Today, most people obtain AI inference by buying it from a small number of organizations that run large data centers, while many GPUs owned by individuals and small institutions sit idle for much of the day. Bitcoin showed that strangers can contribute resources under shared rules and receive checkable rewards, but it relies on an asymmetry: proof-of-work is expensive to produce and cheap to verify. Useful inference has no such asymmetry. We propose the Open Inference Market (OIM), which replaces the missing asymmetry with an economic mechanism. A worker delivers a result without knowing whether it will be audited; its unsettled earnings serve as collateral during a challenge window; and confirmed cheating forfeits all of it. We call this principle earnings as collateral. In a simplified model we show three things. The number of audits needed for deterrence is a constant per worker per day, independent of the worker's throughput, so the audited share falls as the network gets busier. A new worker can join with a short period of intensive auditing and a very small bond. And whether the mechanism works at all depends only on the ratio of the audit judge's false-flag rate to its detection rate. Under example parameters, about 0.3 replays per worker per day are enough to make cheating unprofitable for a rational worker. On this basis we lay out a path that hands four powers back to participants one at a time: owning compute, writing history, judging work, and releasing value. A compute center need not be a building; it can be a protocol that anyone can join.
Figures & tables
Figure 1: One OIM transaction. Roles are logically separate; one operator may hold several at first and hand them over as in Section 7 . Receipts make every job accountable; audits selected only after results are submitted prevent cheaters from timing their behaviour; and the confirmation window turns unsettled earnings into collateral.
Figure 2: Feasible audit rates under earnings as collateral ( γ=1 , d=0.9 , ε=1% ; values generated by evidence/model.py ). Blue lines are the lower bound required by Proposition 1 ; red lines are the participation upper bound of Proposition 2 ( λ=2,000 ). Both fall together as collateral grows, so the green feasible band has the same width at every worker age and is set only by the judge’s f/d . At f=10−2 the upper bound lies below the lower bound and no feasible audit rate exists.
Stage
Power handed over
How
Evidence to publish
S1 External supply
Owning compute
The operator offers one interface, dispatches consented public-tier jobs to admitted independent GPUs, and is answerable for delivery and payment
Share of jobs served by independent owners; full cost and failure rate per successful job
S2 Checkable accounts
Writing history
Every job has a pre-dispatch commitment and a co-signed receipt, written to an append-only log observed by independent monitors
Re-checkable receipt samples; detection of omitted or conflicting records
S3 Independent audit
Judging work
Public randomness selects audits; auditors outside the gateway sign appealable verdicts under audit contracts
d and f by model and hardware; audit cost and dispute resolution time
S4 Portable settlement
Releasing value
Multiple operators accept one set of quotes, receipts, verdicts, and forfeiture rules, strengthened where useful by a shared ledger or on-chain anchoring
Cross-operator payouts and final outcomes of disputes
Table 1: The trust handover path. The four dimensions are independent; progress on one does not complete the others, and each stage can be started and checked on its own.
AI model marketplaces host providers with heterogeneous costs and capabilities. These differences create an opportunity for computational arbitrage (Olmedo et al., 2026), in which an intermediary purchases inference from a portfolio of models and resells it to users at a profit. Beyond creating profit opportunities for the arbitrageur, computational arbitrage offers financial value to both consumers and providers and could therefore significantly influence AI model markets. While prior work empirically demonstrates the feasibility of computational arbitrage for small model pools, scaling it to large marketplaces requires arbitrage strategies that are both computationally tractable and inexpensive to identify and deploy. In this work, we formalize computational arbitrage as an allocation problem and prove that it is generally NP-hard. However, we show that the optimal allocation can be computed efficiently under a natural diminishing-returns condition on how model performance scales with inference spending. We further develop a sample-efficient method for estimating model performance from limited data, reducing the upfront cost of identifying arbitrage strategies. Our analysis also yields several economic insights: at the optimum, every funded model delivers the same marginal utility per dollar; arbitrage directs revenue away from providers offering little utility relative to their prices; and it rewards complementary specialization.
Nastaran Okati, Ricardo Olmedo, Moritz Hardt
Max Planck Institute for Intelligent Systems, and Tübingen AI Center
Verifying claims about AI workloads is a prerequisite for credible AI governance of covert adversaries (who comply with monitoring only when detection likelihood is high), yet the apparent non-determinism of GPU floating-point arithmetic forces auditors to accept approximate output matches. Covert adversaries can exploit unverifiable degrees of freedom in monitored computation. Attack vectors include steganography, unreported modification of inference software, and covert computation via unreported batch elements. Empirically, we analyze how modern inference engines (vLLM, HF transformers) produce deterministic but non-invariant outputs, without needing to set performance-compromising determinism flags, if the right information is available for re-computation and no atomic functions are called in the backend. We demonstrate that such bitwise-precise re-computation does not require access to identical hardware, via a software-only emulation of LLM inference across multiple NVIDIA GPU variants. Thus, accumulated rounding errors can be an auditable signature of the software and hardware setup used for inference, instead of a constraint on verifiability.
Test-time compute has emerged as a promising strategy to enhance the reasoning abilities of large language models (LLMs). However, this strategy has in turn increased how much users pay cloud-based providers offering LLM-as-a-service, since providers charge users for the amount of test-time compute they use to generate an output. In our work, we show that the market of LLM-as-a-service is socially inefficient: providers have a financial incentive to increase the amount of test-time compute, even if this increase contributes little to the quality of the outputs. To address this inefficiency, we introduce a reverse second-price auction mechanism where providers bid their offered price and (expected) quality for the opportunity to serve a user, and users pay proportionally to the marginal value generated by the winning provider relative to the second-highest bidder. To illustrate and complement our theoretical results, we conduct experiments with multiple instruct models from the Llama and Qwen families, as well as reasoning models distilled from DeepSeek-R1, on math and science benchmark datasets.
Ander Artola Velasco, Dimitrios Rontogiannis, Stratis Tsirtsis +1
Max Planck Institute for Software Systems, Kaiserslautern, Germany · Hasso Plattner Institute, Potsdam, Germany