a ledger that records not just what a model is, but the proof that it was novel and the proof of who said so.
AperX is an optimistic verification platform for the provenance of machine-learning artifacts. Models, datasets, and claims are recorded as vertices in a hypergraph; lineages, weight configurations, and derivations are directed hyperedges. Novelty is estimated as a U-statistic over combinations of prior art and reported as a possibility-necessity band rather than a point probability. A relational collapse rule commits a claim only when necessity clears a saturation-adjusted threshold and a weighted supermajority of bonded validators agree; otherwise the claim is rejected on possibility or suspended to a human privileged observer. The heavy mathematics runs off-chain under a deterministic, content-addressed specification, while the chain holds commitments, bonds, and fraud-proof gates, so verification scales with cloud MLOps rather than stalling at a block limit. This paper sets out the ledger topology, the consensus mathematics, the optimistic verification architecture, the validation lifecycle, the mathematical foundations and their honesty tiers, and the security model.
As machine-learning artifacts proliferate, three questions become load-bearing and remain largely unanswerable at scale: what produced this model, is a stated result actually novel against the field, and who is entitled to attribution. Conventional ledgers linearize history into a chain of blocks. Provenance is not linear. A model is produced jointly by checkpoints, datasets, and training runs in specific proportions; a claim is anticipated, or not, by combinations of prior works no single one of which is decisive. Flattening that structure into pairwise edges discards exactly the information a novelty or attribution decision depends on.
AperX takes the opposite stance. It preserves the native shape of provenance as a hypergraph, treats novelty as a property of subsets, and refuses to convert epistemic ignorance into false precision. Where a claim cannot be resolved, the protocol is permitted to say so and escalate, rather than manufacture a verdict.
Provenance has four genuine shapes. Each is a distinct hypergraph class the ledger records without flattening.
An edge e = (T, H, ω) states that a tail set of checkpoints, datasets, and runs produced a head artifact in weighted proportions ω, or that a set of prior works and authors produced a claim. A pairwise graph must decompose that assertion into edges nobody actually made.
Every review edge binds exactly k evaluators, whether k benchmark harnesses scoring a checkpoint or k reviewers judging a paper. Uniformity makes edges exchangeable, which is the precondition for lifted statistical inference over them.
Multiset edges keep repeated lineage visible rather than silently deduplicating it, so a model fine-tuned from its own ancestor, or a self-citation, appears on the ledger and is discounted rather than rewarded.
Saturation measures how much of a domain's combinatorial space is already explored. A novelty score of 0.6 means something different in a saturated architecture family than in an emerging one, so saturation enters the collapse threshold directly.
Every quantity below is recomputable from committed inputs, which is what makes the fraud proofs enforceable.
A claim that no single prior work anticipates but which a combination jointly anticipates is a property of subsets, so the estimator ranges over subsets of size m. Unbiasedness is what lets it survive a dispute in a way a tuned heuristic cannot.
By Hoeffding projection the estimator is asymptotically normal, so novelty is always an interval. A claim whose interval straddles the threshold is not quietly approved; it is epistemically unresolved and treated as such.
An unverified claim in an emerging field has no reference class; forcing a probability invents information. AperX carries a possibility-necessity pair, and the gap between them is reported epistemic ignorance rather than something to be minimized away.
Commitment gates on the conservative lower bound (necessity); rejection gates on the optimistic upper bound (possibility). The residual region is not resolved by a coin flip; it is suspended to a bonded human privileged observer. The threshold rises with saturation and relaxes under measured drift.
You cannot compute a lifted U-statistic over millions of prior-art tuples inside a block gas limit. AperX therefore separates concerns the way an optimistic rollup does. The expensive, deterministic mathematics runs off-chain against a pinned specification with fixed-point arithmetic, so that any party recomputing from the same committed inputs obtains a bit-identical result. The chain records only what must be trust-minimized: content-addressed commitments to inputs and partitions, validator bonds, posted verdicts, and a challenge window.
During the challenge window any party may recompute a contested edge. A divergence between the recomputation and the committed result is a fraud proof; the protocol slashes the bond of the party that posted the incorrect result. Because recomputation is deterministic and inputs are content-addressed, the fraud proof is objective rather than a matter of opinion.
Featurization, partitioning, the U-statistic estimate, and the possibility bounds all run off-chain under a versioned specification. Determinism is a first-class requirement: disputed replay must be bit-identical, so the arithmetic is fixed-point and every seed is committed.
The chain stores the partition root, the estimate commitment, validator identities and bonds, verdicts, and the challenge deadline. Settlement is small and cheap; the heavy work lives off-chain and is only ever re-run under dispute.
Step 08 is the architectural heart. A protocol forced to return a verdict on every claim returns bad verdicts on hard claims; this one is allowed to say unresolved and hand the claim to a human.
A document meant to establish mathematical credibility is destroyed faster by one indefensible claim than helped by twelve impressive ones. Each pillar states its concrete job and its honest limit.
Relational calculus gates logical consistency; probability bounds collusion risk and sets the challenge window; game theory and mechanism design align staking and slashing; information theory measures lineage as information transfer; optimization makes disputed replay bit-identical; statistics audit drift; graph and hypergraph theory are the provenance backbone.
Computability theory and formal methods draw the line between blocking gates that must provably halt and everything else; the scheduled work is a mechanized proof that recomputation is a total deterministic function. Homology and topology fingerprint network structure so a verified model matches its claimed architecture.
Stochastic partial differential equations would extend provenance to scientific-ML surrogates; algebraic geometry over parameter varieties is aspirational. The Dinov and Velev time-complexity framework spans tiers: its time-complexity argument is load-bearing, while the complex-time (kime) representation is a named research option that nothing in the protocol depends on.
The adversary of record is a coalition of validators attempting to commit a false novelty or attribution claim, or to censor a true one. Three mechanisms bound that adversary. First, agreement is a weighted Byzantine supermajority, so a minority stake cannot force a commit. Second, every commit is objectively re-checkable during the challenge window, so a false commit that survives voting is still slashed on recomputation. Third, bonds make dishonesty negative-expected-value: the slashed stake exceeds the gain from a successful lie under the parameters the mechanism-design layer sets.
Two failure modes are handled explicitly rather than hidden. A claim the estimator cannot resolve is suspended to a human privileged observer, not forced to a verdict. And export-controlled material is gated before formalization, so the ledger never anchors what it is not permitted to hold.
Commitment requires agreeing weight of at least two thirds of total stake, following the classical bound on Byzantine fault tolerance. Weight is stake, not head count, so identity inflation buys nothing.
Because inputs are content-addressed and arithmetic is fixed-point, a challenger who recomputes a different result has produced proof, not opinion. The protocol slashes on divergence without a subjective vote.