Attested Arena

ArchitectureThe exam lives where nobody can read it; the record and the money, where everybody can

Read it left to right. People are NEAR accounts. They only talk to the arena — one smart contract per season on the NEAR blockchain, with no access keys, so its rules cannot change. Only the arena calls the judge, and only the judge talks to the models; both run in hardware enclaves nobody can look inside. Point at a promise under the diagram to see where it is enforced.

The seasonSeason 5: one prize, three challengers, a hundred sealed tasks

For the hackathon we ran the arena end to end on the NEAR blockchain (testnet). Seasons 0–4 were trial runs that shook out the pipeline; season 5 is the one this page proves, from the first sealed task to the payout. The sponsor and the entrants are our own test accounts. The judge runs on OutLayer, the models on NEAR AI's confidential inference; the money is testnet NEAR.

The entrants

What happened, in order

1. 1The judge was published and pinned. Build c05fb8cc38…557b7a, key fb0fc7517d…d97406, said by the build itself in BX2D1mez…8uB6zc.
2. 2The arena was deployed and locked. season5.attested-arena.testnet has no access key: its code — which decides which tasks a portion may open — cannot change.
3. 3The exam was made inside the enclaves. 13 batches: code in the judge designed the tasks, a model in NEAR AI's TEE worded them; 104 written, 100 admitted by code, each sealed to the judge's build. Nobody saw them.
4. 4The pool was committed. Merkle root 7a8f2a3663cd…266b06 over 100 leaves, fixed by DUHXtS3F…RrkE81 before any duel.
5. 5Models dueled. 3 duels, 19 judged portions, 95 tasks used once and revealed with their results, 190 answers.
6. 6A record was confirmed and paid. 1 confirmed record; 33.33 progress tokens minted for the gain on the confirmation tasks; the sponsors' 5.00 NEAR redeemed by their holder.

ProofWhat this season proves

Six claims about season 5. None of them asks you to trust this page: as it opened, your browser checked every one with the judge's own code, compiled to WebAssembly, and Intel's quote verifier, on NEAR's state for the season. Each card lists its checks with the values computed; one button reads NEAR live and checks again. The same checks run from a terminal with arena-verify.

Step 1The judge

The judge is an OutLayer app: a WebAssembly program that runs inside an Intel TDX enclave. It is run straight from its published file, named by the file's sha256 — never as an upgradable project. Its keys come from the NEAR MPC network's confidential key derivation (CKD), bound to that hash (bind: "wasm"): any other build, ours included, gets other keys. The build is reproducible: ./judge/build.sh gives the same sha256.

Step 2The exam nobody saw

For each batch, code in the enclave designed the tasks from the enclave's randomness, a model in NEAR AI's confidential inference wrote the wording, a second model read it back, and code decided admission. Only ciphertexts and leaf hashes left the enclave; the arena fixed the Merkle root over them before the first duel.

Step 3Duels

Both models answer the same tasks. A sequential test (SPRT: H1 “the challenger wins 70% of the tasks they disagree on”, α 5%, β 10%) decides; a passed test earns a confirmation on fresh tasks, and the gain is measured there. A run that fails — here, one that outlived OutLayer's 200-block window for returning a result — spends its tasks unopened.

Duel 0: glm-5.3-flash (entered by arena-bob.testnet) vs champion Qwen3-VL-30B-A3B-Instruct — record, +33.33 points

arena-bob.testnet received 33.33 progress tokens: the gain on the confirmation tasks only.

At the cinema, six friends took a single row of seats. Nico sat somewhere between Jun and Ivo. Wren sat somewhere to the left of Jun. Wren and Vera sat in neighbouring seats. Ivo sat in the first or the last seat. Vera also sat in the first or the last seat. Hugo sat somewhere to the left of Jun.

(no <answer> block) …least 1, but we already have:
- Seat 1: Vera
- Seat 2: Wren
- Seat 6: Ivo

So available seats: 3, 4, 5

People left: Nico, Jun, Hugo

So Jun, Nico, Hugo must be in seats 3, 4, 5

Now, Jun must be in 3

Vera, Wren, Hugo, Jun, Nico, Ivo

On a bus trip, seven passengers settled into one row of seats. Jun sat somewhere between Dara and Uma. Dara and Pia sat in neighbouring seats. Quin and Dara sat in neighbouring seats. Dara sat somewhere between Dmitri and Uma. Jun sat somewhere between Uma and Elsa. Elsa and Jun sat in neighbouring seats. Jun sat somewhere to the left of Dara. Dara sat somewhere between Uma and Quin.

(no <answer> block) …tri are to the left of Dara, and Uma to the right.

So the order must be: Quin, Dmitri, Dara, Uma — but wait, Quin and Dmitri are both on the left — but we don’t know their order.

But Dara is between

(no <answer> block) …

Duel 1: Qwen3.6-35B-A3B-FP8 (entered by arena-alice.testnet) vs champion glm-5.3-flash — Rejected

Write a short text about the life of a honeybee.

Rules:
1. The text has exactly 6 lines.
2. Read from top to bottom, the first letters of the lines spell "ASLAHE".
3. Line 3 does not contain the letter "o", in either case.
4. The word "honey" appears exactly 1 time in the text, in any case.
5. The last word of the text is "her".

Definitions: a line is a non-empty line of text; empty lines do not count. A word is a run of the letters A-Z and a-z, with apostrophes allowed inside it; digits, hyphens and all other characters separate words. The first letter of a line is the first letter A-Z or a-z on it.

(no <answer> block) ….

Line 5: "Hardworking foragers gather nectar, turning it into honey." 

Line 6: "Every worker serves the queen, and all the hive adores her." Ends with "her". Good.

Let me check first letters: A, S

A tiny bee wakes at dawn.
Searching for sweet nectar.
She visits many flowers.
Gathering pollen with care.
Making honey for the hive.
She serves her colony.

Write a short text about why we dream at night.

Rules:
1. The text has exactly 6 lines.
2. Read from top to bottom, the first letters of the lines spell "NSOYWS".
3. Line 2 has exactly 9 words.
4. Line 1 does not contain the letter "l", in either case.
5. The last word of the text is "mystery".

Definitions: a line is a non-empty line of text; empty lines do not count. A word is a run of the letters A-Z and a-z, with apostrophes allowed inside it; digits, hyphens and all other characters separate words. The first letter of a line is the first letter A-Z or a-z on it.

(no <answer> block) … emotions.
Others see dreams as rehearsal for threats we might face.
Your sleeping brain stays active, weaving images from memory.
While science offers theories, no single answer exists.
So each night

Night brings visions to the mind
Sleeping brains process daily events
Often we recall strange scenes
Yearning for answers remains
We seek understanding always
Such a deep mystery

Duel 2: glm-5.3-flash (entered by arena-carol.testnet) vs champion glm-5.3-flash — NotProven

The champion's own model, entered again. At temperature 0 the same model still answered 3 of 25 tasks differently from itself (GPU batching is not bit-exact). The test treats that as noise: no record, nothing minted.

Write a short text about the work of a museum guard.

Rules:
1. The text has exactly 6 lines.
2. Read from top to bottom, the first letters of the lines spell "MIVSCA".
3. Line 5 has exactly 9 words.
4. Line 4 does not contain the letter "l", in either case.
5. The last word of the text is "home".

Definitions: a line is a non-empty line of text; empty lines do not count. A word is a run of the letters A-Z and a-z, with apostrophes allowed inside it; digits, hyphens and all other characters separate words. The first letter of a line is the first letter A-Z or a-z on it.

Museum guards keep watch over treasures old and rare.
In quiet rooms, they walk softly among the art.
Vigilant eyes scan every corner for harm or theft.
Steady steps echo as they pace each dim room.
Careful hands never touch the paintings, yet they protect
At closing time, they lock the doors and head home.

Museum guards stand watch through quiet halls.
In dim galleries, they notice every step.
Vigilant eyes protect paintings from harm.
Steady footsteps guard each precious room.
Careful checks keep every canvas and frame safe tonight.
At closing time, the tired guard walks home.

Write a short text about why the sky turns red at sunset.

Rules:
1. The text has exactly 6 lines.
2. Read from top to bottom, the first letters of the lines spell "STWDSE".
3. Line 1 has exactly 10 words.
4. The word "slightly" appears exactly 1 time in the text, in any case.
5. The last word of the text is "picture".

Definitions: a line is a non-empty line of text; empty lines do not count. A word is a run of the letters A-Z and a-z, with apostrophes allowed inside it; digits, hyphens and all other characters separate words. The first letter of a line is the first letter A-Z or a-z on it.

Sunlight travels a long path through the air at sunset.
The atmosphere scatters away blue light, leaving warm red tones.
Waves with shorter wavelengths scatter strongly, while longer red waves survive.
Dust and tiny particles slightly deepen the glowing crimson shade.
Sunsets look redder near the horizon because light bends more.
Every evening paints the sky like a beautiful, stunning picture.

Sunlight travels a long path through the air at sunset.
The atmosphere scatters blue light away, leaving warm red tones.
Waves of shorter blue light scatter widely, while longer red waves survive.
Dust and haze slightly shift the remaining orange and crimson hues.
So the horizon glows with fiery colors as the sun sinks.
Every evening paints a different, breathtaking picture.

AttacksTrying to get around it

And in the contract's tests (contract/src/tests.rs): a result signed by any other build is refused; a result for another arena or operator is refused; evidence other than the signed evidence is refused; a portion must score exactly the tasks it was given; entering the champion's own model earns nothing; a challenger that passes by luck fails the confirmation.

Step 4Money

Sponsors put 5.00 NEAR into the season's pool. Each path out is one rule: redeem pays balance × pool / supply (both fixed at close) and burns the tokens; with no record, reclaim returns each sponsor's own deposit; refund_deposit returns every entry's deposit, whatever its duel did.

DesignWhy each choice

NextWeights, not just models

This season's duels run between NEAR AI's catalog models, because its confidential inference serves its own catalog only. The arena is written for Delta League's format (delta.submission.v1, a version named by the hash of its content). One step is missing: if NEAR AI serves an uploaded weight delta under its content hash, the response signature it already makes — model_id:sha256(request):sha256(response) — binds every answer to exact weights. Then a company can put its own kind of problem and its own prize behind a season, and anyone who improves a model at it gets paid — with nobody, the company included, able to leak or tune the test.

TrustWhat you still trust

• The hardware: Intel TDX and NVIDIA confidential GPUs, verified against Intel's and NVIDIA's services. Physical attacks on a host are outside Intel's model.
• OutLayer's workers and the NEAR MPC network's key derivation (workers in TDX, their measurements approved on NEAR) for giving a build's keys only to that build and reporting a run's caller truthfully.
• NEAR AI's deployment for which weights stand behind a model name: a quote attests the signing key and the software stack, not a hash of the weights.

Not the operator, not the organiser, and not this page.

TerminalThe same checks, from a terminal

$ cargo run --release -p arena-verify -- --arena season5.attested-arena.testnet

Season season5.attested-arena.testnet: "Closed" — judge build c05fb8cc385d29a08a4aa68732757cbae49d55494b3a61d86251102fcc557b7a
  judge key fb0fc7517df836d61fe64be897d18bcaf6981b7fb9942d0f2e2a47a849d97406  (https://test.fastfs.io/attested-arena.testnet/outlayer.testnet/c05fb8cc385d29a08a4aa68732757cbae49d55494b3a61d86251102fcc557b7a.wasm)

1. The pool
  100 tasks, root 7a8f2a3663cddc17e5dc17ac0f36c4e44939e7e3702e709acb72688049266b06

2. Batches — generated inside the TEE, admitted by code
  generated 104, admitted 100; kept out: {"malformed": 4}

3. Portions — every task, answer, signature and score
  portion 3: failed, its 5 tasks spent unopened (the run produced no output)
  95 tasks opened and proven into the root, 190 answers re-scored

4. Duels — the test replayed from the signed results
  duel 0: z-ai/glm-5.3-flash vs champion Qwen/Qwen3-VL-30B-A3B-Instruct → {"Record":{"gain_centi":3333}}
  duel 1: Qwen/Qwen3.6-35B-A3B-FP8 vs champion z-ai/glm-5.3-flash → "Rejected"
  duel 2: z-ai/glm-5.3-flash vs champion z-ai/glm-5.3-flash → "NotProven"

5. Tasks never opened (unused, or spent by a failed run), revealed after the season
  5 tasks opened and proven into the root

39 checks passed, 0 broken.

On chainWhat NEAR itself answers

Raw answers of NEAR RPC for this season, rendered as they came.