SPICE, 0G, and Origins Forge a Verifiable Trinity for Agentic DeFi

The infrastructure for verifiable AI inference is crystallizing around a three-layer stack: identity and provenance, verifiable compute, and on-chain settlement. Three projects—SPICE, 0G, and Origins—each contribute a critical piece, and together they define how autonomous agents will prove their execution in DeFi and beyond. It’s like watching the early days of the internet’s TCP/IP stack, but with more cryptographic firepower and less optimism about human nature.

SPICE, an IETF Internet-Draft, formalizes the provenance layer. Its core innovation is the inference_root claim: a Merkle root of an append-only inference registry embedded in an OAuth token [^claim_2025]. This keeps large proof payloads off the token while enabling audit-plane retrieval. The draft supports two proof types: ZKML proofs for mathematical certainty and TEE attestation quotes for hardware-rooted proof [^claim_2026]. Critically, it quantifies the tradeoffs: ZKML is currently limited to ~100M parameters, while TEE attestation scales to 100B+ parameters [^claim_2027]. Proof sizes range from ~200 bytes (Groth16) to ~50KB (STARKs) for ZK, and ~2KB (Intel TDX) to ~4KB (NVIDIA) for TEE [^claim_2027]. Think of it as the difference between a Swiss watch and a tank—both reliable, but one is for precision, the other for brute force.

The threat model is concrete: model substitution, weight tampering, environment spoofing, and replay of stale proofs [^claim_2028]. SPICE mitigates these by binding proofs to model_fingerprint, input_hash, output_hash, and iat timestamp [^claim_2028]. For real-time applications like chat or interactive agents, the draft recommends TEE attestation quotes exclusively; ZKML is reserved for batch/offline or high-stakes cases [^claim_2030]. This maps directly to DeFi agent risk controls: a trading agent must prove model identity and fresh execution before touching wallets. It’s like a bouncer checking ID and breathalyzer before letting you into the club.

0G provides the execution layer. Its Aristotle Mainnet, live since September 2025, offers verified compute, persistent memory, and onchain settlement [^claim_2031]. Every inference call runs inside a TEE and is cryptographically verified [^claim_2031]. The project claims its DA layer is 50,000x faster and 100x cheaper than Ethereum’s [^claim_2032]—a claim that, if true, changes the economics for agent logs and proof posting. It’s the kind of performance that makes traditional blockchains look like dial-up modems in a fiber-optic world.

Origins Network adds a modular settlement layer. It raised $8 million to build a chain where heavy AI inference runs off-chain on GPU infrastructure from AWS, Tencent Cloud, and Alibaba Cloud, while succinct proofs are verified on-chain [^claim_2033][^claim_2034]. This is a hybrid Web2/Web3 compute market: cloud GPUs execute, blockchain governs verification and settlement. It’s the financial equivalent of short-selling the cloud oligopoly while going long on cryptographic trust.

Finally, the DeFi-ML paper provides the threat data. Its curated dataset includes 298 distinct exploits, 402 exploit transactions, and $3,735,630,450.52 in total losses [^claim_2035]. Classifiers like CNN(F4, K4) achieve 0.9004 accuracy and 0.8200 F1 on unseen exploits [^claim_2036]. These benchmarks show that transaction-level classifiers can be both accurate and gas-feasible, enabling on-chain threat scoring. The numbers are cold, but the losses are real—like reading a balance sheet after a market crash.

The synthesis is clear: TEE-first for latency, ZKML for high-assurance settlement, and a compact provenance token to tie it all together. For DeFi, this means agents can prove their reasoning without revealing it, and protocols can audit execution without re-running it. It’s a stack built for speed, trust, and the cold logic of capital markets.