How to Verify Machine Learning Training You Did Not Run

The Core Method: Held-Out Validation by Independent Parties

To validate ML training you did not run, score the submitted model or update on a held-out dataset the trainer never had access to, using evaluators who are independent of the trainer, and accept the result only when a supermajority of evaluators agree. This is outcome verification: instead of proving every training step was executed faithfully, you prove the thing that actually matters, that the model got better on unseen data. It is cheap, one inference pass per evaluator per epoch, and it is robust to how the training was done. QBC implements exactly this loop live: DiLoCo-pattern workers submit signed updates, validators each measure held-out loss, and a 2/3 quorum finalises the epoch on-chain. The design borrows a very old scientific instinct: do not audit the lab notebook, rerun the measurement. Everything else on this page, quorums, signatures, rollback, exists to make that one measurement trustworthy at network scale.

Why Recomputing Training Is a Dead End

The naive answer to verification is re-execution: run the same steps and check you get the same weights. For real training this fails twice. First, cost: re-executing training costs roughly as much as the training itself, so verification would double the bill, and doing it redundantly across many verifiers multiplies it. Second, determinism: GPU kernels, parallel reductions, and framework versions make bitwise reproducibility genuinely hard, so even honest re-execution can mismatch. Zero-knowledge ML is the principled fix and worth watching, but in 2026 proving a real LLM training step in zk remains research-stage, orders of magnitude too slow for production runs. Optimistic schemes with fraud proofs, explored by several decentralised compute networks, reduce cost but inherit the determinism problem and add dispute latency. Outcome verification sidesteps all of it: nobody replays anything, evaluators only need the update, the held-out set, and an inference pass. That trade is why it ships today while process verification largely does not.

Held-Out Loss as an Objective Scoreboard

Held-out loss works as a verification signal because it is a single number, computed from data contributors cannot see, that moves in the right direction only when the model genuinely generalizes better. On QBC every training epoch gets scored this way, and the scoreboard is public: the live curve at qbc.network/aether-net shows held-out loss for the attested series, which is down more than 75 percent since the loop went live. That figure is deliberately conservative evidence, loss on unseen data, not cherry-picked benchmarks. The same discipline showed up when the served model was evaluated: GSM8K improved about 10 points over the frozen base while MMLU held flat, reported together because honest decentralised training must show what did not improve alongside what did. A falling held-out curve cannot prove every contributor was honest, but it proves the aggregate process is producing real learning, which is the claim buyers and users actually care about.

Quorum Attestation: Making the Measurement Trustless

A single evaluator can lie, so the measurement itself must be decentralised. On QBC each validator independently computes held-out loss for the epoch, signs its attestation, and the epoch finalises only when at least 2/3 of validators agree. That threshold mirrors Byzantine fault tolerant consensus for the same reason it works in GRANDPA finality: with fewer than one third faulty parties, agreement implies correctness. Attestations and training submissions are signed with CRYSTALS-Dilithium5, the FIPS 204 post-quantum standard, so the audit trail stays valid even against future quantum adversaries, a property covered in depth under post-quantum blockchain security. Once finalised, the epoch record is permanent chain state: who contributed, what the measured loss was, who attested, what was paid. The threshold also degrades gracefully: one crashed or dishonest evaluator can neither block nor forge an epoch, and any attestation later shown false is a signed, attributable artifact its author cannot disown. Verification stops being a courtesy the operator extends and becomes a protocol rule that rewards cannot bypass.

Handling Poisoned and Regressive Updates

Open contribution invites bad updates, whether malicious poisoning or honest bugs. Outcome verification handles both with one mechanism: if an aggregated epoch fails to improve, or degrades, the held-out measurement, the update rolls back and the contributors earn nothing. There is no negotiation and no ban list to maintain; economic gravity does the filtering, since attacking the model costs compute and pays zero. This is a meaningfully different posture from process-verified systems, which must detect the poisoned step itself, and from reputation systems, which attackers farm. Rollback also bounds blast radius: the canonical model only ever advances through epochs that measurably helped, so the integrity of the released model is a chain of positive measurements back to the base. The residual risk is subtler attacks that improve held-out loss while embedding targeted behavior, an open research area we track honestly rather than claim solved; defense in depth here includes dataset curation and the quorum evaluators using diverse held-out sets.

An Audit Trail Regulators Can Actually Read

Verification is not only an adversarial concern; it is becoming a compliance one. The EU AI Act asks providers of general-purpose models for documentation about training and evaluation, and an on-chain record of signed contributions, measured held-out performance, and quorum attestations is documentation that cannot be quietly rewritten later. QBC anchors the served model itself the same way: the manifest root of the exact 7B artifact is quorum-attested on-chain at block 1,097,990, so the audit trail runs from individual training rounds to the deployed weights. Teams building for EU AI Act compliance can treat this as an existence proof: verifiable training telemetry is practical today at small scale on commodity hardware. It does not replace legal review, and no chain can attest what happened off-chain before submission, but it converts the weakest part of most AI audits, trust in the provider's own logs, into public, replayable evidence.

From Measurement to Money: The First Paid Epoch

Verification only matters if something depends on it, and on QBC rewards do: no epoch pays until the quorum attests the measurement. The loop closed end to end when the first rewarded epoch settled on-chain, with the RewardDistributor contract paying contributors against an attested held-out result; the first paid epoch writeup is the receipt, tracing the path from worker submissions to the payout transaction. Two properties of that path are worth noticing. First, settlement inherits deterministic finality: once the epoch record finalises, neither the measurement nor the payment can be quietly rewritten, which is what makes the record evidence rather than a log. Second, the payment is small, fractions of QBC per round, and the network says so plainly; the point being proven is the mechanism, not the yield. The broader argument, that provable mechanisms beat impressive claims, is made directly in proof, not promises, and the walkthrough in AI you can audit on-chain shows a third party checking an epoch without anyone's permission.

Honest Limits: What This Verification Cannot See

A verification design earns trust by stating its blind spots. Held-out measurement scores aggregate epochs, so it cannot attribute credit or blame perfectly within a round; a free-riding worker whose update contributed little still shares an epoch that verified. The held-out sets themselves must stay unpredictable, because a leaked evaluation set converts the scoreboard into a target. The evaluator set is small today, 4 validators across 3 machines, which QBC states rather than hides: a 2/3 quorum of a small permissioned set is meaningful accountability, not decentralization theater, and the permissionless machinery, registry, staking, and sortition, is built and being scale-proven on the validator roadmap. And no outcome measurement can see intent: an update that improves loss while embedding subtle targeted behavior remains an open research problem across all of ML, mitigated here by rollback, evaluator diversity, and the attested model registry that pins exactly which artifact users receive. Scale receipts exist too: the loop has run past a million steps, documented in the training milestone log, under these same constraints.