Overview

Cifra is a Bittensor subnet where miners compete to build the fastest fully-homomorphic circuit for a published model.

The owner publishes a plaintext reference model. Miners compile their own optimized FHE circuit for it (bit-widths, p_error, rounding, distillation) and publish the recipe to HuggingFace, committing the pointer on-chain. Validators download each recipe, compile it in an isolated sandbox with 128-bit security enforced, check it still matches the reference (accuracy gate), and rank passing miners by measured FHE execution latency — geometric weights (1, 1/3, 1/9, …) flow down the leaderboard, so emissions go to whoever ships the fastest correct encrypted circuit.

Latency is a local measurement, so consensus rests on the ordering, not raw milliseconds: latencies within 3% tie (and the earlier on-chain committer wins the tie), while the eligibility gates (accuracy floor, 128-bit, complexity band) stay fully deterministic. Complexity is still logged next to latency as the hardware-neutral cross-check.

Architecture

owner  ──publish──►  reference model + calibration + rules (accuracy floor, size cap, toolchain pin)
miner  ──compile──►  recipe.json  ──HF upload──►  set_commitment({repo, rev}) on-chain
validator ──get_commitment──► download recipe ──► SANDBOX(compile 128-bit → accuracy gate → latency+complexity)
          ──► latency rank (3% tie-band, copy-priority) ──► geometric weights ──► set_weights

cifra/ is a normal Python package — no axon, no dendrite, no Synapse, no template base classes. Bittensor is touched only in chain/client.py; concrete-ml only in fhe/.

cifra/
  core/      pure numpy — recipe envelope, scoring, sampling (safe in both venvs)
  chain/     the only bittensor import — metagraph, get/set_commitment, set_weights
  hub/       HuggingFace upload/download (rev-pinned, byte-capped)
  fhe/       concrete-ml — compile (128-bit), sandbox evaluator, miner optimizer
  sandbox/   isolate the evaluator subprocess (CPU + wall-clock bounded)
  roles/     owner / miner / validator orchestration
  cli.py     `cifra miner|validator ...`

Security & consensus properties

• 128-bit floor is structural. The validator, not the miner, builds the compile Configuration; concrete's SecurityLevel enum has no sub-128 option, so a weak-crypto-for-speed circuit is impossible.
• No code execution from recipes. A recipe is concrete-ml JSON loaded with loaders.loads — never joblib/pickle — and compiled inside a CPU+time-bounded sandbox subprocess with credentials stripped.
• Deterministic verdicts. Complexity is reproducible across processes/validators under a pinned toolchain; the accuracy gate uses a task-seeded input set, so miner self-checks and every validator compute the same numbers. Mismatched-toolchain validators self-exclude.
• Anti-plagiarism. Recipes are fingerprinted; the earliest on-chain committer of a fingerprint keeps the reward, later copies score zero.