🤖 AI

SoK: Blockchain-Based Decentralized AI (DeAI)

This paper presents the first Systematization of Knowledge (SoK) on blockchain-based Decentralized Artificial Intelligence (DeAI), providing a formal definition, a lifecycle-based taxonomy, an investigation into blockchain's role in secure collaboration, and an analysis of security risks and future research directions.

Original authors: Elizabeth Lui, Rui Sun, Vatsal Shah, Xihan Xiong, Jiahao Sun, Davide Crapis, William Knottenbelt, Zhipeng Wang

Published 2026-02-10

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Elizabeth Lui, Rui Sun, Vatsal Shah, Xihan Xiong, Jiahao Sun, Davide Crapis, William Knottenbelt, Zhipeng Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of Artificial Intelligence (AI) today is like a massive, high-tech library. Right now, this library is owned by just three or four giant corporations. They own all the books (data), they own all the reading desks (computing power), and they decide which books you are allowed to read and how much it costs. If one of these companies decides to change the rules, or if their building catches fire, the whole world loses access to that knowledge.

This paper, "SoK: Blockchain-Based Decentralized AI (DeAI)," is essentially a massive "State of the Union" report. It looks at a new way to build this library: instead of a few giants, what if the library was owned by everyone?

Here is the breakdown of how they explain this new world.

1. The Concept: The "Community Garden" vs. The "Mega-Farm"

Currently, AI is a Mega-Farm. A single company owns the land, the seeds, the tractors, and the harvest. It’s efficient, but it’s a monopoly. If they decide to stop growing tomatoes, you don't get tomatoes.

DeAI (Decentralized AI) is like a Community Garden.

The Seeds (Data): Instead of one company owning all the data, thousands of people contribute their own "seeds" (data).
The Tools (Compute): Instead of one giant tractor, everyone brings their own shovel, rake, and watering can (their personal computers and GPUs) to help the garden grow.
The Rules (Blockchain): Since there is no "Head Gardener" to manage everything, we use Blockchain. Think of the blockchain as a Magic Ledger in the middle of the garden. Every time someone contributes a shovel or a seed, the ledger automatically writes it down and gives them a "token" (a digital thank-you note that actually has value) as a reward.

2. The Lifecycle: How the Garden Grows

The paper breaks down the life of an AI model into four stages, like the life of a plant:

Phase 1: Proposing the Crop (Task Proposing): Someone says, "Hey, let's grow corn this year!" In DeAI, this is done through a transparent vote so no one can cheat the system.
Phase 2: Preparing the Soil (Pre-training): People bring their data (seeds) to the garden. The paper discusses how to make sure no one brings "poisoned seeds" (bad data) that will ruin the whole crop.
Phase 3: The Growing Season (On-training): This is the hard work. Everyone uses their tools to help the plants grow. The paper looks at how to make sure everyone is actually working and not just sitting in the shade pretending to help (this is called "free-riding").
Phase 4: The Harvest (Post-training): Once the corn is grown, it’s ready to be used! People can buy "corn" (AI services) using the tokens they earned, or use the harvest to power their own "AI robots" (Agents).

3. The Villains: The "Garden Saboteurs"

Because this garden is open to everyone, there are bad actors. The paper identifies several "villains":

The Poisoner: Someone who tries to sneak "weeds" (bad data) into the soil to make the AI act weird or biased.
The Thief: Someone who watches you grow your beautiful corn, waits until you're done, and then tries to claim they grew it themselves to steal your rewards.
The Spy: Someone who tries to peek into your private garden to steal your secret growing techniques (data privacy).

4. The Superpowers: How We Fight Back

The paper reviews "superpowers" (technologies) we can use to keep the garden safe:

ZKPs (Zero-Knowledge Proofs): This is like being able to prove you have a secret recipe without actually showing anyone the recipe. It keeps data private but proves it's good.
Staking: This is like a "Security Deposit." If you want to join the garden, you have to put some money in a pot. If you try to cheat or bring weeds, the community takes your money. This makes it very expensive to be a villain.

The Big Picture Summary

The authors are saying: "Decentralized AI is a brilliant idea, but it's currently a bit of a Wild West."

It has the potential to make AI fairer, more private, and more powerful by letting the whole world participate. However, we still need to figure out how to make it fast enough, how to stop the thieves, and how to make sure the "Magic Ledger" (blockchain) doesn't become too slow or too expensive to use.

Technical Summary: SoK: Blockchain-Based Decentralized AI (DeAI)

1. Problem Statement

The current Artificial Intelligence (AI) landscape is dominated by Centralized AI (CeAI), where data, compute, and model training are controlled by a few massive entities. This centralization introduces several critical vulnerabilities:

Single Points of Failure: Centralized infrastructure is prone to outages and targeted attacks.
Privacy & Security Risks: Centralized data silos increase the risk of data breaches and unauthorized access.
Bias & Lack of Transparency: Proprietary models and datasets lead to inherent biases and "black-box" decision-making.
Scalability & Access Inequality: The massive cost of frontier-scale models (e.g., GPT-4) creates a barrier to entry, concentrating innovation within a few corporations.

While Decentralized AI (DeAI) aims to solve these via blockchain, the academic community lacks a systematic framework to understand its technical foundations, security risks, and the trade-offs between decentralization and performance.

2. Methodology

This paper is a Systematization of Knowledge (SoK). The authors employ a multi-dimensional approach to organize and analyze the DeAI field:

Formalization: They define a DeAI system using a mathematical tuple $S = (M, G, \{D_i\}, \Theta, P, \Pi, \Gamma, V_{val}, D_{del}, \delta)$ , which captures miners, P2P graphs, data distributions, parameter spaces, task mechanisms, incentives, governance, validators, delegators, and delegation mappings.
Taxonomy Construction: They categorize existing DeAI solutions across the AI Lifecycle: Task Proposing $\rightarrow$ Pre-training $\rightarrow$ On-training $\rightarrow$ Post-training (Inference, Agents, and Marketplaces).
Threat Modeling: They develop a cross-layer threat model that distinguishes between risks shared with CeAI (e.g., data poisoning) and risks unique to DeAI (e.g., economic incentive misalignment, GPU side-channels, and validator collusion).
Empirical Evaluation: The authors conduct controlled experiments to benchmark specific mitigation techniques against high-impact threats (Data Poisoning, Model Stealing, and Model Extraction).

3. Key Contributions

Unified DeAI Framework: Provides the first formal definition and a comprehensive lifecycle-based taxonomy of DeAI projects (e.g., Bittensor, FLock, Ocean, Render).
Blockchain Functionality Analysis: Identifies how blockchain primitives (Smart Contracts, Consensus, Tokenomics) specifically enable security, transparency, and incentive-compatible collaboration.
Security Risk Mapping: A detailed matrix (Table II) mapping threats to their respective stages and evaluating the effectiveness of cryptographic (ZKP, MPC), economic (Staking, Slashing), and system-level (TEE, MIG) mitigations.
Empirical Benchmarking: Provides quantitative data on the trade-offs between security and utility (e.g., how much accuracy is lost when applying Differential Privacy).
Identification of Research Gaps: Outlines critical open questions, such as the scalability of Zero-Knowledge Machine Learning (zkML) and the impact of inflationary vs. deflationary tokenomics.

4. Key Results

The paper’s empirical experiments yield several critical technical insights:

Pre-training (Data Poisoning): DP-SGD (Differential Privacy) is the most robust against poisoning but incurs a heavy cost in training time ( $\sim$ 3x) and utility (accuracy drop). MixUp regularization offers a better balance of utility and efficiency but is less effective against aggressive attacks.
On-training (Model Stealing): All tested defenses (Watermarking, Commit-Reveal, PoL, and ZKP) achieved 100% theft detection. However, ZKP (Zero-Knowledge Proofs) was the most efficient, providing a 5,000x speedup in protection runtime compared to traditional cryptographic methods like Commit-Reveal.
Post-training (Model Extraction): Output Perturbation (adding noise to responses) was the most effective at degrading the quality of stolen surrogate models. Conversely, Rate Limiting (a common industry standard) was found to be largely ineffective against distributed extraction attacks.
Task Proposing: Simulations showed that Commit-Reveal protocols provide perfect protection against front-running but significantly increase latency, whereas Staking-Gating provides a strong middle ground.

5. Significance

This work serves as a foundational roadmap for both researchers and industry practitioners. By moving beyond conceptual hype, the paper provides a rigorous technical lens to evaluate whether a DeAI protocol is truly decentralized or merely "decentralized in name only."

Its significance lies in highlighting the "Decentralization Trilemma" in AI: the difficulty of simultaneously achieving high model performance, robust security/privacy, and true decentralization/scalability. The paper concludes that the future of DeAI depends on developing "AI-native cryptography" and more efficient, lightweight verification mechanisms that can handle the massive scale of modern transformer-based models.