MLX: A Peer-to-Peer
Apple Silicon Supercomputer

1Introduction

Progress in AI has followed compute, and compute has concentrated. Amazon, Microsoft, Alphabet and Meta planned more than $700 billion of capital spending for 2026, most of it for AI datacenters^[1]. Those datacenters need power that the grid struggles to supply: the International Energy Agency estimates that datacenters used about 415 TWh of electricity in 2024 and will need about 945 TWh by 2030^[2], and their use grew 17% in 2025 alone^[3]. In the United States, in the regions with data, the median power project now waits more than five years between asking for a grid connection and starting to operate^[4]. Renting the result has not become cheaper this year. The median price of an Nvidia H100 across forty providers was $3.51 per GPU-hour in October 2026, up 18% on a year earlier^[5], as surging inference demand, compounded by memory shortages, pushed rental prices back up after their 2025 low^[6].

At the same time the work itself is shifting. Deloitte estimates that inference, the running of trained models, took about half of all AI compute in 2025 and will take about two thirds in 2026^[7]. Google alone processed more than 3.2 quadrillion tokens a month by May 2026^[8]. Inference is not one giant job. It is billions of small, independent requests, each of which needs a model held in memory and enough memory bandwidth to read it once for every token it writes.

The world already owns a different kind of computer. Apple reported more than 2.5 billion active devices in January 2026^[9]. Every Mac, iPhone and iPad built on Apple Silicon puts its CPU, GPU and Neural Engine on one package that shares one pool of unified memory, so a model loaded once is visible to every processor without copies. At the top of the range, a Mac Studio with M5 Ultra holds 512 GB of memory at 1.2 TB/s^[10], more memory than six 80 GB datacenter GPUs. These devices are already bought, powered, cooled and connected, and most of them are idle most of the day.

What is missing is a way for strangers to trust each other's devices: to route work to them, to check the results, to pay for the work, and to reward the people who build the network before it is useful. Bitcoin solved a related problem for money, letting mutually distrustful peers agree on a single history without a trusted party^[11]. Bittensor showed that peers can be paid for producing machine intelligence as ranked by other peers^[12]. Bittensor's validators rank miners by their judgement of output quality. MLX asks a question with an objectively right answer: did a specified model produce a specified output? It applies those ideas to that narrower problem, running a specified computation on a specified model and showing that it was done.

MLX also starts from the person at the Mac. Most people who want AI on their own hardware want it for themselves first: to chat, write code and make images with a model that never leaves the desk. MLX Harness, built on vMLX by JANGQ AI^[13], runs open models on Apple Silicon and serves them to other apps through local OpenAI-, Anthropic- and Ollama-compatible endpoints. It carries MLX Node, the network's worker, and installs it on first run. Every MLX Harness user is therefore a potential peer in both directions: the Mac answers its owner locally, works for the network while idle, and, once paid jobs open (§14), can hand a request it cannot hold to a larger Mac on the network. BitTorrent showed why this shape is robust: peers that download also upload, so capacity grows with demand instead of against it^[14]. MLX applies the idea to compute, with one difference that §6.2 explains: what moves between peers is a whole job, never a slice of one model (§6.5).

The aim, in one line: make it effortless for any Mac to do useful AI work, check that work honestly, and pay the person who owns it.

This paper describes the hardware the network runs on (§2), what it is designed to do and not do (§3), how work flows through it (§4 to §6), how results are verified (§7), what it does and does not promise about privacy (§8), the ledger (§9), the token and its halving curve (§10), how compute is rewarded (§11), how the design holds up against attack (§12 and §13), and what remains to be built (§14 and §15). Each part is marked by status: Live runs today on mainnet, which began on 18 October 2026, Planned is still to ship, and Research is designed but not yet committed.

2Apple Silicon as a compute substrate

2.1The installed base

Apple does not break its 2.5 billion active devices down by product or chip^[9]. Some anchors are public. About 25.6 million Macs shipped in 2025^[16], and since 2023 every Mac Apple sells runs on Apple Silicon^[17]. Counterpoint estimates that more than 450 million iPhones capable of running Apple Intelligence had shipped by the first quarter of 2026^[18]. The network does not need a large share of this base. One million participating devices would be well under a tenth of a percent of it.

2.2The bandwidth law

A language model writes one token at a time, and to write each token it must read every active weight from memory once. For a single stream of generation, that makes memory bandwidth, not arithmetic, the limit. If $B$ is memory bandwidth in bytes per second, $N_a$ the number of parameters active per token and $b$ the bits stored per parameter, then

Measurements agree. Figure 1 compares the bound with the speed llama.cpp measures for one widely used test model, Llama-2-7B quantized to 4 bits (Q4_0, 3.56 GiB), on four Apple chips^[19]. Real generation reaches 43% to 80% of the bound. Bandwidth figures are Apple's^{[10, 20, 21, 22]}. Apple's own measurements of the MLX framework on M5 tell the same story from the other side: its new GPU neural accelerators made the first token arrive 3.3 to 4.1 times sooner than on M4, a compute-bound step, while generation, which is bandwidth-bound, sped up only 1.19 to 1.27 times, in line with the 28% increase in bandwidth from 120 to 153 GB/s^[23].

Reading the prompt is different. During prefill, all prompt tokens are processed together, so the arithmetic units, not memory, set the pace. In the same benchmarks, prefill runs 11 to 28 times faster than generation per token^[19]. That asymmetry matters for verification: checking a finished answer means processing it as a prompt, which costs a small fraction of writing it (§7).

2.3What fits where

The second limit is capacity: a model either fits in memory or it does not. Mixture-of-experts models make this sharper, since they hold many parameters but read only a few per token, which suits devices with large memory and moderate bandwidth.

Applying equation (1) to the active parameters gives the ceiling for one stream: about 225 tokens per second for gpt-oss-120b on an M5 Max and about 125 for Qwen3.5-397B-A17B on an M5 Ultra, at about 4.25 and 4.5 bits per weight. Memory supply can move: Apple withdrew the 512 GB Mac Studio in March 2026 during the DRAM shortage and reintroduced it with M5 Ultra in August^{[10, 33]}.

2.4Pods

Since macOS 26.2, Macs can exchange memory directly over Thunderbolt 5 using RDMA, a capability Apple names for distributed AI inference with the MLX framework^[34], which exposes it as its JACCL backend alongside MPI and TCP rings^[35]. On four M3 Ultra Mac Studios, RDMA cut communication latency from about 300 µs to under 50 µs and ran the 1-trillion-parameter Kimi K2 Thinking at about 30 tokens per second^[36]. Apple states that a cluster of four Mac Studios runs AI inference up to three times faster than one^[37], and the open-source exo project reports tensor-parallel speedups of up to 1.8 times on two devices and 3.2 times on four^[38].

Apple has since published its own measurements of such clusters^[39]. From version 0.30.1, the MLX framework runs over the RDMA driver through its JACCL backend, with the Macs joined in a peer-to-peer mesh, and two Thunderbolt cables between each pair of Macs double the bandwidth of the link. A model can be split across the Macs in two ways. Pipeline parallelism splits it by depth, giving each Mac a run of consecutive layers. Generation runs about as fast as on one Mac, since each token still passes through every layer in turn, but a long prompt is cut into chunks that the Macs work on at the same time: prefill of a 65,536-token prompt ran up to about 1.8 times faster than on one Mac. Tensor parallelism splits every layer by width. It speeds up generation as well, but the Macs exchange data many times per layer for every token, so it depends on the low latency of RDMA, and dense models gain more from it than mixture-of-experts models.

The largest model in Apple's tests, Muse Spark Open, has 816 billion parameters, 42 billion of them active for each token. Its weights take more than 1.6 TB in BF16 and about 493 GB in NVFP4, which with working memory does not fit one 512 GB Mac. On four M5 Ultra Mac Studios with tensor parallelism it generated 36.7 tokens per second with an 8,192-token context. Two further results matter for MLX. The chip: M5 Ultra returned the first token up to 4.6 times sooner than M3 Ultra and generated 1.6 times faster. The cable: on four M5 Ultras with a 65,536-token prompt, Muse Spark Open's first token took about 50.5 s over one cable per pair and 40.6 s over two. There are limits. With two Macs and very long prompts, tensor-parallel prefill of a mixture-of-experts model can fall behind pipeline prefill, and all of these are Apple's own benchmarks.

The MLX framework's language-model tools serve a model, on one Mac or across a pod, behind a local endpoint compatible with OpenAI's API^[39]. MLX calls such a group, on one desk and joined by Thunderbolt, a pod, and treats it as a single worker.

2.5Energy

Apple publishes wall-power figures for its desktops. A Mac mini with M4 draws 4 W idle and 65 W at maximum^[40]; a Mac Studio with M5 Ultra draws 9 W idle and 385 W at maximum^[41]. A single H100 is rated up to 700 W before its host, networking and cooling^[32]. At the US average residential price of 18.31 cents per kWh in July 2026^[42], a Mac mini at full load costs about 1.2 cents an hour and a Mac Studio M5 Ultra about 7.0 cents. The European household average was €0.29 per kWh in the second half of 2025^[43]. Real inference draws less than the maximum. In Apple's tests with 65,536-token prompts, a Mac Studio peaked at about 300 W with M5 Ultra and about 200 W with M3 Ultra^[39]. This paper still uses the 385 W maximum, so its cost figures err high.

2.6What Apple Silicon is not for

Chip for chip, datacenter GPUs win on arithmetic. An H100 delivers about 989 dense FP16 tensor TFLOPS, half of Nvidia's 1,979 figure with sparsity,^[32], far beyond any Apple chip, and datacenters link thousands of them with fast fabrics. Pretraining frontier models, where every chip exchanges data with every other many times a second, will stay there. Datacenters also serve many users per GPU at once, which spreads the cost of reading the weights across many streams. The Apple fleet is rich in memory and poor in arithmetic, and the network is designed around that shape rather than against it.

3Design goals

1. Useful work only. Every reward traces back to capacity a seat holder committed or work a client paid for. Nothing is spent on puzzles whose only purpose is to be hard.
2. Locality. A job runs whole on one device or one pod. Latency-critical work is never pipelined across the internet.
3. Local first. A request runs on the owner's own Mac when it can. The network is for what that Mac cannot hold or has no time for, and for lending the Mac's idle hours to others.
4. Verifiability. Any result can be checked by an independent peer for a small fraction of what it cost to produce.
5. Cheating does not pay. The expected loss from being caught exceeds the gain from cheating by orders of magnitude.
6. The owner comes first. A device works for the network only while idle, on power and cool, and stops the moment its owner needs it.
7. Private by default, honest about limits. Personal context stays on the owner's devices. The network sees only what a task needs, and the paper does not claim confidentiality that the hardware cannot enforce.
8. Open by default. Every transaction, block and receipt is public and can be checked by anyone.
9. Within the platform's rules. The software follows Apple's rules for each platform it ships on, at their strictest reading.

Non-goals: training frontier models from scratch, replacing datacenters, and confidential computing on devices owned by strangers. The last is discussed in §8.

4The network

Six roles take part.

Owner

A person with a wallet, such as alex.mlx, holding one or more dedicated seats.

Dedicated seat

A record on the ledger: a starter seat or one of three Mac-class tiers (§5.3). It pays nothing up front (since 20 October 2026); it is the unit to which compute rewards are paid, and the MLX its Macs mine is locked for its lock-in (§11.7). A dedicated seat works like a stake: it reserves a place on the network for a Mac of its class and, today, sets that Mac's share of each hour's compute rewards; sending paid AI jobs to Macs with dedicated seats first is planned (§14). A Mac without one runs on a free seat, at a small weight (§11.3). Live

Worker

A Mac, or a pod of Macs, running MLX Node and bound to one or more of its owner's seats. Each such Mac is a node of the network. Planned

Client

Anyone who submits jobs and pays for them in USDC on MLX Network, through the open API or from MLX Harness when a request is better run elsewhere (§6.5). Planned

Router

Places each job on a worker and sets prices by model class. Operated by the network at first, then by several independent operators. Planned

Verifier

A worker chosen at random to re-run a sample of another worker's jobs. Planned

A seventh component, the sequencer, orders transactions into blocks (§9). A job moves through the network in seven steps.

1. Post. The client names the model by the hash of its weights, the runtime version, the input or its hash, a maximum price, a privacy class (§8) and a deadline, and escrows the maximum price in USDC.
2. Place. The router picks a worker that has the model in memory, meets the privacy class and the latency target, and has a good score (§6.3).
3. Run. The worker runs the job, streams the output to the client, and signs a receipt with its device key (§7.2).
4. Record. Receipts are batched into the ledger under a Merkle root, so each one can be proven to exist.
5. Sample. With probability $p_i$ that depends on the worker's record, the job is sent to an independent verifier. The choice is derived from a block hash that did not exist when the worker produced the receipt, so a worker cannot know in advance which jobs will be checked.
6. Settle. After a challenge window, payment is released: 85% to the worker, 5% to the verifier pool and 10% to the protocol (§11.4). The unused escrow returns to the client.
7. Score. The outcome updates the worker's score, which steers future placement, audit frequency and compute rewards.

5Devices, seats and platform rules

5.1Device identityLive

On first launch MLX Node creates a signing key inside the device's Secure Enclave. The key is generated there and cannot be exported, so a signature proves that it came from that physical device^[44]. The owner links the device to their wallet with one signature from each key. On iPhone and iPad, Apple's App Attest service also provides Apple's assertion that the key belongs to a genuine copy of the app on genuine Apple hardware^[45]. Macs do not support App Attest before macOS 27, so on earlier versions a Mac's identity rests on its Secure Enclave key and on the capability checks below.

5.2Measuring capabilityPlanned

A device states its chip and memory, then proves them. A calibration suite measures memory bandwidth, matrix throughput at the precisions the network uses, and usable memory. The results must match the stated chip's known profile within a tolerance, and they are re-measured at random times. A device that claims an M3 Ultra has to sustain bandwidth of the M3 Ultra's class.

The goal is to bind each identity to real capacity, not to police the brand of hardware. The network pays for verified work, so a machine that imitates a device by actually doing the device's work has delivered what it is paid for. What it cannot do is claim capacity it does not have, or multiply identities without buying more seats (§5.3).

5.3Binding seats to MacsLive

Seats are the economic unit; Macs are where the work happens. The three class tiers follow Apple's chip classes, because memory bandwidth and capacity decide how fast a Mac runs a model: Core for base M-series chips, Pro for Pro and Max chips and Ultra for Ultra chips. Each has a Latest edition for Apple's newest chip in its class (M6, M5 Pro, M5 Max, M5 Ultra today), at 1.5× the price and 1.5× the weight. Each tier pledges a minimum of memory and compute, fixed in the protocol today.

Below them sit two starter seats, Nano ($50, 0.5 units) and Lite ($100, 1 unit), at the same $100 per unit as every other seat, so they have the same mining cap per dollar. They are smaller than any Mac class, so any Mac with Apple silicon carries one at its full weight. Their mined MLX locks for 20 and 14 days, longer than any class seat, and they have no Latest edition.

Every hour, each seat in a wallet is carried by one of the wallet's linked Macs, the largest seats by the largest Macs, and a class seat $i$ carried by Mac $d$ counts with the units of the smaller class:

An Ultra seat on a MacBook Air therefore earns as a Core seat until an Ultra Mac carries it. A starter seat counts in full on any Mac: $w_{i,d} = \text{units}_i$. A seat with no Mac to carry it earns nothing that hour. The Mac's class comes from the chip its app reports, checked against the speed it shows on known-answer jobs. Penalties follow the seat, not the Mac.

5.4The owner comes firstLive

On a Mac, the worker runs only when the owner has been away from the keyboard for a set time, the Mac is on power, and the system's thermal state is nominal or fair^[46]. The owner sets limits on memory, GPU share and hours. When the owner returns, the worker stops within a second and the job is handed to another worker. Should iPhone and iPad later become workers (§5.5), their operating system already enforces the same idea: background processing tasks run only while the device is idle, can require external power, and are ended as soon as the user picks up the device^[47]. iOS 26 adds continued processing tasks, which must be started by the user, show their progress and can be cancelled, and need a separate entitlement to use the GPU in the background^[48].

5.5Platform rules

Apple's App Store Review Guidelines bear directly on this design^[49]. Section 2.4.2 asks apps not to rapidly drain the battery, generate excessive heat or put unnecessary strain on device resources, and bars unrelated background processes, with cryptocurrency mining as its example. Section 3.1.5(ii) states that apps "may not mine for cryptocurrencies unless the processing is performed off device". Section 2.5.4 limits background services to their intended purposes, and section 3.1.5(v) bars crypto apps from offering currency for completing tasks such as downloading other apps or posting to social networks.

MLX reads these rules at their strictest and plans accordingly. Compute runs on Macs only.

• Macs do the work. MLX Node, the macOS worker, is distributed directly, signed with an Apple Developer ID and notarized by Apple, which is an automated security check rather than App Review^[50]. Macs also offer the most memory per device and are the only devices that form pods.
• iPhone and iPad follow the network. MLX.app for iPhone and iPad is the companion to MLX Node: it shows the Macs linked to a wallet and what they mined, pauses and resumes them, sets their limits, and tells the owner when a Mac stops. It runs no network compute. Wallet features come in a later version. Running the owner's own models for the owner's own requests, the private half of the hybrid model in §8, is allowed by the rules. Seats bought for an iPhone or iPad count toward the network and mine on a Mac linked to the same wallet.
• Every seat can be served by a Mac. Because seats bind to any device that meets their pledge (§5.3), an owner whose seat was bought with an iPhone in mind can serve it from a Mac and earn compute rewards with it.
• Room to grow. Platform rules change. If Apple comes to allow it, the protocol can admit iPhones and iPads as workers in the forms the platform permits, such as user-started continued processing, or through channels such as alternative app marketplaces in the European Union^[51]. No seat would need to change. The network does not depend on it.

6Workloads, placement and pricing

6.1Four classes of work

Class B deserves emphasis. In reinforcement learning, most of the compute goes into generating sample answers, which is inference. INTELLECT-2 trained a 32-billion-parameter reasoning model with rollouts produced by untrusted, permissionless workers and checked with activation commitments that cost about 1% of throughput^[52].

Class C chooses a split for each job (§2.4). Long prompts and batch work, where prefill dominates, suit pipeline parallelism. Interactive chat, where the user feels the generation speed, suits tensor parallelism.

Class D rests on a fast-moving line of research. DiLoCo matched fully synchronous training while communicating about 500 times less^[53]. INTELLECT-1 trained a 10-billion-parameter model across three continents at 83% to 96% compute utilization^[54]. Covenant-72B was pretrained by permissionless peers on Bittensor^[55], and Pluralis trained an 8.6-billion-parameter model on 330 nodes, mostly consumer GPUs, at 63% of the efficiency of a centralized baseline^[56]. Volunteer computing has reached this scale before: in the spring of 2020, Folding@home passed an exaflop on its volunteers' home computers^[57]. Training on Apple devices is a research track for MLX, not a launch promise.

6.2Why not pipelines across the internet

Splitting one model across distant devices looks attractive and works poorly for interactive use. When generating, each token must pass through every stage in order. If stage $k$ computes for $c_k$ and hands off over a link with latency $\ell_k$, then

With eight stages and 50 ms between each, a single stream cannot exceed about 2.5 tokens per second, however fast each device is. Bandwidth is not the problem. For Llama 3 70B, whose hidden size is 8,192, the data passed at each boundary is 16 KiB per token. Latency is. Petals, running BLOOM-176B on three servers over an emulated network at 100 Mbit/s, fell from 1.66 to 1.23 steps per second when round-trip time rose from under 5 ms to 100 ms^[58]. Apple's measurements make the same point inside a pod: pipeline parallelism does not speed up generation, and tensor parallelism, which does, needs links with very low latency^[39]. MLX therefore splits a model across devices only inside a pod, where latency is measured in microseconds (§2.4).

6.3PlacementPlanned

For each job $j$, the router considers only workers that can hold the model with room for the job's context, satisfy its privacy class and reach the client within its latency target. Among those it picks the worker with the best expected value per dollar:

Here $q_i$ is the worker's quality score (§11.2), $\pi_{ij}$ its price for the job, and $\hat{T}_{ij}$ its expected throughput from equation (1) scaled by $\eta_i$, the share of the bound it has actually delivered. Workers announce which models they hold in memory, and the router prefers warm workers, because loading hundreds of gigabytes of weights takes far longer than most jobs.

6.4PricingPlanned

Each model class $m$ has a base price per million tokens, quoted separately for prompt and output. The router adjusts it after every epoch toward a target utilization $U^* =$ 70%, in the manner of Ethereum's EIP-1559^[59]:

At full utilization the price rises by about 5.4% per epoch, and when capacity sits idle it falls by up to 12.5%. Clients may add a tip for priority. For a sense of the market, Llama 3.3 70B (the Turbo variant) sells for $0.10 per million input tokens and $0.32 per million output tokens on DeepInfra^[60], and $1.04 for both on Together^[61]. The floor for a worker is its electricity. At maximum wall power, an M5 Ultra generating the 7B test model of Figure 1 at 179 tokens per second spends at most $0.11 of US-average electricity per million tokens (§13.4).

6.5Local first: MLX Harness and the network

The first client of the network is the owner's own Mac. MLX Harness runs open models on Apple Silicon for chat, coding agents with built-in tools, and image generation and editing, and serves them to other apps on the Mac at 127.0.0.1:8080 through OpenAI-, Anthropic- and Ollama-compatible endpoints. It is built on the vMLX engine^[13], carries MLX Node and installs it on first run, and is in testing before its first public build. Planned

MLX Harness can tell before loading a model whether it fits. A model needs its parameters times the bits stored per weight, plus room for the context, and by default macOS lets the GPU use about three quarters of unified memory. Its generation speed is bounded by equation (1). The same arithmetic, applied to every Apple chip and popular open model, is published at mlx.app/compare. When the model fits and runs fast enough, the request stays on the Mac and the network never sees it.

When it does not, because the model is larger than the Mac, the Mac is busy, or the owner wants an answer sooner, MLX Harness can post the request as an ordinary class A job (§6.1), escrowed in USDC and verified like any other (§7). The owner chooses its privacy class (§8.2). A Private job runs only on the owner's own devices: a MacBook Air on the road can use the Mac Studio at home, coordinated through the network but never leaving the owner's hardware. An Open job can run on any qualified Mac. Either way the job moves whole, so the latency argument of §6.2 does not apply: a Mac that cannot hold a model sends the request to one that can, rather than holding a slice of it.Planned

The same Mac then gives back. While it is idle, MLX Node runs jobs for the network and mines MLX for verified work (§11). Once paid jobs open, it also earns USDC (§11.4), so a Mac that works at night can pay for the requests its owner sends by day. In BitTorrent, peers that upload are served first by the peers they upload to^[14]. Whether MLX should give Macs that work for the network a similar priority when they ask is a research question: the priority must never let anyone buy their way past verification. Research

7Verification: proof of inference

7.1The problem

A worker paid for inference has several ways to cheat:

• return output without running the model;
• run a smaller model or a coarser quantization than the one requested;
• cut the output short;
• replay an earlier answer.

The known defences trade cost against strength.

• Zero-knowledge proofs. They are the strongest, and far too slow today: zkLLM proves a 13-billion-parameter model's inference in under 15 minutes^[62].
• Trusted execution. Confidential computing on Nvidia Hopper GPUs costs under 7% for most LLM queries^[63], but Apple's GPUs offer nothing comparable to third-party software.
• Refereed delegation. Optimistic schemes resolve a dispute by narrowing it to a single step that a referee re-runs, and are secure if one party is honest^{[64, 65]}.
• Spot checks. Checks backed by stake make honesty the rational strategy at a small sampling rate^[66].
• Activation commitments. TOPLOC hashes a model's top activations and detected changes of model, prompt or precision in every test, at 258 bytes per 32 tokens^[67].

Proof-of-learning schemes for training have proved easier to spoof than first claimed^{[68, 69]}, which is one reason MLX starts with inference, where checking is cheap. MLX combines receipts, commitments, sampled re-execution, known-answer jobs and stake.

7.2Receipts and commitmentsPlanned

Every job produces a receipt signed by the worker's Secure Enclave key. It contains:

• the job's identifier and nonce;
• the hashes of the model weights, the runtime build, the input and the output;
• the sampling seed;
• a commitment to the model's final hidden state for every 32 generated tokens;
• timing.

Following TOPLOC, each commitment is a locality-sensitive hash of the largest activations, so honest re-runs with tiny numerical differences still match while a different model, prompt or precision does not^[67]. Receipts are rooted in the ledger, and the nonce prevents replay.

7.3Determinism classesResearch

Even datacenter inference is rarely reproducible. Asked the same question 1,000 times at temperature zero, one large model gave 80 different answers, because the kernels' results depended on how many other requests shared the batch. Batch-invariant kernels made all 1,000 identical^[70]. MLX workers therefore run batch-invariant kernels and seeded sampling, and group devices into determinism classes defined by chip generation, runtime build, model artifact and kernel configuration. Within a class, an audit expects the same tokens. Across classes, it expects commitments within a calibrated tolerance. Calibrating those tolerances across Apple GPU generations is open work.

7.4Sampled re-executionPlanned

A sampled job goes to a verifier chosen at random among eligible workers that belong to a different owner. The verifier does not regenerate the answer. It feeds the prompt and the claimed output through the same model as one prefill, then checks two things: that the commitments match, and that each output token is the one the seeded sampler would choose from its own probabilities. Because prefill runs 11 to 28 times faster than generation on these chips (§2.2), an audit costs about 4% to 9% of the original job. Audit frequency adapts to each worker's record:

A new worker is checked one job in five; a worker with a long clean record, one in a hundred. At the floor, auditing adds under 0.1% to the network's compute.

7.5Known-answer jobsPlanned

The router also mixes in jobs whose correct output is already known and which look like any other job. They catch workers that return output without running the model, measure real latency, and keep scores honest when paying demand is thin.

7.6DisputesPlanned

A failed audit goes to a second, independent verifier. If both disagree with the worker, the commitments locate the first 32-token window where the outputs diverge, and a referee from the worker's own determinism class re-runs just that window. This follows refereed delegation: the honest party always wins, whichever side it is on^[64]. The losing side pays for the referee.

7.7PenaltiesPlanned

When the fault is confirmed:

• the client is refunded;
• the seat loses $\sigma = 10\%$ of its locked and bonded MLX, which goes to the compute pool;
• the seat's quality score drops to zero for 30 days;
• a third fault within 180 days suspends the seat from compute rewards.

7.8Why honesty is rational

Suppose cheating on a job saves a worker the cost $C$ of doing it. Undetected, the worker keeps the payment $R$. Detected, it loses $R$ and the slashed stake $S$. Cheating loses money whenever

This is the simplest case of the Proof of Sampling condition^[66]. If a share $r$ of verifier capacity is controlled by the cheater, an audit only works when it lands on an honest verifier, and the condition becomes

In MLX, $S$ is the MLX a seat still has locked. Since 20 October 2026 a seat is paid nothing up front, so its stake is what its Macs mined during its lock-in: at the cap, $\kappa\, w\, L$ MLX, or 200 MLX for a Core seat (10-day lock) and 960 for an Ultra seat (3 days). At the genesis network price of one cent, a 10% slash puts $0.20 at stake for a Core seat and $0.96 for an Ultra seat. The electricity for a 1,000-token job, even on a Mac Studio at maximum power, is about 0.011 cents (§13.2). At $p = 1\%$, the condition holds about 12 times over for a Core seat at its cap even if a third of verifiers collude, and about 59 times over for an Ultra seat, and the margin grows with the network price. A seat that has only just started mining has little locked, so for it the condition rests mostly on the payment $R$ and on the score penalty above. Seats bought before 20 October 2026 also stake the up-front reward they were paid.

8Privacy

8.1Hybrid by design

Today a user mostly chooses between a capable model in someone else's datacenter, which sees everything sent to it, and a small local model that keeps data private but can do less. Apple built Apple Intelligence on a third path. A model of about 3 billion parameters runs on the device^[27], and larger requests go to Private Cloud Compute, which is designed so that personal data is processed statelessly, no one has privileged access at run time, and outside researchers can verify the software that runs^[71]. MLX follows the same split. Personal context, such as messages, files, photos and health data, stays with a local model on the owner's devices. Only a narrow, stripped-down task goes to the network. On a Mac, MLX Harness is the local half: a model running in MLX Harness sees personal context, and nothing leaves the Mac unless the owner sends it (§6.5).

8.2Privacy classesPlanned

Open

Any qualified worker may run the job. Suited to public data, evaluations, synthetic data and most batch work.

Pseudonymous

The router removes the client's identity, spreads a session across unrelated workers and keeps no link between them. The worker still sees the content of the job it runs.

Private

The job runs only on devices the client owns, such as their own Mac or a pod they control, coordinated through the network.

8.3What MLX does not claim

A worker owned by a stranger can, in principle, read what it processes. MLX Node keeps inputs in memory only, deletes them when the job ends, and ships as reproducible builds whose measurements are published. But on hardware someone else controls, those are promises, not guarantees. Apple's GPUs do not offer third parties the attested, isolated execution that Private Cloud Compute or Nvidia's confidential computing provide^{[63, 71]}. Until they do, MLX sends sensitive work only to the Private class and says so plainly. Cryptographic approaches that keep inputs hidden from workers are a research track.

9The ledger

9.1Accounts and keysLive

An account has a readable name ending in .mlx and an Ed25519 key^[72]. The key is derived from a 32-byte seed stored as the user handle of a passkey^[73]. The passkey syncs through iCloud Keychain, and the browser releases the handle to mlx.app only after Face ID or Touch ID. WebAuthn does not treat the user handle as a secret, so the wallet's protection rests on the platform's passkey storage and on the biometric check, not on a hardware-isolated key. The same seed is the entropy of a 24-word recovery phrase that the owner can export at any time. No seed phrase is needed to start, and no server ever holds a key.

9.2Transactions and blocksLive

A transaction's hash is the SHA-256 of its canonical JSON (keys sorted, no whitespace, without the signature), and the account signs those 32 bytes with Ed25519. A block commits to its chain identifier, height, previous block hash, timestamp, transaction count, producer and the binary SHA-256 Merkle root of its transaction hashes. Its hash is the SHA-256 of that header's canonical JSON, signed by the sequencer's key. Each block names its predecessor, so changing any past transaction would change every later hash, as in Bitcoin's timestamp chain^[11]. Blocks are sealed within about a minute of a transaction arriving, and every block, transaction and account is published through the explorer and an open JSON API.

9.3GenesisLive

Block 0 created all 10B MLX in five public protocol accounts (§10.1). No transaction type can create MLX afterwards, so the sum of all MLX balances and locks equals 10,000,000,000 in every block.

9.4USDC on MLX NetworkLive

USDC is the network dollar. Money enters and leaves the network as USDC, whatever coin was sent in.

• Deposits. Users deposit USDT or USDC on Solana, Ethereum or BNB Chain, USDT on Tron, or SOL, ETH, BNB, TRX or BTC. Each deposit is credited as USDC on MLX Network by the bridge account, at the value quoted when the deposit was opened.
• Supply. The bridge account publishes the total USDC it has issued.
• Withdrawals. USDC can be withdrawn on Solana: at least 10 USDC, with a 1 USDC fee. The amount is held in escrow on the ledger until the Solana transfer is made, then settled with a transaction that records the Solana signature.

USDC on MLX is a claim on reserves held by the operator. Regular, published proof that reserves cover what has been issued is planned next. Planned

9.5From one sequencer to many

A single sequencer orders transactions today. That lets the network move quickly while it is small, and it is the network's most centralized part. Because every block is signed and public, anyone can replay the ledger from block 0 and detect a rewritten history, but not prevent one. The plan has three stages.

1. Today Live: one sequencer, signed and hash-linked blocks, open data, independent replay.
2. Next Planned:
   • a Merkle root of all account state in every block, so any balance can be proven against a block;
   • block hashes anchored to a public blockchain at regular intervals, so history cannot be rewritten without public evidence;
   • independent replicas.
3. Committee Research: long-standing, high-scoring Ultra seats co-sign blocks, and two thirds must agree. The sequencer role rotates, and a path to force transactions in through the anchor chain resists censorship.

MLX does not use proof of work. Its scarce resources are useful compute and honest verification, not hashes, and on iPhone and iPad, mining on the device is barred by the platform's rules^[49].

10The MLX token and the halving curve

10.1Supply and allocationLive

The supply is fixed at 10,000,000,000 MLX, divisible to six decimal places, all created at genesis. It is divided into five protocol accounts that anyone can watch on the explorer.

35% of the supply pays the Macs that run compute (§11). The 30% seat reserve paid dedicated seats up front along the halving curve until 20 October 2026; seats mine instead since then, and the reserve pays nothing out.

10.2The halving curveLive

Bitcoin halves its block reward every 210,000 blocks, about every four years. MLX halves by growth instead of time. Position in the network is counted in units: one unit for every $100 that enters through a seat purchase or a spot buy. If $u$ units have entered, the MLX rate for the next unit is

so the rate halves every 200,000 units, or every $20M that enters the network, and it halves smoothly rather than in steps. The span of units from $u$ to $u+m$ is worth the exact integral of the rate over it:

Spot buys and sells are filled on this integral (§10.4). Until 20 October 2026 every dedicated seat was also paid it up front, from the seat-reward account. Since then a seat's dollars still move the position, and so the price, but the seat is paid nothing up front: it mines (§11). Three properties follow from equation (10).

• Splitting changes nothing. The integral is additive, so buying in one piece or many gets the same MLX:
  $$g(u, a) + g(u + a, b) \;=\; g(u, a + b)$$

  (11)
• The total is finite. One pass along the curve pays at most
  $$g(0, \infty) \;=\; \frac{G H}{\ln 2} \;\approx\; 2{,}885{,}390{,}082 \text{ MLX}$$

  (12)
  and half of that is paid by the time $20M has entered. Because spot sells move the position back (§10.4), a segment of the curve can be paid again after a sale. Spot buys are limited by the MLX the treasury holds (§10.4); up-front seat rewards were limited by the 3B balance of the seat-reward account.
• The price is set by the curve. The network price of MLX is what a unit costs divided by the MLX it is worth:
  $$p(u) \;=\; \frac{\$100}{r(u)} \;=\; \$0.01 \cdot 2^{u/H}$$

  (13)
  It starts at one cent and doubles with every halving. What a unit buys falls exponentially while the price rises exponentially, and every buyer at a given moment pays the same curve price per MLX.

10.3Dedicated seats mineLive

A dedicated seat is paid nothing up front. What it buys is a higher mining rate: up to $\kappa\, w$ MLX a day, where $\kappa = 8$ and $w$ is the seat's size in units, earned hour by hour while a Mac of the matching class carries it (§11). A Core seat mines up to 20 MLX a day, a Pro seat 80 and an Ultra seat 320; a Mac without a seat mines up to 1 MLX a day on a free seat. The seat's dollars still enter the network and move the curve forward, so seats raise the network price, but since 20 October 2026 they no longer draw on the seat-reward account.

The MLX a seat's Macs mine is locked for the seat's lock-in: 20 days for Nano, 14 for Lite, 10 for Core, 7 for Pro and 3 for Ultra, the same for Latest editions, and 30 days on a free seat (§11.7). The smaller the seat, the longer the lock: a large seat earns more each day, and its owner has more to lose from a fault (§7.7). Lock-ins are protocol parameters and may be lengthened for new locks if selling pressure on the treasury (§10.4) calls for it. Locked MLX is the seat's stake: it is what a confirmed fault slashes (§7.7).

Until 20 October 2026 each dedicated seat was paid the integral of equation (10) up front, locked for its lock-in, and a referrer earned 10% of that reward from the community account. Seats bought before the cutover keep what they were paid. A seat bought after it that was still paid up front has the reward and any referral bonus returned to the seat-reward account by a public seat_reward_return transaction. Referrals are still counted, but they no longer pay a bonus.

10.4The spot marketLive

MLX can also be bought and sold without a seat, from the USDC balance in a wallet. The protocol itself is the counterparty and fills every order along the same curve, which makes it a protocol-owned bonding curve rather than an order book. Spending $D$ dollars at position $u$ moves the network forward by $m = D/100$ units and pays

from the treasury, where $\pi_b$ is the buy premium. Selling $X$ MLX moves the network back to the position $a$ at which the curve would have paid exactly $X$, and pays the dollars of that span less the sell discount $\pi_s$:

The defaults are $\pi_b = 25\%$ and $\pi_s = 10\%$, and both are published with the network's live statistics. At genesis, $500 buys 39,999.65 MLX, an average of $0.0125. Selling all of it straight back returns $360.00. The round-trip spread protects the curve from cheap manipulation. Spot buys are limited by the MLX the treasury holds, and sells by its USDC.

10.5Why the network is built before it computes

A compute network faces the cold start that every network faces: a hundred devices are a promise, and a hundred million are a supercomputer. The hardest and riskiest step is the first one, from zero to a network large enough to matter. Later steps are safer, because each new member joins something that already exists and works.

MLX sequences its work to match. In its first phase, Genesis, the network gathered seats before any Mac computed. Since 17 October 2026, Macs run work and earn from the compute pool, and since 18 October 2026 the network has been on mainnet, with seats tied to the class of Mac that carries them. Since 20 October 2026 seats are paid only for the work their Macs do. What runs on iPhone and iPad later depends on platform rules that may change in the years ahead. The seats, and the network they form, do not depend on those rules.

The halving curve prices that sequence. MLX is cheapest when the network is smallest and its future least certain, and the network price doubles with every $20M of growth, as the risk of joining falls. The compute pool releases the most in its first years (§11), so the Macs that work earliest, when the network is least certain, mine the most. Whether the network grows to millions of devices is not something this paper can promise. The design makes sure that, if it does, the people who built it first are rewarded for the work they did.

11Compute rewardsLive

11.1Release schedule

The compute account holds 3.5B MLX. Since 17 October 2026, it releases a fixed fraction of whatever remains each day, settled hour by hour (a 24th of the day's fraction and of the cap each hour):

where $B_d$ is the account's balance on day $d$. If every released MLX is claimed, the pool halves every four years, echoing Bitcoin's schedule: about 1.66 million MLX on the first day, about 557 million in the first year and 1.75 billion in the first four. MLX that is released but not earned stays in the pool, so a slow start stretches the schedule instead of wasting it.

11.2Scores

Each seat $i$ earns a daily score between 0 and 1:

• $A_i$ is availability: the share of the day the seat's device was eligible to work (§5.4), attested and answering challenges. Only Macs are workers, so a seat earns compute rewards while a Mac linked to its wallet is working.
• $T_i$ is delivery: verified work delivered on assigned jobs, against the tier's pledge, capped at 1.
• $q_i$ is quality: an exponential moving average of audit outcomes, zero for 30 days after a confirmed fault.

Until audits ship, the network measures these simply: availability from signed heartbeats, delivery as verified jobs against one job per two eligible minutes, and quality as the share of a Mac's answers that agree with other Macs on the same job, once it has ten comparisons. A wallet with several Macs scores by its best one. A free seat is throttled: it gets short AI jobs on a random heartbeat, waiting 1 to 9 seconds between them, so its delivery is measured against one short job per 12 seconds; dedicated seats get full jobs back to back, a steady flow.

11.3Distribution

With $w_i$ the seat's units as carried (equation 2: Nano 0.5, Lite 1, Core 2.5, Pro 10, Ultra 40, Latest 1.5×), the day's release is shared in proportion to weighted score, with a cap per unit:

The cap keeps a small early network from draining the pool. On the first day it binds until the weighted score of all seats passes about 207.5K units, and the threshold falls as the pool releases less each day. With 100,000 units active at an average score of 0.8, each unit earns the cap of 6.4 MLX a day and an Ultra seat earns 256. With a million units at the same score, each unit earns about 1.66 MLX a day.

A Mac whose wallet holds no dedicated seat runs on a free seat and still earns, at a weight of $w = 0.125$, a twentieth of a Core seat, and all such Macs together receive at most 10% of each release. At the same score, a Nano seat earns 4 times what a Mac without one does, a Lite 8 times, a Core 20 times, a Pro 80 times and an Ultra 320 times: at the cap, 1 MLX a day against 4, 8, 20, 80 and 320, or 30, 120 and 480 for Latest editions. At the genesis network price of $0.01, a seat at the cap earns about 29% of its price a year in MLX, and every tier out-earns the electricity of the Mac that carries it. Anyone can try the network with a Mac alone; the rewards stay with seats, for the reasons in §11.5.

11.4Fees and recycling

When a job settles, the client's payment is split three ways:

• 85% to the worker;
• 5% to the verifier pool, which also pays for known-answer jobs and disputes;
• 10% to the treasury as USDC, where it deepens the liquidity that pays sellers.

Each epoch, the treasury moves MLX worth the protocol's share of fees, at the network price, into the compute account. Paid demand therefore refills the pool that rewards supply, and once fees are large enough, the pool can sustain itself.

11.5Why rewards follow seats, not volume

It is tempting to pay token rewards in proportion to paid work. But a worker can pay itself. If each dollar of work earned more in rewards than it cost in fees and electricity, self-dealing would grow until the reward per dollar fell to the fee, and the emission would become a rebate paid to whoever trades with themselves most. DePIN networks have learned versions of this the hard way. io.net saw about 1.8 million fake GPUs try to join its network in 2024^[74], and Helium added a denylist for hotspots that earned rewards without providing coverage^[75].

MLX ties token rewards to seats, which cost real dollars, and caps the delivery term at 1. A new identity costs real money, and self-dealing cannot raise a seat's share above its weight. Paid work is rewarded in USDC, which is only real if a real client paid it.

11.6After the lock-in

A seat whose lock-in has ended keeps earning compute rewards only while it keeps MLX bonded worth 25% of what it mines at its cap during one lock-in, or 25% of its up-front reward for a seat bought before 20 October 2026, so every earning seat always has stake that can be slashed. Locked mined MLX (§11.7) counts toward the bond. The rest is free to move.

11.7Lock on mined MLX

Compute rewards are paid into the owner's wallet every hour and locked from the day they were earned: for 30 days on a free seat, or for the lock-in of the wallet's shortest-locked dedicated seat (3 to 20 days). The lock rolls: a little unlocks every day instead of everything at once, and a dedicated seat shortens the wait as well as raising the rate. Rewards began on 17 October 2026, the day before mainnet; the lock on anything mined before mainnet counts from its start. The first rules locked mined MLX for 18 months; they were shortened on 19 October 2026 and every earlier lock was re-dated.

• Treasury. Spot sells are paid from the treasury's USDC (§10.4). Liquid emissions of up to $\kappa$ MLX per unit per day would make miners the treasury's largest claim the moment the network grows.
• Stake. Locked mined MLX is part of the seat's locked and bonded MLX, so the slash $\sigma$ applies to it (§7.7). A worker's stake grows with its honest work, and the longer a Mac has worked, the more a fault costs it.
• Running costs. What a worker needs now, its electricity, is paid by its 85% share of paid jobs in USDC (§11.4), which is never locked. The MLX it mines is a claim on the network's future.

12Security analysis

13Calculations

13.1Probability of detection

Bitcoin's paper closes by calculating how quickly an attacker's chance of catching up falls^[11]. The equivalent question here is how long a cheater survives. If each job is audited independently with probability $p$, a worker that fakes $n$ jobs is caught at least once with probability

13.2The cost of a job against the stake behind it

Take the M5 Ultra of Figure 1 at its maximum wall power of 385 W, which overstates the real draw. A 1,000-token answer at 179 tokens per second takes 5.6 s and uses 0.60 Wh, or 0.0109 cents at the US average price. A Core seat mining at its cap has up to 200 MLX locked, of which 10% is 20 MLX, or $0.20 at the genesis network price. Condition (7) needs $p$ above about $5\times 10^{-4}$, and the network's floor is $1\%$.

13.3Aggregate capacity

Suppose a million seats, 60% Core, 30% Pro and 10% Ultra, each meeting only its minimum pledge. Together they hold 16 PB of unified memory, as much as 200,000 H100s, and 4.5 EFLOPS of pledged FP32 compute. In dense FP16 tensor arithmetic, that compute is worth only about 4,550 H100s^[32]. The comparison is the thesis in two numbers: an enormous amount of memory with modest arithmetic beside it. Routing memory-bound, parallel work to the fleet (§6) is how that becomes useful.

13.4What a worker spends

At 179 tokens per second and 385 W, an M5 Ultra writes at least 1.67 million tokens per kWh at batch size one. That puts electricity at $0.11 or less per million tokens at the US average price^[42]. A Mac mini M4 at its 65 W maximum costs 1.2 cents an hour to run^[40]. A worker's margin is the price of §6.4 less these costs. For an owner, the hardware has already been paid for.

13.5How fast the curve moves

From equation (9), what a $100 unit is worth halves by the time $20M has entered the network, falls to a quarter by $40M, and to about a thousandth by $200M. By then the network price is $10.24, 1,024 times its genesis price. The compute pool releases half of what it holds every 4 years (§11.1), so the Macs that work while the network is young and least certain mine the most.

14Roadmap

15Risks and open problems

• Platform dependence. The network runs on one company's hardware and operating systems, and Apple's rules can change. The design keeps Macs, distributed outside the App Store, as the backbone, and treats iPhone and iPad work as an extension.
• Demand. Mining rewards can attract supply before there is demand. Compute rewards are capped and paced (§11) so that they do not run ahead of the network, but the network is only as valuable as the work clients bring to it.
• Model quality. The network serves open-weight models. Epoch AI estimates that open models trail the best closed ones by about four months^[76]. That gap has narrowed but not closed.
• Reproducibility. Exact agreement across Apple GPU generations is not yet established. Commitments with tolerances are the fallback (§7.3).
• Centralization today. The sequencer, the first router and the USDC bridge are operated by the network today. Each has a published path to independence (§9.5), and until then each is a point of trust.
• Hardware supply. The DRAM shortage of 2026 removed the largest Mac Studio for nearly six months^[33]. Memory prices shape how fast the fleet's capacity grows.
• Parameters. The values in Appendix A that are marked "Planned" are starting points, set from the analysis above, and will be tuned against real data.

16Conclusion

We have proposed a network that uses the largest fleet of AI-ready hardware in the world without asking anyone to build a datacenter.

• Work is placed by memory and bandwidth, so jobs run whole on one device or one pod.
• Each Mac is a peer in both directions: it runs models for its owner first, lends its idle time to others, and can send a whole job to a larger Mac when it needs one.
• Results are signed by keys that never leave the hardware, committed to through hashes of the model's activations, and re-run at random by peers. Cheating costs far more than it can earn.
• Seats pay nothing up front: they raise how fast a Mac mines for verified work. The network price follows a curve that halves with growth, so it rises as the network does, and the compute pool pays the most to the Macs that work earliest.
• Everything that moves value is recorded on an open ledger that anyone can check.

Bitcoin showed that strangers can agree on money without trusting each other. MLX aims to show that they can share a supercomputer the same way. The next great computer is not a building. It is already here, plugged in, in homes and offices all over the world.

AAppendix: parameters

BAppendix: verify it yourself

Everything in the Live parts of this paper can be checked against the running network without an account. The explorer at explorer.mlx.app shows every block, transaction, account and dedicated seat, and verifies signatures in the browser. The same data is served as JSON:

curl https://mlx.app/api/stats          # supply, curve position, market, liquidity
curl https://mlx.app/api/blocks?limit=5 # newest blocks with hashes and signatures
curl https://mlx.app/api/nodes?limit=5  # newest dedicated seats

To check a block, hash the canonical JSON of its header, with chain set to the chain identifier that the stats endpoint reports, and compare it with the block's hash. Then verify the sequencer's Ed25519 signature over it, recompute the Merkle root from the transaction hashes, and confirm that each block names its predecessor. To check the curve, evaluate equations (9) to (13) at the position reported by the stats endpoint.