GENLAYER LABS RESEARCH

A brief intro to this exploration:

Some decisions are easy to automate.

A CLEAR RULEDid the payment arrive?

→

ONE ANSWERYES.

The argument

Six questions, one system.

Every chapter below asks one question and answers it. Here are all the answers at once; the rest of the page is the evidence, and each chapter ends with the paper that carries the proof.

00THE MACHINEWhat are we building?A blockchain that can judge.
01MEASURECan you trust a small panel of AI judges?Trust becomes a number.
02AGREEWhen are two AI answers “the same”?The contract declares it.
03ADAPTHow much evaluation should a decision buy?Exactly what the stakes justify.
04SUSTAINWhy can’t the vote be bought with computers?Votes are locked capital.
05ALIGNWho pays to challenge a wrong decision?Whoever the payout makes rational.
06VERIFYDoes the deployed code match the math?Re-checked on every change.

00 · The machine

GenLayer: a blockchain that can judge.

GenLayer is a blockchain whose contracts can act on questions with no provable answer: was the work delivered as promised, did the shipment arrive damaged. Its consensus, Optimistic Democracy: a leader proposes, a panel of validators (each running its own AI model) votes, and the verdict stays open to challenge before turning final.

One decision, end to end.

01MEASURE

Can you trust a decision when evaluators disagree or cheat?

The short answer

Yes — because trust becomes a number. The paper computes exactly how often a small random panel matches its declared pool of judges, even when adversaries sit inside it.

Ask a wide pool of honest evaluators a hard question and 80 might say yes, 20 no. GenLayer only ever asks a small random handful. How far can you trust the handful?

THE IDEA IN PLAIN WORDS

Picture the declared pool of possible judges (the evaluator population). If it leans one way, how often does a small random panel land on the same side? That chance is reproducibility: matching the pool, deliberately not truth. The paper computes it exactly, including a worst case where adversaries always vote against the honest majority.

TRY IT

Change the population, the adversaries, and the panel.

MAKE A PREDICTION

Adversaries flip an 80/20 pool to 70/30. Forty-seven random judges vote. How often do they still land with the honest majority?

Share of honest evaluators choosing YES 80% Share of the population flipped by adversaries 10%

70% YES10% FLIPPED20% NO

Panel size

CHANCE THE PANEL STILL REACHES THE HONEST MAJORITY—

Worst case from the paper’s exact non-adaptive model: every adversarial vote moves against the honest majority.

Go deeper

What the paper proves, exactly

Exact formulas for how often a panel of any size matches the declared pool, with and without corruption, and a way to certify how many future decisions will resolve reproducibly (finite-panel error probabilities, sensitivity surfaces, operational certificates).

Why do larger panels help?

The more judges you sample, the smaller the chance the panel misses the side the whole pool favors.

What makes a decision easier to resolve?

The stronger the pool agrees, the fewer judges a stable result needs.

Does reproducibility mean truth?

No. It means random panels tend to reach the same side as the declared pool. Truth is a separate, empirical question.

What if some evaluators are adversarial?

The paper computes exact worst-case error when a known share of the pool is corrupted before the panel is drawn. Tolerance is measured, not assumed.

READ THE PAPER · AGGREGATE DISAMBIGUATION SYSTEMS ↗

02AGREE

Who decides when two AI answers are the same?

The short answer

The contract does. Every call declares what counts as “the same answer,” and validators judge the leader’s proposal under that declared rule — the Equivalence Principle.

Where does a vote come from? Ask an AI the same question twice and the words come back different. A classical blockchain reads any difference as a fault and rejects honest work.

THE IDEA IN PLAIN WORDS

The fix is the Equivalence Principle: each contract call declares what counts as “the same answer.” The leader does the work and proposes; the others re-run the task and judge under that rule. Declare it well and votes carry judgment. Declare it badly and they turn unanimous but empty, or reject everything honest.

TRY IT

Switch the criterion and watch the vote change.

1 THE CONTRACT DECLARES WHAT COUNTS AS THE SAME ANSWER

llm_call(
  task = "Does the delivered report meet the brief?",
  equivalence = "same verdict as your own re-execution",
)

# or declare: · ·

2 THE LEADER RUNS IT AND PROPOSES

“Meets the brief: pricing and competitors are strong; regulation is thin but present.”

3 FIVE VALIDATORS RE-RUN IT AND VOTE ON THE LEADER’S ANSWER

Go deeper

What the whitepaper specifies, exactly

Per call, the contract declares the criterion under which a validator judges whether the leader’s output is an acceptable answer, possibly against its own re-execution.

Is this real syntax?

No, illustrative. Real GenVM contracts are sandboxed Python classes, but the mechanism (a declared per-call criterion for every AI operation) is exactly as the whitepaper specifies.

Why do two validators reject an honest answer?

Their own re-runs honestly reach the opposite verdict. That is disagreement, not cheating: it is never punished, and the Measure math is built to absorb it.

Who picks the criterion?

The contract developer, per call. Different calls in the same contract can declare different criteria.

Why not just require every validator to get the exact same output?

For AI calls and web reads there is no single right output: two correct summaries differ textually. Deterministic code is still checked byte for byte.

READ THE WHITEPAPER · THE EQUIVALENCE PRINCIPLE ↗

03ADAPT

Why ask a thousand evaluators when a couple dozen will do?

The short answer

Buy exactly the evaluation the stakes justify. At every step — stop, re-check, or start over — the best move is the one with the lowest expected total loss, and the paper computes it.

Every evaluation is paid work. A $200 refund does not deserve a 1,537-judge panel; a $20,000 treasury move might.

THE IDEA IN PLAIN WORDS

At each step the system can stop, buy more judges for the same answer (re-evaluate), or pay for a fresh answer (regenerate). The best move minimizes expected total loss: judge fees plus the average cost of being wrong. The paper computes the ideal benchmark; whether real appeals track it is the Align question below.

TRY IT

How many evaluators should this decision buy?

MAKE A PREDICTION

$2,000 rides on a question where 80% agree. Judges cost 10 cents each. Where is it cheapest to stop?

Pick an example decision

Value at risk if the decision is wrong $2,000 How contested is the question? 80% agree · leaning one way

Each evaluator charges 10¢. Panels come in the protocol’s round sizes, 5 up to 1,537.

Total = fees + risk, per round. Stop where the black line bottoms out.

THE STOPPING RULE—

Go deeper

What the paper proves, exactly

A precise rule for which move carries the lowest expected loss, certificates that stay valid while the answer changes, and a proof that GenLayer’s escalation ladder does less than six times the work of a perfectly informed choice (the G-AE-ADS planner, a six-competitive schedule).

Why can the system start with a small panel?

Most decisions resolve cheaply. Add judges only when the benefit beats the cost.

When is more evaluation worth it?

When the stakes are high enough, or the evidence weak enough, to pay for another look.

Why distinguish checking this answer from trying a new one?

They buy different things: re-checking adds evidence on the same answer; regenerating changes the answer itself. The paper prices each before spending.

Does the live network actually follow this ideal rule?

Not shown here. The rule is a planner’s benchmark; the network matches it only if someone finds the right appeal privately worthwhile. That is exactly what Align studies.

ADAPTIVE ECONOMIC DISAMBIGUATION · PAPER COMING SOON

04SUSTAIN

What stops one actor from running enough nodes to take over?

The short answer

Votes are locked capital, not computers. Taking over means buying — and putting at risk — a huge share of GEN, a token nobody can print at will.

So far we assumed votes are hard to buy. But computers are cheap: one person can run a thousand nodes.

THE IDEA IN PLAIN WORDS

So votes belong to locked GEN, a token nobody can print at will. A validator locks at least 42,000 GEN it can lose (stake); anyone else can attach GEN to a validator they trust (delegation). Taking over means buying a huge share of all GEN and parking it where the network can burn it (slashing).

WATCH IT

Watch the same attacker try to take over in two different worlds.

WORLD 1 · ONE NODE, ONE VOTE Fake voters are free, so the attacker prints them

spawning fake voters, each costing about $0…

WORLD 2 · GENLAYER: ONE LOCKED TOKEN, ONE VOTE Every vote must lock GEN, a token nobody can print at will

SHARE OF ALL GEN THE ATTACKER HAS HAD TO BUY

same attack here: buy and lock 0% of all GEN. Cheat, and that stake burns (slashing).

From the paper’s pinned tables: 42,000 GEN validator minimum, 42 GEN delegation minimum, 7-epoch unbonding, up to 5% fraud slash.

Go deeper

What the paper specifies, exactly

The economic engine beneath the court: a fixed 4.2B GEN genesis supply, issuance declining from 9% toward 4% (a ceiling, not a promise), rewards from fees plus issuance, staking rules, and penalties that never slash honest disagreement, only provable misconduct.

Where does the money that pays validators come from?

Two streams: transaction fees, plus issuance declining from 9% toward 4% on a fixed curve (a ceiling; burns can only lower it). The DAO is funded from fees alone, so its income tracks real usage.

What actually gets a validator punished?

Honest error and misconduct are priced apart. Losing a vote burns only fee-sized amounts, never principal. Idleness slashes 1%, provable fraud slashes the leader 5%, and a failed appeal forfeits its bond. Disagreement is absorbed; misconduct is punished.

Does the square-root weighting stop Sybils by itself?

No, and the paper says so. The concave weight only dampens concentration; what stops splitting is that every identity must lock the full 42,000 GEN, run its own node, and face its own slashing.

Can I earn rewards without running a validator?

Yes. Delegate 42 GEN or more and rewards auto-compound. No commissions to shop for: the protocol fixes the split, and every GEN in a validator’s position earns the same rate.

GEN TOKENOMICS · PAPER COMING SOON

05ALIGN

Who pays to challenge a wrong decision?

The short answer

Whoever the payout makes it rational for. The appeal reward has a narrow safe window: big enough that informed doubts act, small enough that blind spam still loses money.

Remember the 3-2 vote? Decisions that close deserve a second look. But a challenger must lock money (a bond) and risk losing it. Why volunteer?

THE IDEA IN PLAIN WORDS

The paper separates two things that sound alike: when the system needs another panel, and when a private person profits from triggering one. They diverge both ways: missed appeals (nobody pays) and junk appeals (someone pays needlessly). The payout is the lever: too small and doubts stay silent; too large and blind challenges become a business.

TRY IT

The payout decides which doubts are worth acting on.

Successful appeal returns 2.5× the bond

WHO WILL CHALLENGE—

Go deeper

What the paper proves, exactly

An exact price on the gap between the ideal stopping rule and real appeal behavior (implementation regret), a proof that no fixed bond and reward fits every workload, and the conditions under which a calibrated payout closes the gap.

What makes someone willing to appeal?

Their odds of winning, the reward, the bond at risk, the cost of appealing, and any private stake in the outcome.

Can we design incentives so useful appeals actually happen?

Under conditions, yes. The paper shows how to calibrate rewards so private incentives track when the system benefits from another panel.

Why are multiple potential appellants important?

Once many people can appeal, their choices interact: waiting, racing, duplicated effort. The mechanism must price all three.

Why not just raise the appeal bond to keep out frivolous appeals?

A bigger bond funds the panel and deters spam, but it locks capital: the payoff math can stay identical while the pool of people who can afford to appeal shrinks sharply.

MULTI-AGENT APPEAL GAMES · PAPER COMING SOON

06VERIFY

Does the protocol actually behave as designed?

The short answer

It is re-checked on every change. A machine-checked model of Optimistic Democracy runs against the deployed contracts as they evolve — and it has already caught real bugs.

Everything above is math about a design; the network runs code that changes weekly. So a machine-checked model of Optimistic Democracy (model checking in TLA+) is re-checked against the contracts as they evolve.

253commits of protocol evolution re-checked against the same machine-verified properties. 1race caught between two code paths handling the same appeal event. 3protocol invariants a single hotfix had silently broken, found by model checking. All findings confirmed in the implementation and reported upstream.

Go deeper

What does the verification actually cover?

A layered model: a canonical state graph, TLA+ specifications checked against it, and a mapping from every transition to the Solidity code of a pinned revision.

Does this prove the code has no bugs?

No. It proves stated properties about a stated model of a pinned revision. That scoping is what makes the claims checkable at all.

Why re-verify instead of proving once?

The protocol keeps evolving. Each revision is re-checked against the same properties, so silent drift shows up as a failed check, not a production incident.

Has the harness ever caught anything real?

Yes: the race and the three broken invariants above. All confirmed in the implementation and reported upstream.

LAYERED FORMAL VERIFICATION · PAPER COMING SOON

THE CORE RESEARCH