In one paragraph

Theseus is a Substrate chain that turns every model inference and agent call into a single verifiable state transition. Off-chain provers run the AI workload and submit results with KZG proofs; on-chain pallets verify the proof in constant time and route the verified result back into agent execution. The chain coordinates; the GPUs prove; the consensus layer only trusts what it can verify.

Chain: Substrate runtime with Theseus-specific pallets (aivm, models, agents, tools, store, ship) plus standard FRAME pallets for balances and BFT consensus.
Prover network: full prover with TensorCommitment proofs, plus lite provers for hosted-API breadth at alpha.
Blessed enclave: TEE that holds the chain’s key, executes off-chain tools (web search, authenticated HTTP), decrypts agent credentials.
Layer0 bridge: any token bridges in; seus (gas) is bought only with frxUSD.

Architectural Overview

Three main processes

AIVM executes inference and forwards valid transactions; TheseusStore anchors model and agent-context data via content-addressed roots and verifies retrievals against them; BFT consensus provides deterministic finality. All communicate via RPC/networking layer.

Three-Layer Stack

Execution Layer: AIVM

Deterministic tensor-native runtime with Tensor Commits:

Tensor operationsAgent schedulingProof generationSHIP spec

Availability Layer: TheseusStore

Off-chain DA layer for model weights and agent contexts. Integrity comes from on-chain anchors, not the storage layer:

weights_rootcontext_rootMerkle / Verkle proofsOCW sampling

Consensus Layer: BFT proof-of-stake

Deterministic finality once 2/3 of validators agree. AI-specific gating folded in:

Valid model rootsVRF prover selectionNative KZG host fnForkless upgrades

Block Structure

block.header

header {
  parent_hash, height, timestamp
  post-state Merkle root
  Terkle tree of Tensor Commits
  Merkle root of available model and context blobs
  gas limit
  VRF-selected validator signature
}
body { Transaction[] }

A block cannot finalize unless both conditions hold:

Inference integrity: Every inference must include a valid Tensor Commit proof

Agents availability: Every stored condition must be provably retrievable

TheseusStore Deep Dive

TheseusStore is the availability layer, handling gigabytes of model weights and agent context on-chain.

Model storage

Immutable weights addressed by their on-chain weights_root. Provers fetch by root and verify integrity (Merkle / Verkle proofs) before running inference.

Context storage

Agent execution context and the AKG live behind a per-agent context_root. Updated by pallet_agents as agents execute; readers verify retrievals against the anchor.

Correctness vs availability

Consensus nodes never trust raw bytes from TheseusStore. They fetch by content-addressed root and verify against the on-chain anchor. As long as one honest full node can obtain the data and verify it against the root, the state transition stays correct.

The DA layer’s economics ensure availability, not integrity. Integrity is cryptographic. See Data Availability for the full breakdown.

Prover and Verifier Selection

Provers

Run full forward passes. VRF selects by capacity + stake.

Publish hardware specs → Registry tracks → VRF filters (RAM ≥ model) → Cache popular models

Verifiers

All active verifiers check every inference.

Never download weights~2ms per check1K validators → 100 jobs <1s2/3 agreement for finality

Security Model

Theseus assumes a partially synchronous network with up to 1/3 byzantine validator stake. Within those bounds, three properties are protected by economic and cryptographic mechanisms working together.

Inference integrity

A dishonest prover producing a wrong inference result is caught by Tensor Commit verification: every active verifier rechecks every proof in roughly 2 ms. A faulty proof fails KZG pairing checks deterministically.

Slash condition: invalid Tensor Commit. Stake is burned, and the inference is rejected before the block can finalize.

Liveness

A request must reach an honest prover that can run the model. The protocol picks n candidates per request via VRF, weighted by stake and hardware capacity. The probability that at least one is honest is:

Pr(liveness) = 1 - (1 - h)ⁿ

Where h is the honest fraction. With h = 0.67 and n = 10, liveness is >99.99% per request. With h = 0.33 worst-case and n = 10, >98%.

Data availability

Model weights and agent context must be retrievable for provers to run, for verifiers to check proofs, and for agents to make progress. The on-chain anchor (weights_root / context_root) guarantees integrity; the DA layer’s economics guarantee availability.

Substrate Off-chain Workers periodically sample data referenced by anchored roots, with unsigned transactions recording evidence of unavailability and triggering slashing. See Data Availability.

Out of scope

Network-level censorship by a majority validator coalition, supply-chain attacks on model weight files before commitment, and attacks on the VRF beacon are out of scope of the consensus security model and are addressed by separate protocol layers and operational discipline.

Transaction Lifecycle

Model Deployment

Developer uploads weights (with Tensor Commit) to TheseusStore

Inference Transaction

User submits {modelRoot, input, maxGas} to AIVM

Block Proposal

Validator packages model and inference TXs with TheseusStore root

Execution & Proofing

AIVM runs the model and emits a Tensor Commit receipt

Finality

PoS finalizes; TheseusStore miners pin any new context/model shards

AIVM Details →

Deep dive into execution layer

Tensor Commits →

Learn about proof mechanisms

System Architecture