How it works, in more detail.

How it works

The server keeps everything that carries meaning: the data, the labels, the architecture, the weights, the non-linearities, the loss and the optimizer. The only thing that leaves is “multiply these two matrices.” That is enough, because almost all of training is matrix multiplication: the forward pass, and the derivatives too. Every product is scrambled and split so no single node learns its inputs, and every answer arrives with a proof.

1. Every matrix product becomes anonymous tasks

   For a layer with input X and weights W, the forward pass needs X times W. The backward pass needs the weight gradient, Xᵀ times the error, and the input gradient, the error times Wᵀ. These are the network’s derivatives, and each one is just another product. Large products are cut into 64-wide tiles, and several mini-batches run at once, so nodes stay busy while the server does its element-wise work. A node cannot tell a forward product from a derivative, or one layer from another.

2. Whole numbers in a prime field, so answers are exact

   The server rounds each row of the first matrix and each column of the second to about 11–12 bits, keeps the scales to itself, and works with whole numbers modulo the prime 2³¹ − 1. Sums stay below half the prime, so the exact integer product is recovered after unblinding. Gradients use stochastic rounding, so rounding noise averages out instead of biasing training.

3. A hiding layer scrambles the matrices

   Before anything is sent, the server pads both matrices up to a power-of-two size, so exact layer sizes are not revealed, then shuffles rows, columns and the shared inner index. It then mixes everything with random butterfly networks: log-depth layers of random 2×2 invertible blocks, the same structure as a fast Fourier transform. Mixing the rows of the first matrix and the columns of the second is undone after the product is combined, and the mixing on the shared inner index cancels inside the product. Nodes compute on a dense matrix with no order, no zeros and no magnitudes to read.

4. Secret sharing hides the operands

   The server draws uniformly random matrices and sends node i the pair Aᵢ = A + αᵢR + αᵢ²R′ + …, Bᵢ = B + αᵢS + αᵢ²S′ + …, with as many random terms as the privacy level T. Node i multiplies its pair, and the products lie on a polynomial of degree 2T whose value at zero is the answer. Any 2T + 1 results pin the polynomial down, and interpolation at zero returns A·B in a single pass. Any T shares are statistically independent of the secret, whatever computing power their holders have. The price is that nodes do 2T + 1 times the arithmetic.

5. A succinct non-interactive proof for every product

   Each node proves its answer with the sumcheck protocol for matrix multiplication. Rather than redoing the product, the verifier checks a random combination of the entries, and that check is reduced round by round to a single evaluation it can compute from the inputs. The random challenges come from hashing the transcript with SHA-256 (the Fiat–Shamir transform), so the proof is non-interactive, needs no trusted setup, and the node can’t pick its randomness after seeing the claim. The proof is about 190 bytes for these tiles. Checking it costs a small fraction of the multiplication itself. A wrong result is accepted with probability about 2⁻¹¹⁷. An independent second implementation of the protocol produces identical proofs, and every forgery attempt in the tests is rejected.

6. WebAssembly does the heavy lifting

   The arithmetic runs as compact WebAssembly modules about 20 KB in size. They multiply small blocks of 31-bit numbers into 64-bit accumulators and reduce modulo the Mersenne prime only occasionally, so nothing overflows and nothing needs a division. There is a SIMD build and a scalar build; SIMD wins clearly on ARM chips and often ties on x86, so each node times both on start-up and keeps the faster. The proof, the hash and the extension-field arithmetic live in the same module. Buffers move between the network and worker threads without copying, and a node runs as many workers as you choose.

7. A tamper-evident receipt for the whole run

   The run starts with a commitment to the dataset, the architecture and the initial weights. Every step then adds a record that links to the previous one by hash, holds the Merkle root of every verified node result used in that step, and fingerprints the full training state. All randomness in a step (which examples, how rounding falls) is derived from the previous record, so the server can’t cherry-pick it, and any stretch of training can be replayed exactly. A node keeps a secret token and can later prove that its result is a leaf of a given step.

8. Fault tolerance and hardening

   A task that times out, or whose node disconnects, goes back to the queue for a node that doesn’t already hold a different share of the same product. Nodes that return an invalid proof are banned. Results with out-of-range values, wrong sizes or replayed proofs are rejected, because every task carries a fresh random tag. Training controls are protected by a private link, connections per address are capped, and the server never sends one node more than one share of a product. Training simply pauses while fewer nodes are connected than shares are needed.