No Receipt for a Forward Pass: Why AI Safety's Binding Constraint Is Accounting, Not Alignment

In May 2024, a safety team that had been promised one-fifth of the most expensive compute cluster ever assembled quietly stopped existing. Forty-seven weeks earlier, OpenAI had announced Superalignment with a four-year mandate and a budget that would have made it one of the largest research groups in the industry. By the time Jan Leike resigned, the team was gone, and the sentence he left behind — that safety culture had "taken a backseat to shiny products" — was circulating in Brussels and Washington. What interested me was not the sentence. It was that nobody could check it. Not because anyone was hiding something. Because there is no ledger. There is no artifact in existence that records how many FLOPs a named safety team actually consumed in a quarter, no signed hash binding a model release to the evaluation harness that cleared it, no settlement layer where a commitment like "we will not ship above this capability threshold" can be tested against what shipped. We spent three years building cryptographic machines that prove a computation occurred without revealing the inputs. We spent almost none of that time pointing them at the one industry whose central promises are structurally unverifiable. Excavating truth from the code's buried layers is my day job. In AI safety, the layers are not buried. They are absent. The regulatory scaffolding landed before the evidence layer did. The EU AI Act's obligations on general-purpose models came into force in August 2025, demanding technical documentation, evaluation results and incident reporting from providers above a compute threshold. NIST's framework is voluntary but increasingly cited in procurement. Export controls on accelerators, defense-adjacent contracts, and a policy consensus on both sides of the Pacific that capability leadership is a strategic asset compressed the timeline further. Every one of those regimes assumes claims about a model can be evidenced. None of them specifies in what format. Three candidate stacks exist, and they are not interchangeable. TEE attestation is the cheapest and the only one in production: confidential computing modes on datacenter accelerators emit signed quotes binding a workload to a firmware version and a weight hash. Its trust root is a vendor's attestation service and a signing key you do not control. Optimistic ML borrows the rollup playbook wholesale. Publish the model, let anyone re-run a disputed inference inside a challenge window, slash the bond if the re-execution disagrees. It converts verification into an economic game, which is exactly what makes it interesting and exactly what makes it fragile. ZK proofs of inference replace re-execution with a succinct argument that the transformer's arithmetic was performed correctly. Beautiful, general, and priced in a currency most AI labs do not have: time. Start with the arithmetic, because the arithmetic is where this argument is won or lost. A single forward pass of a 7-billion-parameter model over a 2,048-token context is roughly 2 × 7e9 × 2,048 — about 2.9e13 floating-point operations. On an H100 that is memory-bandwidth bound and lands in the tens of milliseconds. Now wrap it in a circuit. Published benchmarks for transformer-class proving systems land between 10^4 and 10^6 times native execution once you quantize to low-bit arithmetic and lean on lookup arguments. Take the optimistic end, 10^4: 2.9e17 field operations. A single accelerator grinding through maybe 1e11 of them per second needs 2.9e6 seconds. That is thirty-four days, per inference, for a small model. The overhead does not shrink when you buy more GPUs, because it is multiplicative. It shrinks when the model shrinks and the precision collapses, and it never approaches the thirty-millisecond serving budget. A frontier model with a real-time verifiable endpoint is not a hardware problem. It is a category error dressed as a roadmap. So where does the mathematics actually bite? Commitments. Hash the weights. Merkle-ize the training data manifest. Commit to the evaluation set, the harness version, the decoding parameters, the output. Proving a hash chain costs what hashing costs — nanoseconds — and the proof is constant-size to verify. What you get is a model card that cannot lie about itself: anyone can sample-verify that a reported benchmark score corresponds to committed questions, not to a curated demo set assembled the week before launch. Cheap, boring, and the only thing that works today. The optimistic route has a block-space problem worth quantifying. Seven billion parameters in fp16 is 14 GB. Post-Dencun, Ethereum targets six blobs per block at 128 KB each — 768 KB every twelve seconds, roughly 5.5 GB a day. Publishing a single mid-sized model consumes about two and a half days of the entire data capacity of the network that settles the whole rollup economy. Navigation is not the hard part here. The labyrinth is where value flows unseen, and the tolls are already being set. I have argued since Dencun that blobspace is a commons with a two-year fuse, and the AI industry is the match. Attestation protocols bidding for blobs do not compete with other attestation protocols. They compete with the cheapest, highest-volume consumer of the resource — a rollup batching fifty thousand retail transactions. When the fee market clears, that consumer is the one priced out, and the doubling in rollup fees arrives ahead of schedule. Verifiable AI is not a free rider on Ethereum. It is a new tenant in a very small apartment. There is a second migration that matters more, and I learned it the hard way. When I mapped Celestia's data availability sampling in 2022, the technical lesson was that sampling converts an absolute guarantee into a probabilistic one, and the attack surface migrates from the cryptography to the node distribution — who can afford to be a sampler, who gets sampled, who is sybil-adjacent. Verifiable inference has the same shape. Once proofs are cheap enough to verify, the interesting question stops being whether the proof verifies and becomes who is allowed to produce attestations, and what is their bond. Every bug is a story waiting to be decoded, and the story is almost never in the math. Now the part the sector does not want to price. In 2021 I forked the Circom compiler to build a simplified tutorial that ended up carrying about five thousand developers through their first zero-knowledge circuit. The thing you learn on the third or fourth circuit is what a proof actually asserts: that a relation between a witness and an output holds for the witness you supplied. It is silent, permanently silent, on whether that witness is honest. For AI, the witness is the input. You can spend thirty-four days proving that a model produced an output from a prompt and learn nothing about whether that prompt was production traffic or a hand-picked demo. The hard part of verifiable AI is not the prover. It is the input oracle, and there is no circuit for "this data is the data." This is why the sector's funding maps so badly onto its problems. The zkML cohort that raised at 2024 valuations has shed most of its value in this market — several teams are down more than eighty percent and running on eighteen-month runways that are now fourteen. The ones with real traction are not proving transformer inference. They are proving data lineage: jurisdictional origin, licensing rights, absence of personal data, the hash of a training corpus at a point in time. Underwriters and procurement officers pay for liability receipts. Nobody buys a proof of a forward pass. Which brings me to what I built last year. With three AI startups I prototyped a proof layer for model inference, and the architecture that survived contact with customers was not the one we designed. The unit that buyers wanted was authorization, not computation: prove that an autonomous agent's action fell inside a committed policy — position limits, counterparty allowlists, jurisdictional constraints — without revealing the portfolio it acted on. That is a circuit of a few hundred constraints. It runs in milliseconds. It maps to an insurance policy and a compliance filing, not to a research paper. The composability argument is the same one that made DeFi legible a decade ago, and it cuts the same way. Composability is not just function; it is poetry. But poetry does not survive an audit unless the primitives are boring, and proving policy compliance is boring in exactly the right way. Here is the contrarian read, and it will annoy both camps. The AI safety discourse assumes the binding constraint is alignment — that the models are dangerous and the labs lack the science to constrain them. The binding constraint is accounting. Labs cannot demonstrate what they did, regulators cannot audit what they cannot see, and the industry has converted a transparency problem into a philosophical one, because philosophy has no disclosure deadline. Watch the governance structures and the resemblance to crypto becomes uncomfortable. AI labs' safety boards occupy the same structural position as foundation multisigs: nominally sovereign, practically dependent on the entity they oversee, and auditable only at the layer that entity chooses to publish. Project treasuries are traceable on-chain. Safety committees are traceable on nothing. And the talent signal is inverted from the narrative. The researchers who left the safety organizations were the ones who could be audited, because they had written positions and public commitments. The ones who stay become the compliance shield, and their continued employment is itself the compliance artifact. The first serious deployment of verifiable AI will not happen at a frontier lab. It will happen at an insurer or a regulator, because they need receipts for liability, not for alignment — and they do not care what a model believes, only what it did. The registry will also fracture along chain boundaries: moving a proof of compliance between two domains remains, in 2026, slower and more failure-prone than withdrawing from a centralized exchange, which tells you precisely where the UX floor sits. So here is the forecast, with the confidence I can honestly assign. Within eighteen months, an attested-inference registry will exist where the unit of verification is not a forward pass but an authorization: a proof that a specific agent was permitted to take a specific action under a committed policy, with the decision hash anchored to a chain that nobody's foundation controls. The first on-chain dispute over an autonomous agent's output will not be about the model's weights. It will be about the prompt log — who supplied the input, when, and under what agreement. The labs will not build this. They will be forced into it by the first incident that costs an underwriter real money, and the pressure will arrive through the same door as the geopolitics: not as ethics, but as evidence. The open question is whether the cryptographers get there first, or whether the accounting standard gets written by the people with the least interest in a ledger.