►
From YouTube: TrueBit: Scalable Computation - Christian Reitwiessner
Description
Slides: http://chriseth.github.io/notes/talks/truebit_meetup_2017-03/#/
Interactive verification is one solution to the scalability problem. The idea is that large computations are proven to be faulty by chopping them up into smaller and smaller pieces until a tiny step remains that can be easily checked by smart contracts. The difficulty lies in motivating Verifiers to watch the process: Verifiers are hard to reward if they do not find an error and the desired situation is precisely the one where nobody cheats and thus no computation contains an error. This talk will introduce an incentive layer that properly rewards verifiers "even" in the case where everyone is honest.
A
B
A
So
we,
both
of
you
might
have
heard
that
lock
change
do
not
scale
currently
and
one
of
the
main
debate
in
the
Bitcoin
community.
But
what
does
it
mean?
What
is
this
game?
To
put
it
simply
something
scales
if
it
performs
equally
well
as
it
grows,
and
currently
for
this
coin?
There
is
empirical
evidence
that
this
is
not
the
case,
because
so
it
gained
more
and
more
popularity
over
time
and
now
it's
harder
and
harder
to
get
Rebecca's
accepted
and
they
also
get
more
expensive.
A
And,
of
course,
this
problem
existed
exactly
the
same
way
for
appearing
and
perhaps
even
worse,
since
the
next
any
more
complicated.
But
currently,
if
you
did
not
hit
this
limit
and
what
is
the
reason
that
are
locked
in
stone
scale.
The
simple
answer
to
that
is
that
every
people
now
has
to
process
everything
for
next
verify
every
single
direction,
and
of
course
this
does
not
really
work
well,
because
you
have
a
suit.
You
have
the
thickest
block
time,
the
time
between
two
blocks
and
inside
in
this
time.
C
A
The
database
system,
then
you
can
just
add
more
servers
and
it
will
balance
that
out.
So,
if
you
add
more
note,
then
you
can
cope
with
with
high
a
man,
and
that
is
not
talking
with
block
chains
because
of
this
property
that
every
photo
has
to
produce
every
single
block.
And
of
course
you
have
this
property
because
of
trust.
B
A
So
Casper
is
not
just
about
proof
of
stake,
but
also
about
trying
to
save
the
blockchain
and
the
adherent.
Casper
is
that
he
is
yeah.
It
comes
across
hardness,
more
or
less
the
same,
a
concept
that
is
used.
Obviously,
these
scalable
this
should
be
detonated
their.
The
idea
is
that
yeah,
you
just
send
transactions
to
just
circle
notes
so
verifying,
but
Casper
makes
it
secure
again
by
rotating
these
very
famous
in
regular
intervals.
A
Then
there
is
a
rate
which
is
the
etherium
analogy
of
the
likely
network,
which
is
a
pic
online
network
and
there
the
idea
is
that
you
can
scale
transactions
by
grouping
them
in
a
certain
way.
You
move
them
off
trains,
you
don't
process
them
in
the
blushing,
so
deeper
still
in
a
in
a
different
network,
and
then
at
the
end
you
group
them.
We
proved
mouth
and
protection
to
assume
your
transaction
and
just
put
that
transaction
on
the
rope
chain
in
very
very
little
words,
so
you
can
get
more
turn.
A
You
can
get
more
yeah
transactions
and
clothes
into
a
single
action.
Title
boxing
at
that
hard
case
and
true
bit
is
the
third
way
and
there
the
idea
is
to
yes,
state
computations
I
will
explain
more
later
how
about
an
action
means
and
way
to
scale.
It
is
using
interactive
verification
that
you
want
to
go
to
detail
later.
A
In
complexity,
limited
and
resource
usage,
because
of
the
fact
that
every
photo
has
a
chance
has
to
process
every
transaction
and
with
true
bit,
you
can
get
smart
contracts
which
do
not
have
an
estimate.
Essentially
they
can
be
written
any
programming
languages,
the
music
that
is
so.
If
you
don't
have
a
gas
limit,
you
can
just
take
a
program
written
in
Python
and
then
just
put
the
Python
interpreter
on
the
blockchain
and
randomizing
program.
To
that
it
seems
smart
contracts.
A
Then
an
access
that
terrifies
big
file
and
weak
to
single
chunk
in
there
or
even
computes
a
big
sum
over
all
the
entries
in
this
gigantic
pile.
Of
course,
these
smart
contracts
will
not
run
directly
on
the
blockchain.
We
know
that
gate
such
the
the
trust
promise
will
be
the
same
as
if
they
would
run
on
the
auction.
A
A
Some
more
specific
practically
saddled
through,
but
you
can
link
Martin
to
block
train
so
there's
this
does
call
you,
through
your
bridge
project,
which
tries
to
create
a
bridge
not
only
from
no
time
to
eat
hearing,
but
also
from
a
theorem
conosco,
and
the
idea
is
that
you
can
detain
can
take
those
those
cart
and
move
into
the
field
blockchain,
where
it
will
be
a
independent
token.
You
can
move
it
around
and
they
talkin
there
and
then
also
will
be
back
destroying
the
token
and
yeah
releasing
or
generating
new
needle
under
fire.
A
A
B
A
Program
of
chain
and
puts
the
result
of
it
and
then
people
can
rewrite
the
same
computation
check.
That
was
done
correctly
if
they
want
and
the
idea.
So
this
is
similar
to
a
blockchain.
We
have
Martin
miners
who
process
or
collection
and
then
verify
each
other
and
on
a
blockchain.
If
you
have
a
disagreement
there
and
you
can't
work
and
if
you
can
convince
over
fifty
percent
of
the
hash
power
that
your
version
is
the
correct
one,
then
you
basically
convince
the
whole
network
now.
D
B
A
D
D
A
B
A
Ago
we
sent
okay
is
singing
or
singing
on
a
clarifier
surprises
that
nobody
can
cheat,
but
it
turned
out
that
this
scene,
honest
verified,
not
always
there,
but
yeah.
We
added
an
economic
incentive
mechanism
to
actually
ensure
that
this
thing,
an
honest
process
is
also
always
there,
and
so
there
are
other
projects
which
do
similar
things
like
stolen
my
exit
and
reform.
A
But
the
difference
to
those
project
is
that
they
focus
mainly
on
performing
the
computations
or
outsourcing
the
computations,
but
not
on
the
fact
that
they
are
done
correctly
and
true
bit,
on
the
other
hand,
is
yeah,
it's
focusing
mainly
on
correctness
and
not
on
yahoo
to
see
the
costs
or
something
that's.
The
truth
is
really
about
scaling
up
what
can
be
done
inside
a
single
transaction?
A
A
A
Yeah
there
is
that
the
main
problem
why
we
can't
stand
complications,
because
everyone
has
to
compete
anything.
So
the
solution
is
obviously
Villa
system,
where
not
everyone
has
to
complete
everything.
Soon,
I
have
a
computation,
a
task
force
in
the
blockchain
and
two
or
three
people
take
it
all
and
perform
the
computation
and
then
post
the
result
of
the
blockchain
and
the
main.
A
The
main
point
is:
if
we
had
any
disagreement
here,
then
these
people
go
to
court
and
port
here
means
blockchain.
So
we
have
the
smart
contract
judge
which
who
finds
out
without
error,
who
gave
the
wrong
answer,
and
yet
again,
the
simple
solution
regime
would
be
that
the
smart
contract
just
rewrote
the
full
computation,
but
that
again
doesn't
stay
until
the
checking
who
was
an
error
has
to
be
magnitude
faster
than
actually
learning
a
constant.
A
A
B
B
C
A
A
The
end
eqs
their
memory
content,
they're
all
for
instance,
and
then
smart
contract,
the
judge
will
come
and
say,
with
picture
of
the
middle.
The
second
is
a
year
and
ask
them
for
the
local
root
of
their
state
at
that
point
in
height,
and
they
might
use
the
same
answer
this
means.
So
this
means
that
a
ten
point
here
is
the
second
half.
A
There
has
to
be
a
single
step,
at
least
one
single
step
where
we
go
from
agreement
to
disagreements,
so
those
parties
were
in
agreement
here,
but
the
artists
in
the
disagreement
here
so
at
some
point
along
the
line
a
year
there
you
have,
they
have
to
move
from,
agree
multi-discipline
and
that's
just
the
point.
Is
we
use
research
using
values
and
we
25
years
of
an
research
so.
B
A
A
This
goes
on
and
some
point
because
they're
the
size
of
this
time
interval
always
half
at
some
point.
We
will
reach
a
situation
where
we
have
one
step
where
both
parties
are
in
agreement.
The
next
step
were
the
artisan,
our
disagreement
and
the
good
thing
about
that
is
that
it's
not
contract
n.
So
if
Mark
contest
can
just
take
Sasha
Fierce
a
situation
to
you
in
his
step
and
just
recompute
any
single
step
and
text,
which
is
the
correct
result,
because
yeah
a
single
step
is
easy
to
compute.
A
A
Okay.
So
this
takes
20
rounds,
which
is
quite
long.
I
would
say,
I
mean
it's
still
a
tiny
compared
to
1
million
percent.
What
I
said
has
to
be
magnitude
faster,
unchanged
and
actually
running
the
for
computation,
but
still
yeah.
The
good
news
is
that
Miss
Rogers
rounds
can
be
further
reduced
and
so
the
more
the
chief
correspondent,
certainly
there's
no
is.
We
are
no
way
to
get
around
that
and
but
because
of
that,
if
you,
if
you
try
to
cheat,
you
already
know
you
will
lose
in
that
game.
B
A
B
A
Is
that
first
dissolve
deposit
base
to
all
participants
for
the
deposit
on
chain
and
if
they
are
guilty
of
cheating,
then
therefore
deposit
is
destroyed
and
the
people
who
discovered
that
sack
they
get
a
reversible.
So
the
verifier
will
get
a
reward
if
they,
if
they
find
an
error.
But
if
everything
works
works,
fine
then
yeah
they
never
find
narrow.
So
they
will
never
get
a
reward,
and
this
is
actually
a
variable
is
no
problem,
because
how
do
you
as
a
verify?
A
That's
also
the
reason
I
got
but
yeah
I
mean
you
knew
the
result
performance.
How
can
you
yeah,
you
can
just
just
have
copy
that
so
yeah
over
time.
The
verifier
will
lose
interest
because
they
are
not
paying
in
any
way
but
have
to
do
act
exactly
the
same
work
as
the
main
trauma
solvers.
So
they
will
stop
looking
and
as
soon
as
the
solvers.
A
Anymore
then
they
can
cheat
and
the
whole
system
itself,
so
we
need
a
way
to
pay
verifiers
for
the
work
and
solution
to
that
is
something
called
force,
errors
and
the
way
it
works.
Is
you
baby
inject
an
error
into
this
whole
process,
which
can
then
be
detected
by
the
verifier
and
then
hit
they
can
pay
for
that?
So.
B
A
That
so,
if
you
want
the
truth
system
to
solve
it
out
for
you,
you
have
to
pay
for
that.
So
you
have
to
pay
yep
a
AP
and
missy
is
in
part
payout
to
the
person
who
post
solution
to
the
task
and
in
part,
is
saved
in
a
in
a
counterculture
pot.
And
if
such
a
40
acres
and
a
verifier
find
the
error,
then
the
very
sorry
has
paid
from
that
ipod
and
so
yeah
it
is.
Quantum
is
different.
The
solder
cannot
be
punished
because
of
that
had
to
inject
the
water.
A
C
A
To
inject
the
error,
then
he
or
she
will
be
punished,
and
the
problem
is
now
everyone
who
texts.
This
error
gets
the
reward,
and
now
the
solver
can
of
course,
notify
verifiers
about
the
fact
that
we
have
that
support
arijit
happen.
So
the
the
idea,
what
the
sober
injects
the
arrow,
but
does
not
tell
anyone
about
that,
because
we
want
the
verifier
to
actually
reacts
acute
everything
so
right,
s'okay
press,
yes,.
A
A
Because
such
a
fourth
error
might
happen
in
every
single
task,
and
you
only
know
that
it
happens
after
this
activity
and
so
as
a
verifying
as
to
acquire
that
that
information
that
it
forced
ever
happened
and
the
way
we
want
the
very
pious
acquire
information
is
by
just
reacted.
Cheating
the
top
okay
and
there's
a
second
way
that
they
can
acquire
this
information.
And
that's
by
asking
the
favor
right.
A
B
E
A
C
D
D
A
B
B
A
On
the
blockchain,
nobody
knows
that
your
fridge,
so
you
don't
have
a
reputation
system
attached
to
the
solvers
and
yeah
it's
difficult
and
also
I
mean
so
we
want
this
to
be
to
be
tight,
also
again
kind
of
arbitrary
bribery,
smart
contract.
That's
why
just
something
the
solvers
is
not
not
revolutionary.
B
B
B
A
A
Something
else
perhaps,
instead
carriers
that
anyone
can
be
verified
and
also
you
can
from
us
you
can
you
can
step
in
and
and
challenging
a
computation
from
outside
at
any
time
you're.
Not
so
that's
another
model
when
you
say
you
have
to
verify
the
computation,
but
if
you
do
that,
then
you
have
to
punish
people
when
they
did
not
verify
the
computation.
That's
kind
of
a
tricky
thing
to
do
here,
except
what
we
come
up
with
a
solution.
A
A
A
Okay,
this
is
how
you
prevent
the
silver
from
sharing
the
information
about
the
fourth
error,
with
the
verifier,
and
so
so
we
don't
prevent
the
photo
from
also
challenging
their
own
computation
cases
for
third
of
the
good
thing
to
just
solder,
just
get
another
revenge
and
we
can
factor
that
in
with
the
regular
world.
So
that's
fine,
but
the
idea
is
that
the
reward
will
decrease
dramatically.
The
more
challenges
there
are
so
he's
not
actually
be
improved,
but
that's
how
it
was
a
decision
in
the
white
paper.
So
I
will
say
like
that.
A
A
B
C
A
A
lot
of
money
with
my
team
or
like
whip
it
okay,
so
so
for
so
yes,
they
attend
this,
or
rather
the
blockchain
and
even
the
the
blockchain
has
an
upper
limit
of
how
much
what
you
want
to
do
on
a
block
chamber,
what
we
value
the
National,
what
to
do!
So,
if
you,
if
you
put
something
on
a
block
chain
which
is
worth
more
than
the
whole
block
chain,
then
attacker
can
just
attack
before
the
block.
A
This
thing
so
and
to
purchase
it-
and
the
second
is
not
really
exactly,
but
it
is
not
problem
for
policemen
another
and
connect
either
they're
very
high
of
23.
Wait
until
someone
challenges
and
then
only
rugged
individualism
is
because
I'm
quite
sure
that
the
edges
problems
in
digital
is
a
creation.
Then
it
all
involve
without
great
I
hands.
Yes,
very
good
question
that
especially
relevant
foot
sulfur,
because
the
solvent
immediately
knows
there
is
a
force
error.
A
So
you
could
just
watch
is
the
solver
challenges
or
not,
and
because
of
that,
you
have
to
randomly
make
something
called
take
challenges.
So
it
has
to
be
some
coming
for
real
mechanism
where
you
first
post
something
to
the
to
the
block
chain
which
look
like
challenge,
but
then
in
the
end,
turns
out
about.
C
Another
problem
you
just
be
and
bring
down
some
random-
yes
right,
Patera
agrees
and
compared
to
them
and
each
occasion
and
require,
while
of
work,
order
and
von
solo,
and
so
what
you
really
would
like
to
do
is
just
for
tank
without
he
normally
body
having
a
group,
health,
computing,
Sutherland
or
Ella,
and
so
working
Pazuzu
would
say.
Hey
I,
edit
and
share
information
anyway.
Is
oh
geez,
whatever
I
don't
get
any
money,
because
you
know
I,
share
information
network
and
challengers.
C
Also
I,
don't
get
any
money
for
their
405
and
save
all
the
money
for
the
for
us.
That
should
not
have
to
run
I
hope
using
data,
because
I
always
share
the
information
on
post
ever
go
on
to
Emma
and
look
at
my
other
complications,
because
when
otherwise
did
share,
it
makes
it
all
about
their
own.
They
want
a
narrow,
so
no
one
will
charge
any
other
communication
to
none
right.
So
if
there,
between
another
human
plan
on
the
corner
of
and
money,
you
can
pay
by
not
getting
around
the
other
mutation,
be.
A
A
B
D
You're
talking
about
ready
arbitration
already
so
my
time
of
any
prizes,
Nigel
daughters
and
a
pretty,
and
but
instead
of
a
good
time,
your
talk
you
into
a
double
example.
For
yes,
there
was
beneath
on
gene
illusions
or
injecting
the
air,
as
well
as
for
the
composition
of
the
last
that
degree.
The
right
results
tomorrow,
work
and
so,
but
we
might
require
that
the
ontogenetic
ask
you
on
anyway,.
A
So
we're
planning
to
implement
this
single
step,
verification
for
a
process
for
architecture
called
lanai
which
is
developed
by
google
for
some
networking
processor,
and
this
architecture
is
questionable
and
Google
wrote
a
and
L
of
the
unpack
and
for
that
architecture.
So
you
can
compile
C,
C++
and
rust
code
into
that
into
that
back
end
and
I'm
not
sure
what
I
forward
in
whatever
I
will
no.
A
A
I
mean
it's
not
part
of
block,
so
it
is
fitting
that
clock
sense.
It's
just
so
also.
This
is
file
search
that
only
works
for
virtual
functions,
so
you
have
to
include
with
the
full
state
and
input
and
output.
You
can
work
on
on
swarm
files
I
like
that,
but
that
requires
that
you
actually
have
a
proof
that
the
file
is
available,
which
is
popular.
This
works,
at
least
in
the
fire
working,
and
that's
why
you
can
so.
C
A
E
A
C
That
I
and
I
will
comment.
After
and
in
principle,
we
would
have
a
situation
where,
and
there
will
be
so
much
always
be
very
tight.
That's
what
we
want
so
and
in
the
end,
is
everyone
dressed
or
error.
They
won't
be
the
only
one
challenge,
because
the
suburban
will
challenge
and
an
important
two
three
four
five
six
El
Paso
well
and
champion-
and
it's
someone
who
originally
because
it
as
many
very
well.
C
No,
they
won't
enter
anything
to
deserve
this
and
increases
and
they
want
their
learning,
English
underwear,
some
kind
of
equal
to
let's
say
the
solution
is
jealous
of
that
free
everyone,
just
the
body.
Would
you
then
make
sense
for
the
soldiers
will
just
create
account
and
always
some
it's
for
service
is
his
term
that
we
have
a
service
to
everyone.
Looking
at
that
these
are,
they
are
already
mastered,
as
it
does
make
sense
for
me
to
join
in
and
then
f
of.
A
A
A
A
A
Yeah
I
explained
how
to
fix,
gave
trusted
computations
with
analogous
contestants.
So,
as
the
only
requirement
is
a
working
trusted
execution
environment
with
limited
capacities
so
in
block
chain,
and
it
can
be
scared
to
me
more
or
less
unlimited
capacity
ads
at
unanimous
consent.
The
website
is
too
narrow
and
the
taking
of
white
paper
and
they
hope
they
get
link
which
can
also
be
harmless.