# Verde: Verification via Refereed Delegation for Machine Learning Programs

arXiv: https://arxiv.org/abs/2502.19405 · HTML: https://mlsanity.com/paper/2502.19405/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 15 references that are in the map.
- First posted on arXiv 26 Feb 2025.

## Builds on (most cited first, 6 of 6)

- [cuDNN: Efficient Primitives for Deep Learning](https://mlsanity.com/paper/1410.0759/) (2014)
- [Proof-of-Learning: Definitions and Practice](https://mlsanity.com/paper/2103.05633/) (2021)
- [zkLLM: Zero Knowledge Proofs for Large Language Models](https://mlsanity.com/paper/2404.16109/) (2024)
- [Tools for Verifying Neural Models' Training Data](https://mlsanity.com/paper/2307.00682/) (2023)
- [Proof-of-Learning is Currently More Broken Than You Think](https://mlsanity.com/paper/2208.03567/) (2022)
- [A scalable verification solution for blockchains](https://mlsanity.com/paper/1908.04756/) (2019)

## Built on by (most cited first, 9 of 9)

- [Incentivizing Permissionless Distributed Learning of LLMs](https://mlsanity.com/paper/2505.21684/) (2025)
- [VeriLLM: A Lightweight Framework for Publicly Verifiable Decentralized Inference](https://mlsanity.com/paper/2509.24257/) (2025)
- [Hail to the Thief: Exploring Attacks and Defenses in Decentralised GRPO](https://mlsanity.com/paper/2511.09780/) (2025)
- [Hawkeye: Reproducing GPU-Level Non-Determinism](https://mlsanity.com/paper/2603.20421/) (2026)
- [TAO: Tolerance-Aware Optimistic Verification for Floating-Point Neural Networks](https://mlsanity.com/paper/2510.16028/) (2025)
- [Crypto x AI, AI x Crypto: A Survey](https://mlsanity.com/paper/2606.13892/) (2026)
- [OPEN-1B: A Fully Auditable Training Run](https://mlsanity.com/paper/2609.17380/) (2026)
- [Refereed Learning](https://mlsanity.com/paper/2510.05440/) (2025)
- [HadAgent: Harness-Aware Decentralized Agentic AI Serving with Proof-of-Inference Blockchain Consensus](https://mlsanity.com/paper/2604.18614/) (2026)

## Abstract (arXiv)

Machine learning programs, such as those performing inference, fine-tuning, and training of LLMs, are commonly delegated to untrusted compute providers. To provide correctness guarantees for the client, we propose adapting the cryptographic notion of refereed delegation to the machine learning setting. This approach enables a computationally limited client to delegate a program to multiple untrusted compute providers, with a guarantee of obtaining the correct result if at least one of them is honest. Refereed delegation of ML programs poses two technical hurdles: (1) an arbitration protocol to resolve disputes when compute providers disagree on the output, and (2) the ability to bitwise reproduce ML programs across different hardware setups, For (1), we design Verde, a dispute arbitration protocol that efficiently handles the large scale and graph-based computational model of modern ML programs. For (2), we build RepOps (Reproducible Operators), a library that eliminates hardware "non-determinism" by controlling the order of floating point operations performed on all hardware. Our implementation shows that refereed delegation achieves both strong guarantees for clients and practical overheads for compute providers.