The puzzle

Here is the whole Pearl mining puzzle in one paragraph. A miner takes a block template, multiplies two matrices of small whole numbers, and turns every little patch of the result into a lottery ticket. Before multiplying, it must add noise that nobody could predict until the block and the matrices were fixed. While multiplying, it keeps a diary of each patch’s running totals, and the ticket is a hash of that diary. A ticket wins if it’s small enough, scaled by how much work it cost. The winner is proven with a zero-knowledge certificate, and the noise is peeled off so the real product isn’t wasted.

This page walks through it step by step, first in plain words, then exactly, with every intermediate value from a small worked example you can run below.

Try it

The toy miner runs Pearl’s real steps, with the real hash functions and byte formats, on 4 × 16 and 16 × 4 matrices. Step through it in order.

What are the steps?

1. Start from a block template

   The miner prepares a block template: version, previous block, Merkle root, time and bits, the first 76 bytes of the header. There is no nonce, and the last 32 bytes (the proof commitment) can’t be filled in yet.

2. Pick two matrices

   A is m × k and B is k × n, whole numbers from −64 to 64. In the official miner they are an AI layer: the activations of at least 1,024 tokens, and the layer’s weights. The rules don’t care what they mean.

3. Fingerprint everything

   BLAKE3 hashes the template and the mining settings into a job key. Keyed with it, BLAKE3 fingerprints A (row by row) and B (column by column). Each fingerprint is the root of a Merkle tree over 1 KiB chunks, so single rows can be proven later.

4. Roll the dice for the noise

   The fingerprints, salted with the matrix sizes since block 99,000, are hashed into two noise seeds. Change one byte of the template, or one entry of B, and both seeds change completely. Change one entry of A and A’s seed does, while B’s stays put.

5. Add structured noise

   Each seed grows into a noise matrix the size of A or B: a thin random matrix times a ±1 selector, rank 128. Added on top, A′ = A + E_A and B′ = B + E_B still fit in a byte.

6. Multiply, keeping a diary

   The GPU multiplies A′·B′. For each tile of output cells (2 × 64 in the reference miner), every 128 steps along k, it XORs the tile’s running sums into one 32-bit word and stirs it into a 64-byte diary, the transcript.

7. Turn every tile into a ticket

   When a tile is done, BLAKE3 keyed with seed A hashes its diary into a 256-bit ticket. One big multiplication gives hundreds of millions of them.

8. Check the ticket

   Read as a little-endian number, a ticket wins if it is at most the target times the work it cost, h·w·L multiply-accumulates. Since block 96,251 a higher noise rank also makes the bar stricter.

9. Prove it without revealing it

   The winning tile’s rows and columns, with their Merkle paths, go to the pool or gateway, which turns them into a ~60 KB zero-knowledge certificate. The header’s last field commits to its public data, and the block hash is SHA256d of the finished header.

10. Peel off the noise

    In the same pass, the GPU subtracts two cheap low-rank corrections and gets back A·B, the layer’s real output. (In integers the identity is exact; whether the GPU’s floating-point path is bit-for-bit exact is an open question.)

11. Why can't anyone cheat?

    The noise is unknowable until everything is committed, so no product can be prepared or reused. And because the ticket depends on every intermediate running sum, the known shortcuts cost as much as the multiplication. That last part is an argued conjecture, not a proof.

What does each step compute, exactly?

The plain story has exact arithmetic behind it. Each expander below gives the rule as Pearl’s code implements it, with the toy example’s real values.

Template, settings and job key

header76 = 01000000 aa…aa bb…bb 0078e768 00000120
config52 = 10000000 0400 0000 000100000000 000100000000 00…00
job_key  = 55e6f3546f79cb12be7462f5a03703c9115347f7b1f0c95a174a17d4414d242d

Fingerprints and seeds

hash_A = BLAKE3_keyed(job_key, pad1024(A row by row))     = 94afc3a464d534521b566c3316fb2ac0b509f3d0f86482297224cee05e90d3ae
hash_B = BLAKE3_keyed(job_key, pad1024(B column by column)) = f146e7981399e075cc81811357527ee29efb43ad61868d01a701a91a5aaa3425

bound_A = BLAKE3_keyed(BLAKE3("pearl/cert-v3/noise-seed/A"), hash_A ‖ LE32(m) ‖ 28 zero bytes) = 43ba7eb2…2c7946bb
bound_B = BLAKE3_keyed(BLAKE3("pearl/cert-v3/noise-seed/B"), hash_B ‖ LE32(n) ‖ 28 zero bytes) = a7502e0a…920c99d2
seed_B  = BLAKE3(job_key ‖ bound_B) = 05899146801117e66a811953e5aa4b480a0a37fb79f9d274f2a51a7e5683f99d
seed_A  = BLAKE3(seed_B ‖ bound_A)  = c40e9a24b1de3b558dc081c19b8969be5f6873009faddae1cc35361524ec9745

Noise and noisy matrices

The diary and the ticket

C_tile += A′[R, slab s] · B′[slab s, C]           # r more multiply-accumulates per cell
X       = XOR of all h·w running sums, as u32
M[(s−1) mod 16] = rotl(M[(s−1) mod 16], 13) XOR X

The check, the certificate and the header

proof_commitment = SHA256d(03000000 ‖ public_data) = a5791938f80d02ef6eea1f050036bb0a1f68323861ae65e658a0bc5d40c9baf7
header108        = header76 ‖ proof_commitment
block hash       = reverse(SHA256d(header108))     = 095c5529d6536a9c396a6392be9baf707de78920002f1ccb536c122c6a08c403

Getting the real answer back

How big is the real thing?

The toy and mainnet side by side. The mainnet column is block 130,825’s certificate.

At that difficulty a block takes about 1.1 × 10²² multiply-accumulates on average: roughly 40 million multiplications the size of block 130,825’s, across the whole network, every few minutes.

for ll in (rank..=k).step_by(rank) {
    for (u, &a_idx) in a_rows.iter().enumerate() {
        for (v, &b_idx) in b_cols.iter().enumerate() {
            for l in ll - rank..ll {
                jackpot_tile[u][v] += a_noised[a_idx][l] * b_noised_t[b_idx][l];
            }
        }
    }
    let xored_tile = jackpot_tile.iter().flatten().fold(0u32, |a, &x| a ^ x as u32);
    let tid = (ll / rank - 1) % JACKPOT_SIZE;
    jackpot[tid] = jackpot[tid].rotate_left(LROT_PER_TILE) ^ xored_tile;
}
let jackpot_hash = compute_jackpot_hash(&jackpot, a_noise_seed);
let jackpot_bound = extract_difficulty_bound(header.nbits, &config);