"Ampere changes the unit economy for AI neoclouds"
Vipul Ved Prakash
Together AI CEO
This document describes the design of the Ampere network – the first useful proof-of-work L1 protocol for native AI computations. The heart of the protocol is a new and efficient implementation of the core GPU opcode (matrix-multiplication), allowing GPUs to implement proof-of-work as a side-effect of native AI training and inference workloads (2-for-1). As such, the Ampere protocol intertwines energy, data, and money into a single atomic operation. This document outlines the protocol design, key implementation choices, and various economic aspects of the system.
"If... we can find some useful computation which is easy to verify, then cryptocurrency mining could actually become a huge boon to society..."
"Ampere changes the unit economy for AI neoclouds"
Vipul Ved Prakash
Together AI CEO
One of the biggest conceptual contributions of Bitcoin, is turning electricity into currency: Bitcoin showed that scarce, verifiable energy can be transmuted into digital scarcity and credible neutrality. Alongside its sweeping success and adoption, Bitcoin mining taps merely to a niche, artificial source of energy (random hashing), applicable only to specialized hardware (ASICs). By contrast, Artificial intelligence (AI) is projected to consume the vast majority of global electricity within a decade1. Indeed, it is increasingly clear that in the age of LLMs, the fundamental barrier of AI progress is neither models, algorithms nor hardware (GPUs) – but the production and availability of energy for training and inference. Our central thesis is simple:
A permissionless monetary network, which replaces Bitcoin's wasteful proof-of-work mining (artificial hashing) with the native operation underlying modern AI: matrix multiplication (GEMM). As such, Ampere is able to turn general compute on commodity hardware (GPUs) into a monetary currency, directly leveraging AI growth to secure the trust layer of AI agents. Ampere is the Bitcoin of the AI compute era.
Two observations motivate the design of the network.
Observation 1: AI is governed by physics. As many have argued, intelligence is expensive in joules.
If this is correct, the right meter for the AI economy is not clicks or API calls but verifiable floating-point or integer operations powered by energy. Ampere operationalizes this idea by turning the blockchain into an AI compute meter: block rewards are minted in direct proportion to verifiable multiply–accumulate work, tying issuance to a measurable physical substrate.
Observation 2: AI and Bitcoin now compete for the same resource. The binding constraint is electricity. A sharp claim from recent debate makes the point vivid:
Whether or not the exact figure proves correct, the direction is clear: energy is finite, and both AI training and Bitcoin mining bid for it. Today, in many environments, GPU-based AI compute margins exceed ASIC-based Bitcoin mining margins, yet little of that surplus contributes to decentralized consensus or a credibly neutral state layer. Ampere stitches these worlds together so that each kilowatt-hour spent on AI can simultaneously earn mining rewards and secure a monetary commons.
Ampere is designed as a state layer where AI agents live, transact, and reach consensus. Agents optimize explicit rewards; Ampere makes those rewards on-chain, verifiable, and mineable.
Classical Proof of Work monetizes security. Ampere monetizes security and utility. As with Bitcoin, volatility and speculation fund the security budget. In Ampere, that same demand subsidizes useful work: miners can repurpose AI workloads (training and inference) for mining, creating a parallel revenue stream from the exact same GPU cycles. The result is a virtuous loop:
This dual-utility design also increases the throughput of GPU providers. Because Ampere mining is tiled, kernel-level, and parallel, it interleaves with normal AI computation with negligible overhead. Providers extract yield from idle fragments, pipeline stalls, and micro-batches, turning once-wasted headroom into block-eligible work without sacrificing service-level objectives.
"Ampere finally makes proof-of-work serve AI instead of fighting it"
Dan Boneh
Stanford University
Ampere merges the world's two largest energy-consuming digital markets (AI compute and cryptocurrency mining) into a single GPU-native operation. Practically, we integrate a new MatMul mining kernel into existing AI frameworks and runtimes. Training and inference jobs call into the same vendor-optimized matrix-multiplication primitives they already use; a Ampere drop-in path augments these calls with negligible additional operations to facilitate mining. ML practitioners keep their stacks and models; miners keep their data-centers; the network gains security from useful AI work.
At the heart of Ampere is a Proof of Useful Work that maps ordinary matrix multiplication into Nakamoto-style mining while preserving three properties: fairness, verifiability, and privacy.
This construction retains the security semantics of Nakamoto consensus: any adversary must still accumulate almost all of the effective work. It is ASIC-resistant by universality: matrix multiplication is the canonical throughput path on commodity GPUs and accelerators and is already relentlessly optimized by vendors and open-source stacks. Rather than fighting specialization, Ampere harnesses the industry's existing optimization roadmap.
Three converging shifts make Ampere timely:
"Ampere proves you don't need to reinvent consensus - just make it useful"
Evan van Ness
Ex-Ethereum
Foundation |
Ampere Foundation
Our system is a Proof of Useful Work (PoUW) blockchain built as a fork of the Bitcoin protocol, integrating the cryptographic proof of useful work mechanisms proposed to replace traditional hash-based PoW with verifiable matrix multiplication tasks. While maintaining the features of Bitcoin's security and consensus model, the blockchain introduces key adaptations to support the new proof of work protocol as well as other improvements.
At its core, our blockchain maintains a ledger of unspent transaction outputs (UTXOs), which represent coins available for spending. Transactions in our network consume existing UTXOs as inputs and create new ones as outputs, effectively transferring value. Each transaction is digitally signed using the sender's private key, ensuring authenticity and authorization. All nodes in the network propagate transactions and blocks using a gossip-like protocol over the P2P network, allowing for robust dissemination and fault tolerance.
The ledger is a linear sequence of blocks, each containing a batch of transactions, a timestamp, a reference to the previous block's hash, and a proof satisfying the proof-of-work condition. The PoW algorithm acts as a computational black box, where given a block header, it requires finding a special input such that the a particular condition is satisfied. The condition is adjusted as the competition for solving the black box varies, determining the block's difficulty.
This target is recalibrated approximately every two days to maintain an average block time of ten minutes.
Nodes adhere to the "longest chain rule," which selects the chain with the greatest cumulative work (i.e., the most difficult chain) as the valid one. This rule ensures convergence and consistency in the presence of forks. When multiple chains exist temporarily (e.g., due to propagation delays), nodes continue mining on the one they see as the most difficult, and eventually all nodes converge on a single chain as it extends further. New blocks extend this chain, and only confirmed transactions within the longest chain are considered final.
To prevent double-spending and ensure ordering of transactions, our blockchain relies on the immutability of the blockchain enforced by proof of work mechanism and an economic incentive. Miners who create valid blocks are rewarded with newly minted Ampere coins (block subsidy) and transaction fees, providing both issuance and security. Because the proof of work is computationally costly and rewards are only granted for extending the valid chain, attackers would need to control the majority of the network's total "puzzle solving" power to subvert the system, which becomes economically and physically impractical at scale.
UTXO framework. The UTXO (Unspent Transaction Output) model is the accounting framework used to track the ownership and transfer of value. Unlike an account-based system that maintains balances per address, the UTXO model defines coins as discrete chunks of value represented by outputs of transactions that have not yet been spent. Each UTXO is uniquely identified by the transaction in which it was created and the index of the output within that transaction.
A transaction consumes existing UTXOs as inputs and produces new outputs that become UTXOs themselves. Each input specifies a reference to a previous transaction's output and includes a cryptographic signature satisfying the conditions set in that output's locking script. This script typically requires a valid digital signature from the private key corresponding to a public address. When a transaction is validated, the node executes the unlocking script provided in the input together with the locking script of the referenced output to check whether the spending conditions are satisfied.
The structure of a transaction thus consists of one or more inputs, each referencing a previous UTXO, and one or more outputs, each specifying a value and a locking script. The sum of the input values must be greater than or equal to the sum of the output values; the difference, if any, is interpreted as a transaction fee and claimed by the miner who includes the transaction in a block.
The global UTXO set is maintained by each full node and represents the current state of spendable outputs. When a new transaction is received, a node checks that all referenced inputs exist in the UTXO set and are unspent, that the signatures are valid, and that no double-spending occurs. Once validated, the transaction updates the UTXO set by removing the consumed inputs and adding the new outputs.
"the evaluation of the pricing function serves no useful purpose... It would be exciting [...if it] serves serves some additional purpose"
Moni Naor & Cynthia Dwork, 1992
Advances in Cryptology →
"Ampere turns every GEMM into a lottery ticket - it's the kernel we've been waiting for"
Tri Dao
Stanford
University
Co-founder Together AI
At the core of our blockchain lies the Proof of Useful Work (PoUW) protocol, which we describe in this section. Our objective is twofold: to design a Proof-of-Work (PoW) protocol that upholds the essential properties required for secure blockchain maintenance, while simultaneously computing a useful result—namely, the product of two arbitrary matrices. Crucially, we demonstrate that this useful computation can be performed concurrently with the PoW mechanism, incurring essentially no additional overhead.
Proof-of-Work Protocols: A Proof-of-Work protocol enables a party to generate a cryptographic proof that certifies the execution of a certain amount of computational effort. This concept underpins the security and fairness of blockchain systems by offering a decentralized and probabilistic mechanism for selecting the next block miner. Selection is distributed proportionally to the computational effort expended by participants. At a high level, let σ denote the current state of the chain (or a succinct digest thereof). A PoW protocol processes σ and yields a verifiable proof or identifier certifying that substantial computational work was performed. These proofs serve as lottery tickets, each with a small probability of winning—i.e., granting the right to mine the next block. Each valid proof is equally likely to win. To have the expected mining rate aligned with the computational effort invested, we need the number of such proofs a party can produce to be proportional to their computational power. To preserve this fairness, it is essential that the protocol enforces consistent computational cost across all participants, ensuring that each unit of work corresponds to a uniform chance of success.
Matrix Multiplication Algorithms: Matrix multiplication is a foundational operation in a wide range of computational workloads, particularly in the domain of machine learning. Both training and inference in modern ML models, ranging from deep neural networks to linear classifiers, rely extensively on repeated multiplication of matrices. These operations are computationally intensive, highly parallelizable, and occur abundantly in large-scale deployments, making them a natural fit for underpinning a Proof of Useful Work protocol. Over the years, a series of theoretical algorithms have been developed to asymptotically improve upon the naive O(n3) approach. However, in practical settings, especially within high-performance and hardware-accelerated environments, optimized variants of the naive algorithm are overwhelmingly favored. These implementations are better aligned with modern memory hierarchies and vectorized execution models, offering significant performance advantages despite their asymptotic inefficiency. Importantly, these algorithms exhibit highly predictable runtimes that are determined primarily by matrix dimensions, and not by the specific values of the entries. This input-agnostic runtime behavior,
combined with the widespread utility of the results, makes matrix multiplication particularly well-suited for integration into a PoW protocol.
Our Proof of Useful Work (PoUW) protocol integrates these two components: cryptographic proof generation and matrix multiplication. The protocol takes as input both the blockchain state σ, as required in a standard Proof-of-Work setting, and a pair of matrices A, B, which serve as inputs to a matrix multiplication algorithm. As output, it yields the product A · B, as well as a cryptographic proof that this result was obtained through the execution of a specific matrix multiplication algorithm—thereby constituting a valid "lottery ticket" corresponding to the state σ.
A key design goal is that the total runtime of the PoUW protocol should closely match the runtime of the matrix multiplication itself, ensuring minimal overhead. Moreover, the cryptographic proof must certify not merely the correctness of the output A · B, but also that the full matrix multiplication algorithm was faithfully executed. This constraint is crucial to prevent adversarial strategies—for instance, miners attempting to gain an advantage by multiplying trivial or degenerate matrices (e.g., all-zero inputs) in pursuit of a faster Proof-of-Work. By binding the proof to the computational trace of a genuine algorithm, we ensure fairness across miners and align computational effort with meaningful output.
An additional important design goal arising from this integration is privacy. Since the cryptographic proofs generated by the protocol may occasionally become public, namely, when a "winning ticket" is published as part of the blockchain, we must ensure that these proofs do not leak any information about the input matrices A and B. In many applications, such matrices may contain proprietary data, model weights, or sensitive user-derived information. Therefore, it is essential that the proof attests only to the correctness and integrity of the computation, without revealing any details of the inputs themselves. This necessitates the use of zero-knowledge techniques or cryptographic abstractions that decouple computational verifiability from data exposure, thereby preserving input confidentiality while enabling public validation.
A central idea of our protocol is to introduce and eventually remove a carefully constructed form of noise in the matrix multiplication process, to preserve computational correctness while unifying computational hardness across all inputs. Specifically, we generate two noise matrices E and F, and add them to the input matrices A and B, respectively. The protocol then proceeds by computing the product of the perturbed matrices (A + E) and (B + F), and producing a proof attesting to the correctness of this computation.
The distribution of the noise matrices E and F needs to be carefully designed. On one hand, the product (A + E) · (B + F) should be as hard to compute as the product of two random matrices, so that an adversary cannot construct A and B in a way that simplifies the computation. This guarantees
Section coming soon...
Section coming soon...
Section coming soon...
Section coming soon...
Section coming soon...
