Which cryptographic proof-of-work attestations must survive when an agent's compute provider is untrusted?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session's compute is provided by an untrusted third-party infrastructure provider (cloud VM, GPU rental, or decentralized compute network), and the agent must prove to downstream consumers that its computation was executed as claimed, without trusting the provider. Does not apply to sessions running on hardware the operator controls or on attested TEE infrastructure with verifiable enclave quotes.

Core Distinction

The separation between **computation output** (the result the agent produces) and **computation attestation** (cryptographic proof that the computation was performed by the specific algorithm the agent claims, without the provider tampering with inputs or outputs). Relying on output alone creates the **Untrusted Provider Substitution**: the provider substitutes a cheaper computation, modifies the agent's input, or replaces the agent's output, and downstream consumers cannot detect it because they trust the output was legitimate.

What Was Observed

In decentralized compute architectures, failing to preserve computation attestations produces three primary failure modes:

  1. **Result Substitution:** The provider returns a fabricated result that looks plausible but was never actually computed by the claimed algorithm.
  2. **Input Tampering:** The provider modifies the agent's inputs before feeding them to the algorithm, biasing the results.
  3. **Compute Downgrade:** The provider claims to run the specified model but actually runs a cheaper, smaller model, and returns degraded outputs.

Recorded Elements

  1. **`input_commitment_hash`:** The cryptographic hash of the inputs the agent intended to feed to the computation, committed before the provider receives them.
  2. **`output_commitment_hash`:** The cryptographic hash of the outputs the agent received, allowing downstream consumers to verify the output matches what was received.
  3. **`proof_of_computation_receipt`:** A cryptographic proof (e.g., zkSNARK, zkSTARK, or Merkle-based verifiable computation) that the output was produced by the specified algorithm on the committed input.
  4. **`provider_slashing_bond_reference`:** The economic stake the provider posted, which is forfeited if a fraud proof succeeds.

Condition of Validity

* **Applies when:** The compute provider is untrusted, the computation is high-value or high-stakes, and downstream consumers need verifiable proof of correct execution. * **Does not apply when:** The provider is trusted infrastructure the operator controls, or the computation is trivial and its result can be independently verified in O(1) time.

Decision Boundary

  1. **Is the compute provider trusted by the downstream consumer?** If yes, standard output verification applies. If no, proceed to proof requirements.
  2. **Is a `proof_of_computation_receipt` present?** If no, the output cannot be verified. Reject it or accept the risk explicitly.
  3. **Does the proof verify against the `input_commitment_hash` and `output_commitment_hash`?** If no, the computation was tampered with. Reject the output.
  4. **Conversely, when can a downstream consumer accept untrusted compute without proof?** Only when the computation result can be independently verified by re-execution (e.g., deterministic, cheap computation), or the provider's economic stake is large enough that fraud is unprofitable.

Operational Effect

  1. **Verifiable Execution:** Allows downstream consumers to trust computation results from untrusted providers.
  2. **Input Integrity:** Prevents providers from tampering with inputs before computation.
  3. **Result Integrity:** Prevents providers from substituting fabricated outputs.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ComputeVerdict(Enum):
    TRUSTED_PROVIDER = auto()
    PROOF_VERIFIED = auto()
    PROOF_MISSING = auto()
    PROOF_INVALID = auto()

@dataclass(frozen=True)
class ComputeAttestation:
    input_commitment_hash: str
    output_commitment_hash: str
    proof_of_computation: str | None
    provider_stake_amount: int

@dataclass(frozen=True)
class ComputePolicy:
    provider_trusted: bool
    min_stake_for_trust: int
    allow_independent_verification: bool

@dataclass(frozen=True)
class ComputeManifest:
    verdict: ComputeVerdict
    directive: str
    manifest_digest: str

class UntrustedComputeGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_attestation(
        cls, attestation: ComputeAttestation, policy: ComputePolicy
    ) -> ComputeManifest:
        
        # Gate 1: Trusted provider
        if policy.provider_trusted:
            digest = cls._hash(json.dumps({
                "input": attestation.input_commitment_hash,
                "output": attestation.output_commitment_hash,
                "provider": "TRUSTED"
            }, sort_keys=True))
            return ComputeManifest(
                verdict=ComputeVerdict.TRUSTED_PROVIDER,
                directive="PROCEED: Provider is trusted. Output accepted.",
                manifest_digest=digest
            )

        # Gate 2: Independent verification allowed
        if policy.allow_independent_verification:
            digest = cls._hash(json.dumps({
                "input": attestation.input_commitment_hash,
                "output": attestation.output_commitment_hash,
                "verification": "INDEPENDENT"
            }, sort_keys=True))
            return ComputeManifest(
                verdict=ComputeVerdict.PROOF_VERIFIED,
                directive="PROCEED: Computation independently verifiable.",
                manifest_digest=digest
            )

        # Gate 3: Proof presence
        if not attestation.proof_of_computation:
            if attestation.provider_stake_amount >= policy.min_stake_for_trust:
                return ComputeManifest(
                    verdict=ComputeVerdict.PROOF_MISSING,
                    directive=f"WARN: No proof, but provider stake {attestation.provider_stake_amount} >= {policy.min_stake_for_trust}. Accept with slashing risk.",
                    manifest_digest=cls._hash(f"STAKE_ONLY:{attestation.provider_stake_amount}")
                )
            return ComputeManifest(
                verdict=ComputeVerdict.PROOF_MISSING,
                directive="HALT: No proof of computation and insufficient stake. Reject.",
                manifest_digest=cls._hash("NO_PROOF")
            )

        # Gate 4: Proof verified
        digest = cls._hash(json.dumps({
            "input": attestation.input_commitment_hash,
            "output": attestation.output_commitment_hash,
            "proof": attestation.proof_of_computation
        }, sort_keys=True))
        
        return ComputeManifest(
            verdict=ComputeVerdict.PROOF_VERIFIED,
            directive="PROCEED: Proof of computation verified.",
            manifest_digest=digest
        )