{"version":1,"id":"proof-of-useful-work","title":"Proof of Useful Work","summary":"Proof of Useful Work is a consensus approach that uses computation to secure a network while producing useful results, such as machine-learning inference or application computations.","content":"**Proof of Useful Work** (PoUW) is a family of approaches that aim to make computation performed to secure a [blockchain](https://iq.wiki/wiki/blockchain) also produce a useful result, such as an artificial-intelligence inference or a solution to a delegated problem. Unlike conventional [proof of work](https://iq.wiki/wiki/proof-of-work-pow) (PoW), in which miners perform computation—typically repeated hashing—to compete to propose [blocks](https://iq.wiki/wiki/block), PoUW aims to give that computation a purpose beyond securing the network. PoUW is not one protocol: proposals differ in what counts as useful work, how results are verified, and whether the work replaces all or only some conventional [mining](https://iq.wiki/wiki/mining) computation.[\\[1\\]](#cite-id-4m652nyzgs)​[\\[2\\]](#cite-id-heu9qsbglo)​\n\n## Overview\n\nA PoUW design seeks to combine three properties: the work should have value to someone, performing it should add little overhead beyond completing the task, and producing a valid proof should require work comparable to that of an honest participant. These goals can conflict. For example, adapting a task to fit a [block](https://iq.wiki/wiki/block)’s context or [mining](https://iq.wiki/wiki/mining) difficulty may change it in ways that reduce its external value. Large task inputs can also increase storage, bandwidth, and verification costs.[[3]](#cite-id-eopmvg9mll)[[2]](#cite-id-heu9qsbglo)\n\nThe 2026 survey of useful-computation alternatives groups their requirements into [blockchain](https://iq.wiki/wiki/blockchain) “backbone” properties, block-proposal properties, and properties of the tasks themselves. These include chain safety and progress, fair allocation of [block](https://iq.wiki/wiki/block) proposals, task hardness, efficient verification, adjustable difficulty, and resistance to reusing work across tasks. The survey also distinguishes **strong usefulness**, in which someone wants a particular problem instance solved, from **weak usefulness**, in which someone wants a solution to any instance in a task class. Strongly useful tasks generally need an external supplier, while weakly useful tasks may be generated by the system.[[2]](#cite-id-heu9qsbglo)\n\nTask design poses additional problems. An easy instance can undermine [mining](https://iq.wiki/wiki/mining) competition; deterministic or progressively improving algorithms can advantage more experienced solvers; and a supplier might collude with a solver who has already computed an answer. Large inputs may also be difficult to store or distribute. Some work can be amortized across instances: the survey gives Fibonacci computation as an example. By contrast, optimization tasks may be difficult to verify without effectively solving them again. These issues mean that showing a computation has been performed is not, by itself, enough to show that it secures a [blockchain](https://iq.wiki/wiki/blockchain) as intended.[[2]](#cite-id-heu9qsbglo)\n\n## Early Constructions\n\nProofs of work predate [blockchain](https://iq.wiki/wiki/blockchain) systems: Dwork and Naor proposed computational pricing in 1992, and [Adam Back](https://iq.wiki/wiki/adam-back) proposed Hashcash in 1997. [Bitcoin](https://iq.wiki/wiki/bitcoin) later used hash-target [mining](https://iq.wiki/wiki/mining) to make [block](https://iq.wiki/wiki/block) production costly and help protect its ledger. Earlier ideas for directing [mining](https://iq.wiki/wiki/mining) effort toward other tasks included Primecoin’s searches for prime chains and Permacoin’s use of mining for archival storage.[[4]](#cite-id-gipwlk2375)[[5]](#cite-id-i2oemy9k18)\n\nA theoretical construction by Marshall Ball, Alon Rosen, Manuel Sabin, and Prashant Nalini Vasudevan developed proofs based on fine-grained computational problems, principally Orthogonal Vectors (OV) and its generalization, \\(k\\)-OV. In their framework, a challenge is generated from a delegated problem; a solver supplies a compact proof, and a verifier checks it and reconstructs the answer. Under conjectured hardness assumptions, the authors sought constructions with near-quadratic or tunable higher-order solving costs, but near-linear verification and reconstruction. The paper also considered 3SUM and All-Pairs Shortest Path as possible bases for similar schemes.[[5]](#cite-id-i2oemy9k18)\n\nThe construction addressed the risk that miners could reuse one computation across many challenges: its authors analyzed whether solving multiple independently generated instances could be amortized. They also proposed a [blockchain](https://iq.wiki/wiki/blockchain) arrangement in which delegators post problems to a public board and workers attach proofs to [blocks](https://iq.wiki/wiki/block). The paper’s blockchain design was a proposal, not a report of a deployed network.[[5]](#cite-id-i2oemy9k18)\n\n## Matrix-Multiplication Mining\n\n### cuPOW and the Pearl Network\n\nA later approach uses matrix multiplication, a core operation in machine-learning inference. Ilan Komargodski and [Omri Weinstein](https://iq.wiki/wiki/omri-weinstein)’s cuPOW protocol is designed so that miners can use matrix multiplications they already want to perform as [blockchain](https://iq.wiki/wiki/blockchain) work. Its central technique adds seed-dependent, low-rank random noise to input matrices, has the miner compute the perturbed product in [blocks](https://iq.wiki/wiki/block), and uses the intermediate partial products as a transcript of the computation. The miner removes the noise to recover the requested product; a verifier recomputes the transcript and checks its hash against a difficulty target.[\\[3\\]](#cite-id-eopmvg9mll)​\n\nThe construction encodes the noise as products of smaller matrices. For an (n \\times n) computation, the paper describes a transcript containing ((n/r)^3) intermediate (r \\times r) matrices, where (r) is smaller than (n). Encoding and decoding are stated to cost (O(n^2r)), compared with (O(n^3)) for naïve square matrix multiplication. The authors claim an asymptotic overhead of (1+o(1)) relative to that baseline. Their security argument depends on a conjecture about the difficulty of computing batches of intermediate values for random low-rank matrices; it is a stated assumption, not a proved impossibility of shortcuts.[\\[3\\]](#cite-id-eopmvg9mll)​[\\[4\\]](#cite-id-gipwlk2375)​\n\nThe authors distinguish this transcript-based approach from simply checking whether a product is correct. Freivalds’ algorithm can probabilistically verify a matrix product with less computation than performing the multiplication, but the Pearl Research blog argues that correctness verification alone does not demonstrate how much work a miner performed or provide an adjustable [mining](https://iq.wiki/wiki/mining) difficulty. The blog also contrasts cuPOW with zero-knowledge proofs for machine-learning inference, citing reported proving times for GPT-2- and 13-billion-parameter models that it considers too slow for production-scale inference.[\\[6\\]](#cite-id-i50e7s22ny)​\n\nPearl describes its [Layer 1](https://iq.wiki/wiki/layer-1) network as using general matrix multiplication (GEMM) for AI inference, with miners operating GPUs rather than specialized hashing ASICs. In its design, the same computation serves an AI client and contributes to [blockchain](https://iq.wiki/wiki/blockchain) security; miners may receive [block rewards](https://iq.wiki/wiki/block-reward) and inference fees. Pearl reports that its proof-of-useful-work kernel adds 5.08% end-to-end overhead for Llama 70B across four H200 GPUs and 3.9% for DeepSeek V3.2 across eight H200 GPUs. The blog says the system uses integer hardware with W7A7 quantization, GPTQ, and SmoothQuant, with native floating-point support in development.[\\[6\\]](#cite-id-i50e7s22ny)​\n\nA separate cuPOW paper reports GPU benchmarks for integer matrix multiplication, comparing its implementation with cuBLAS and vLLM on selected model workloads. In those tests, cuPOW remained in a similar performance range to the comparison systems but did not match cuBLAS latency in the listed cases; it was faster than vLLM in some of them. The paper presents these as implementation benchmarks, distinct from the protocol’s asymptotic overhead analysis.[\\[4\\]](#cite-id-gipwlk2375)​\n\nThe [Pearl](https://iq.wiki/wiki/pearl) blog also describes PRL, the network’s native token, as being issued through verified GPU computation used for inference. It argues that GPU capacity and demand for inference constrain issuance and connect token economics to AI-compute markets. These are the project’s own economic claims. A 2026 floating-point scheme specification described by the Consortium for Verified Computing adapts the matrix-multiplication approach to FP8 GPU computation, while noting that the construction does not establish the origin of the matrices being processed.[\\[6\\]](#cite-id-i50e7s22ny)​[\\[1\\]](#cite-id-4m652nyzgs)​\n\nThe same Consortium for Verified Computing account reports that an independent 2026 study measuring Pearl’s cuPOW protocol on its [mainnet](https://iq.wiki/wiki/mainnet) found that random matrices passed verification. The finding raises a distinction between verifying that a computation was performed and establishing that its inputs served an external customer or useful task.[\\[1\\]](#cite-id-4m652nyzgs)​\n\n### Qubic’s Useful Proof of Work\n\nQubic uses the name Useful Proof of Work (UPoW) for a different arrangement. Its documentation describes “Computors”—[validators](https://iq.wiki/wiki/validator) backed by miners, also called AI miners—as performing artificial-neural-network training tasks. Examples include processing large datasets and training models on specific problems. A Computor’s ranking for each one-week epoch depends on how effectively its miners solve the assigned problems; stronger performance can result in a higher ranking and potentially higher earnings.[\\[7\\]](#cite-id-achij5axih)​\n\nQubic’s documentation says miners generate neural networks with randomly structured connections and vary their parameters, while Aigarth analyzes the networks’ properties. The described research stage collects samples and looks for patterns that might inform further development. The documentation presents the work as an exploration of neural-network structure, particularly connectivity, and discusses a possible “sweet spot” in removing connections before performance declines. It also claims that training can be optimized for ordinary hardware and may use less energy per computational unit than traditional PoW; these are stated potential benefits of Qubic’s approach, not properties shared by all PoUW systems.[\\[7\\]](#cite-id-achij5axih)​\n\n### Internet Computer\n\nThe [Internet Computer](https://iq.wiki/wiki/internet-computer-icp) uses “Proof of Useful Work” for its membership-and-consensus model. Rather than relying on hashing, standardized [node](https://iq.wiki/wiki/node) machines perform application computation, including canister computations represented in transaction [blocks](https://iq.wiki/wiki/block). The model treats purchasing, hosting, and operating [node](https://iq.wiki/wiki/node) hardware as stake, and expects nodes to perform roughly equal amounts of work; statistical deviations in [block](https://iq.wiki/wiki/block) production can lead to punishment.[\\[8\\]](#cite-id-qf6knrimzw)​\n\nThe Internet Computer’s on-chain Network Nervous System (NNS) configures the network, upgrades node software, combines nodes into subnets, and governs node admission and removal. It selects nodes according to provider, data center, geography, and jurisdiction, and can remove statistically deviating nodes from a subnet. The model also relies on chain-key cryptography and advanced consensus protocols to connect subnets into one network. This is a network-governance and node-selection design, not the matrix-multiplication [mining](https://iq.wiki/wiki/mining) method used by cuPOW.[\\[8\\]](#cite-id-qf6knrimzw)​\n\n## Other Proposed Systems\n\nScaloWork is a proposed PoUW framework that replaces hash [mining](https://iq.wiki/wiki/mining) with computation of minimum dominating sets in graphs. A utility company supplies a graph and offers remuneration for a solution; [mining pools](https://iq.wiki/wiki/mining-pool) collaborate to find a small dominating set, and the winning pool proposes a [block](https://iq.wiki/wiki/block). An auditing committee selects and assesses graph instances, while isomorphic instances are assigned to different pools to make copying another pool’s solution harder. The design includes pool-level work allocation intended to identify participants who claim rewards without contributing.[[9]](#cite-id-3c48rbyh3s)\n\nScaloWork’s authors describe a prototype tested on synthetic graphs of up to five million vertices. In their experiments, it handled graphs with average degree up to 75 within a 15-minute cutoff, while the tested average-degree-100 cases exceeded that limit. The authors compare the design with Chrisimos, an earlier dominating-set proposal, and present ScaloWork as a prototype rather than a deployed [blockchain](https://iq.wiki/wiki/blockchain) system.[[9]](#cite-id-3c48rbyh3s)\n\n## Economic and Security Debate\n\nPoUW’s useful output does not automatically translate into stronger economic security. In a 2025 systematization of knowledge that examined more than 50 constructions, Pratyush Dikshit, Ashkan Emami, Johannes Sedlmeir, and Gilbert Fridgen concluded that the external economic or societal value of useful computation does not necessarily contribute to a [blockchain](https://iq.wiki/wiki/blockchain)’s security budget. They recommended designs involving verifiable computation, partial allocation of incentives, and difficulty adjustment that accounts for task utility.[[10]](#cite-id-5d1zavmy28)\n\nA 2026 economic model by Rafael Pass studies a matrix-multiplication PoUW system in which GPUs can perform [mining](https://iq.wiki/wiki/mining), inference, or both. The model assumes competitive entry, a fixed token reward per [block](https://iq.wiki/wiki/block), a market price for inference, and efficiency parameters for hybrid mining-and-inference work. It distinguishes the value of [block rewards](https://iq.wiki/wiki/block-reward) from the inference market and identifies conditions under which hybrid work replaces separate [mining](https://iq.wiki/wiki/mining) and inference. The paper names the resulting regimes “Bitconia,” “Fortessia,” and “Duplexia.” These are outcomes of the paper’s model, not labels for deployed network modes.[[11]](#cite-id-1i3s4sjp0y)\n\nIn the model, efficient hybrid work can replace some computation that would otherwise be spent solely on mining. In Duplexia, [block rewards](https://iq.wiki/wiki/block-reward) subsidize inference, lowering its modeled price and potentially expanding inference supply when demand is elastic. Pass argues that, under his stated measure, the cost of a majority attack remains equal to half the block-reward value across the model’s regimes; if an attacker can redeem only part of the rewards, the modeled cost falls in proportion to the redeemable share. The paper therefore challenges the claim that useful output necessarily makes majority attacks cheaper, while noting that its conclusions depend on its assumptions and attack-cost definition.[[11]](#cite-id-1i3s4sjp0y)\n\nThe model’s social-value results are also conditional. At the same block-reward value, Pass concludes that Duplexia produces greater net social value than Bitcoin-style mining because it also produces inference valued by consumers. At a fixed ratio between token rewards and inference-market spending, however, the paper says that avoided mining waste must outweigh duplex overhead and the deadweight loss from subsidized inference for PoUW to dominate.[[11]](#cite-id-1i3s4sjp0y)\n\nBroader reviews identify persistent trade-offs between usefulness and consensus requirements. A 2026 survey in *ACM Computing Surveys* reported that, at the time of writing, no surveyed system completely replacing cryptopuzzles with useful work had been deployed and that none met all the properties it assessed. A 2025 systematic literature review selected 53 primary studies and classified reported advantages and disadvantages across PoUW consensus proposals.[[2]](#cite-id-heu9qsbglo)[[12]](#cite-id-z5dfljuqmr)\n\nTogether, these assessments distinguish a protocol’s ability to verify computation from the harder questions of whether that computation is externally useful, difficult to shortcut, fairly allocated, and sufficient to preserve the security and operation of a [blockchain](https://iq.wiki/wiki/blockchain).[[2]](#cite-id-heu9qsbglo)[[10]](#cite-id-5d1zavmy28)","categories":[{"id":"glossary","title":"glossary"}],"tags":[],"images":[{"id":"QmVpeZY45HXmuLQqvKcW3j4TMnDmvSJykaCstX3dkfjRdA","type":"image/jpeg, image/png"}],"media":[],"metadata":[{"id":"references","value":"[{\"id\":\"4m652nyzgs\",\"url\":\"https://consortiumforverifiedcomputing.org/atlas/proof-of-useful-work\",\"description\":\"Overview of proof of useful work\",\"timestamp\":1792162258770},{\"id\":\"heu9qsbglo\",\"url\":\"https://dl.acm.org/doi/full/10.1145/3828717\",\"description\":\"2026 survey of useful-work PoW\",\"timestamp\":1792162258770},{\"id\":\"eopmvg9mll\",\"url\":\"https://arxiv.org/html/2504.09971v4\",\"description\":\"cuPOW protocol paper\",\"timestamp\":1792162258770},{\"id\":\"gipwlk2375\",\"url\":\"https://drops.dagstuhl.de/storage/00lipics/lipics-vol388-esa2026/LIPIcs.ESA.2026.2/LIPIcs.ESA.2026.2.pdf\",\"description\":\"ESA 2026 paper on matrix-multiplication PoUW\",\"timestamp\":1792162258770},{\"id\":\"i2oemy9k18\",\"url\":\"https://eprint.iacr.org/2017/203.pdf\",\"description\":\"Theoretical paper on useful-work proofs\",\"timestamp\":1792162258770},{\"id\":\"i50e7s22ny\",\"url\":\"https://pearlresearch.ai/research/blog/proof-of-useful-work\",\"description\":\"Pearl Research account of cuPOW\",\"timestamp\":1792162258770},{\"id\":\"achij5axih\",\"url\":\"https://docs.qubic.org/learn/upow/\",\"description\":\"Qubic UPoW documentation\",\"timestamp\":1792162258770},{\"id\":\"qf6knrimzw\",\"url\":\"https://internetcomputer.org/wiki/proof-of-useful-work/\",\"description\":\"Internet Computer PoUW overview\",\"timestamp\":1792162258770},{\"id\":\"3c48rbyh3s\",\"url\":\"https://arxiv.org/html/2504.14328\",\"description\":\"ScaloWork proposal\",\"timestamp\":1792162258770},{\"id\":\"5d1zavmy28\",\"url\":\"https://eprint.iacr.org/2025/1814\",\"description\":\"Systematization of PoUW research\",\"timestamp\":1792162258770},{\"id\":\"1i3s4sjp0y\",\"url\":\"https://arxiv.org/abs/2606.06700\",\"description\":\"Pass’s economic model of PoUW\",\"timestamp\":1792162258770},{\"id\":\"z5dfljuqmr\",\"url\":\"https://www.sciencedirect.com/science/article/pii/S2096720925001149\",\"description\":\"Systematic review of PoUW consensus\",\"timestamp\":1792162258771}]"},{"id":"main-image-origin","value":"{\"imageId\":\"QmVpeZY45HXmuLQqvKcW3j4TMnDmvSJykaCstX3dkfjRdA\",\"originalId\":\"QmVpeZY45HXmuLQqvKcW3j4TMnDmvSJykaCstX3dkfjRdA\"}"},{"id":"commit-message","value":"Add Proof of Useful Work wiki"}],"events":[],"linkedWikis":{"founders":[],"blockchains":[],"speakers":[]},"user":{"id":"0x8af7a19a26d8fbc48defb35aefb15ec8c407f889"},"author":{"id":"0x1E23b34d3106F0C1c74D17f2Cd0F65cdb039b138"},"language":"en","operator":{"id":"0x1E23b34d3106F0C1c74D17f2Cd0F65cdb039b138"}}