Heartwood — proof that an LLM endpoint spent the compute you paid for

01The gap, named by the field itself

Two papers from July 2026 define it. We did not invent the gap — we are first to close it.

Cryptography cannot bind effort

Hollow-LLM (arXiv 2607.28884): “proof of correct inference is not proof of large-model execution.” Ghost weights satisfy the ZK circuit while running a tiny model.

Behavioural audits cannot transfer

IRIS (arXiv 2607.20860), on itself: “no mechanism allows independent verification; the audit is auditor-centric… no cryptographic commitment or public randomness is used.”

One layer is publicly verifiable but semantically empty on effort. The other is semantically real but unprovable to anyone else. Heartwood bridges them.

02The attack that defeats every existing layer

Silent reasoning-effort downgrade. Genuine model, genuine weights, genuine binary — less computation per request. Not hypothetical: reasoning tokens are documented as silently dropped through gateways, and GPT-5.1 defaults reasoning_effort to none.

Verification layer	Binds	Verdict
TEE attestation (Tinfoil, Phala, Apple PCC)	hardware, firmware, image	PASSES
zkML weight commitment	architecture + committed weights	PASSES
AEX / zkTLS provenance	a signature chain	PASSES
Style fingerprinting (LLMmap, IRIS)	output distribution	blind (AUC 0.523)
Heartwood	computation actually spent	CATCHES IT

Style is cheap to fake. Capability is not. A padded skimmer blinds a length detector, while the capability gap holds at 0.750 vs 0.208. That asymmetry is why a semantic test binds effort where cryptography provably cannot.

03Measured on production frontier APIs

Claude Haiku 4.5 and Claude Opus 5 via the Anthropic Messages API. Same model, same weights, same signed response — only the compute differs.

4queries to catch a full effort skim on Opus 5

0false positives across 105 honest queries

10⁻²⁷where honest evidence decayed to

Model	Endpoint	Verdict	Queries	Receipt
Haiku 4.5	honest	no deficit	60	valid
Haiku 4.5	effort-skimmed	EFFORT_DEFICIT	4	valid
Haiku 4.5	50% dilution	EFFORT_DEFICIT	14	valid
Opus 5	honest	no deficit	45	valid
Opus 5	effort-skimmed	EFFORT_DEFICIT	4	valid
Opus 5	50% dilution (p1=0.65)	EFFORT_DEFICIT	33	valid

The capability band belongs to the model, not the protocol. Opus 5 solves an 8-step chain in 3 output tokens with no deliberation — audit it at Haiku's difficulty and every query is uninformative. Calibration is the step you cannot skip.

04How it works — the ordering is the security

CalibrateFind the claimed model's capability band on a disjoint pool. p0 is a conservative lower bound, biasing the test against finding fault.
CommitPublish SHA-256 over every question and answer, before any query is sent.
Bind to a public beaconA drand round that did not exist at commit time selects which items are used. Neither side controls the sample.
Bete_t = 1 + λ(p0 − x_t). Under the null this is a supermartingale, so Ville's inequality gives an anytime-valid guarantee — stop whenever you like without inflating false positives.
Emit a receiptAnyone recomputes it offline: regenerate the pool, re-derive the order, re-grade every response, re-multiply the evidence.

Commit before the beacon exists and the auditor cannot cherry-pick while the provider cannot predict which requests are audits. Reorder these steps and it is no longer Heartwood.

And the limit of that, found by attacking our own verifier. Step 5 derives the item order from the beacon the receipt itself carries — so an offline check proves a receipt is self-consistent, not that its beacon was ever drawn. An auditor free to invent that value can grind candidates until the ordering favours the verdict they want: 1,017 tries, 0.4 seconds to manufacture a false EFFORT_DEFICIT against an endpoint with no deficit at all. verify.py --online anchors the beacon to the drand chain and rejects it — and all twelve published receipts anchor to real rounds. Reproduce with python security_test.py; the full write-up is limitation 2 in the threat model.

05Verify a receipt yourself

git clone https://github.com/zcashsensei/heartwood
cd heartwood
python verify.py evidence/frontier/opus5_receipt_hollow.json

Seven checks, entirely offline — no contact with the auditor, the provider, or the network. That is what makes the evidence transferable.

Check	Defeats
pool_commitment	pool substitution
beacon_selection	cherry-picking, reordering, beacon swap
response_hashes	response tampering
regrading	grade flipping
lambda_matches_plan	post-hoc bet tuning
wealth_recomputed	evidence inflation
verdict_consistent	verdict restatement

11/11 forgeries caught by the adversary suite · 155/155 tests passing · 5,400 ground truths re-derived by an independent parser · 12/12 published receipts anchored to real drand rounds.

06What Heartwood does not prove

Published because a reviewer will find them anyway, and because work that hides its boundary is worth less than work that states it.

It does not bind responses to the provider. A dishonest auditor could fabricate a transcript; the adversary suite demonstrates this rather than hiding it. Compose with AEX or zkTLS — and note zkTLS today is designated-verifier.
A negative result is not a clean bill of health. It means “no degradation beyond p1 detected in n queries.”
Sensitivity is what you declare. The same 50% dilution went undetected at p1=0.30 and was caught in 33 queries at p1=0.65. Milder tolerance costs queries and buys sensitivity.
Behaviourally identical substitution is undetectable. We argue that is the right equivalence class for an API customer, but it is a real limit.
The statistics are not novel. Betting martingales are standard. The contribution is the composition and the threat model.
The skim was configured by us, not caught in the wild. This shows the audit detects the attack — not that any provider performs it.