AMD SEV enclave running on GCP. Google Cloud attestation token signed. Commitment hash anchored on Base Sepolia. Every step independently verifiable, zero trust assumptions on our side.

This post is the full technical breakdown — what worked, what didn't, and what the three open security issues are before we can talk about mainnet.

The Architecture in One Paragraph

Neurolix Protocol is a DePIN infrastructure layer for confidential AI compute. The model: regulated enterprises (healthcare, finance, biotech, legal) need to run AI on sensitive data without handing that data to a cloud provider they can't fully trust. We solve this with hardware-enforced privacy in TEE enclaves, cryptographic attestation per session, and commitment hashes anchored immutably on Base L2. Every session produces proof. Every proof lives on-chain forever.

What We Built — Step by Step

Step 1: Spinning Up the Confidential VM

GCP Confidential Computing. AMD EPYC with SEV active. Machine type n2d-standard-2, zone us-central1-a.

First thing: verify the enclave is actually live, not just a setting in a dashboard.

neurolix_protocol@neurolix-tee-node-1:~$ sudo dmesg | grep -i sev
[    0.380014] Memory Encryption Features active: AMD SEV

That line is the kernel confirming hardware memory encryption is active at CPU level. Not a software flag. Not a cloud setting. Silicon.

Step 2: GPT-2 Inside the Enclave

We used GPT-2 (124M params) intentionally. Small enough to iterate fast on CPU-only hardware, real enough to prove the architecture. The production target is Llama 70B, Mixtral, Claude-class models — but you don't validate a protocol architecture with a 70B model on day 5 of a build.

from transformers import GPT2LMHeadModel, GPT2Tokenizer
tokenizer = GPT2Tokenizer.from_pretrained('gpt2')
model = GPT2LMHeadModel.from_pretrained('gpt2')

prompt = "Patient diagnostic report - confidential"
output = model.generate(
    inputs.input_ids,
    max_length=80,
    do_sample=True,
    top_k=50,
    top_p=0.95,
    temperature=0.7,
)

The inference ran. Everything inside: model weights, prompt, output. None of it ever touched non-encrypted memory. That's the whole point.

Step 3: The Attestation Token

This is where Neurolix stops being "trust us" infrastructure.

The CVM produced a signed OIDC token from Google Cloud's attestation service. Decoded payload:

{
  "google": {
    "compute_engine": {
      "instance_confidentiality": 1,
      "instance_name": "neurolix-tee-node-1",
      "project_id": "project-55eb2dea-259c-4db5-a25",
      "zone": "us-central1-a"
    }
  },
  "iss": "https://accounts.google.com"
}

instance_confidentiality: 1. Google certifying — cryptographically — that the enclave was active. Not us claiming it. The attestation chain: AMD hardware → Google Cloud → accounts.google.com root. Three independent parties before we even get to the blockchain layer.

Step 4: Commitment Hash

SHA-256 fingerprint of the inference session:

The canonical input for the hash: {model_id}|{prompt}|{output}|{timestamp}. Change a single bit and the hash changes completely. Combined with the Google attestation token, you have two independent proofs: one certifying the enclave was live, one certifying what was computed inside it.

Step 5: On-Chain Anchoring via NeurolixAttestation.sol

Minimal contract by design. No tokens, no governance, no upgradeability. Single responsibility: register commitment hashes permanently.

function registerAttestation(
    bytes32 commitmentHash,
    string calldata teeType,
    string calldata cloudProvider,
    string calldata modelIdentifier
) external returns (uint256 index)

Called registerAttestation() with:

• Hash: ec52836f...

• TEE: AMD_SEV

• Provider: GCP

• Model: gpt2-124m

Transaction confirmed. Verifiable forever: 0x6c9a8e68...010046 on Base Sepolia Blockscout

The Smart Contract Suite — v4 Status

Six contracts. Four iterations in four days. Audited with Devil's Advocate methodology — we assume every actor is malicious and work backwards.

Resolved (v1 → v4)

• NeurolixGovernor was entirely missing (governance was non-functional for three iterations)

• Quorum overflow: was calculating 4% of totalSupply() instead of VotingEscrow.totalLocked() — trivially exploitable

• OLIXToken.burn() was missing entirely

• Tax applied to system contract transfers (NodeRegistry, vault) — broken economics

• Slash timer reset exploit (node operator could reset the slash window)

• setProtocolContracts was callable multiple times (front-runnable)

• VotingEscrow missing IVotes checkpoints — broke Governor integration entirely

All fixed in v4.

Open — Mainnet Blockers

1. Heartbeat farming. The heartbeat function has no workload validation. A script can call it every N seconds from any machine with no actual compute. Fix: heartbeats must include a workloadCommitment hash + oracle-signed proof that TEE output was produced. Architecture defined, implementation pending.

2. MEV exit during SLA breach. deregisterNode() can be called while active sessions exist, allowing a node operator to escape slashing. One-line fix:

require(activeSessions[nodeId] == 0, "Cannot deregister with active sessions");

Scheduled for v5.

3. SLA parameter trust. Session parameters are currently set unilaterally by the client. A malicious client can specify impossible SLAs and claim refunds. Fix: bilateral signature (client + miner) required on session creation, verified on-chain. Implementation pending.

These three are mainnet blockers. They are not PoC blockers. The goal right now is architecture validation and community feedback — not production hardening.

We document them publicly because that's the difference between a serious protocol and security theater.

Why Base L2

Base is the obvious choice for Neurolix, and it's not close.

• $0.001 per attestation anchoring vs. Ethereum mainnet costs — every compute session produces an on-chain proof; the economics only work at L2 cost

• Coinbase ecosystem = institutional credibility for regulated-sector enterprise buyers ("settles on Coinbase's blockchain" lands differently than "settles on an anon L2")

• EVM-native: direct composability with DeFi, lending, staking primitives

• Fiat on-ramp through Coinbase for enterprise purchasing (meaningful for healthcare and finance CTOs who do not want to explain DEX mechanics to their procurement team)

Competitive Landscape — Where Neurolix Sits

Generic DePIN compute (io.net, Akash, Render) competes on $/GPU/hour. We do not play that game. That market has a price compression dynamic that crushes token economics — look at the -97% from ATH pattern across comparable generic protocols.

The closest architectural comp is Marlin Oyster (TEE compute + on-chain attestation). Respect the engineering. Different product: they're built for Web3 developers on any chain. We're built for regulated enterprise AI with compliance designed in from day one. Different market, different margins, different moat.

The quadrant we occupy — Decentralized + TEE + Regulated AI vertical — has no other occupants today. That's the opportunity.

Roadmap

Phase 1 — Hardening & Multi-Cloud
  → 3 open security issues resolved
  → External audit
  → Azure Confidential Computing + AWS Nitro Enclaves

Phase 2 — Base Mainnet Launch
  → Protocol economic layer live
  → NodeRegistry operational
  → First node operators onboarded

Phase 3 — GPU Confidential Compute
  → NVIDIA H100 TEE-IO
  → AMD MI300X confidential mode
  → Production LLM inference (Llama 70B, Mixtral) inside enclaves

Phase 4 — Enterprise Pilot Program
  → First regulated-sector partners
  → Closed beta, commercial agreements

Phase 5 — General Availability
  → Open network, permissionless onboarding, public SDK

What This Is Not

Not a GPU marketplace. Not competing on price per hour. Not another compute layer with a token bolted on.

Neurolix is the compliance-ready AI compute primitive for sectors where privacy is a legal requirement. Every architectural decision — TEE selection, attestation chain design, Base L2 deployment, smart contract structure — was made with that constraint as the starting point.

Follow the Build

Day 9. This is early. The protocol is being built in public — every milestone, every bug, every architectural decision.

• X: @NEUROLIX

• Website: neurolixprotocol.com

• On-chain proof: Base Sepolia Blockscout

• Email: info@neurolixprotocol.com

Built by @BartLee99

If you're building in DePIN, confidential computing, or regulated AI infrastructure — reach out. The community is being built now.

Subscribe to follow Phase 1 shipping updates.

Disclaimer: This article is for informational and technical purposes only. Neurolix Protocol is in active development and this document describes a proof of concept, not a production-ready system. Please conduct your own research.

The Inconvenient Truth About Modern AI

Every hospital sits on data that could save lives. Every bank runs trading models that move markets. Every law firm has documents that decide cases.

None of them can use modern AI on that data.

Not because the models don’t exist — GPT-4, Claude, Gemini, MedGemma are right there. Not because the compute doesn’t exist — AWS, Azure, Google Cloud sell GPUs by the second.

They can’t use it because the moment sensitive data touches a public cloud, it becomes a compliance liability. GDPR. HIPAA. SOC 2. Each one a regulatory landmine.

According to the Cisco AI Readiness Index 2025, data privacy is now the #1 stated barrier to enterprise AI adoption — ahead of cost, talent, and infrastructure.

This is not a future problem. This is a $45 billion problem today.

The AI industry has spent five years optimizing for scale: bigger models, more parameters, larger context windows. Nobody optimized for the one thing regulated industries actually need:

Cryptographic proof that sensitive data never leaves a secure boundary.

That’s the problem Neurolix is building to solve.

What Is a TEE, Really?

Most explanations of Trusted Execution Environments are written for security researchers. Here’s one that isn’t.

Imagine a sealed glass box inside a server. Anyone can verify the box exists. Anyone can verify what model is running inside. But nobody can see the data flowing through it — not the cloud provider, not the system administrator, not the protocol operator. Not us.

This isn’t a software promise enforced by policy. It’s a hardware boundary enforced by silicon.

Modern TEE technologies — AMD SEV-SNP, Intel TDX, AWS Nitro Enclaves — encrypt VM memory at the CPU level. Even an attacker with physical access to the data center cannot read what’s inside.

When a workload runs inside a TEE, three things happen:

1. The CPU generates a cryptographic attestation token proving the enclave was active

2. The data is processed without ever being decrypted outside the boundary

3. The output emerges with a commitment hash — a unique fingerprint of the computation

Verify the attestation, verify the hash, and you have mathematical certainty that the work happened correctly and privately.

This is what Neurolix is designed to deliver — at scale, on regulated data, with on-chain SLA guarantees. The architecture has been validated in this proof of concept. The protocol is being built.

Field Report from the Build

What follows is the actual sequence of events. The terminal output is real. The on-chain transaction is verifiable by anyone reading this.

Step 1 — Spinning Up the Confidential VM

Google Cloud’s Confidential Computing offering supports AMD SEV-enabled instances out of the box. The configuration:

• Machine type: n2d-standard-2

• Zone: us-central1-a

• Confidential VM: enabled

• AMD EPYC processor with SEV active

First verification — confirming SEV was actually enforcing memory encryption, Hardware-level confirmation. The enclave was live:

Step 2 — Loading GPT-2 Inside the Enclave

We chose GPT-2 (124M parameters) intentionally for this PoC. It’s small enough to iterate fast on CPU-only hardware, large enough to be a real language model rather than a toy. The point was never to demonstrate state-of-the-art inference — it was to prove the architecture works end-to-end.

Inside the enclave:

from transformers import GPT2LMHeadModel, GPT2Tokenizer
tokenizer = GPT2Tokenizer.from_pretrained('gpt2')
model = GPT2LMHeadModel.from_pretrained('gpt2')

# Confidential medical inference
prompt = "Patient diagnostic report - confidential"
output = model.generate(...)

The inference ran. Honestly, the first time it worked I ran it twice just to make sure. The data — which inside a real deployment would be actual patient records — never touched any non-encrypted memory region.

Step 3 — The Attestation

This is where Neurolix becomes different from a “trust us” architecture.

The Confidential VM produced an attestation token, signed by Google Cloud’s attestation service. The decoded payload:

{
  "google": {
    "compute_engine": {
      "instance_confidentiality": 1,
      "instance_name": "neurolix-tee-node-1",
      "project_id": "project-55eb2dea-259c-4db5-a25",
      "zone": "us-central1-a"
    }
  },
  "iss": "https://accounts.google.com"
}

instance_confidentiality: 1 is the value that matters. It is Google certifying — cryptographically — that the enclave was active during the inference. Not us claiming it. Google certifying it.

Step 4 — The Computation Commitment

The inference produced a unique commitment hash:

ec52836f23170a1b601dd7e475107f314ca004186707f69836f7615901a665bd

This hash is a fingerprint of the computation output — a verifiable record of what was processed. Combined with the Google Cloud attestation token, the two form independent but complementary proofs: one certifying the enclave was active, one certifying what was computed inside it. Modify any single bit and the hash changes completely. It’s the cryptographic equivalent of a signed, sealed, dated affidavit.

But a hash sitting on a server is just data. To make it verifiable forever, it needed to live on-chain.

Step 5 — Anchoring to Base Sepolia

We deployed NeurolixAttestation.sol to Base Sepolia testnet. A minimal contract — by design. No tokens, no governance, no complexity. One job: register attestations from the protocol.

After deployment, we called registerAttestation() with the GPT-2 commitment hash, the TEE type, the cloud provider, and the model identifier.

Transaction confirmed. The proof is now permanent.

Verifiable by anyone, forever:

Step 6 — The Loop Closes

From cold infrastructure to verifiable on-chain attestation, end-to-end.

Confidential VM (AMD SEV)
        ↓
GPT-2 inference inside enclave
        ↓
Attestation token signed by Google Cloud
        ↓
Computation commitment hash produced
        ↓
Hash anchored on Base Sepolia blockchain
        ↓
Globally verifiable, permanent proof

I didn’t expect it to work this cleanly on the first attempt.

TEE → Attestation → Blockchain. The loop is closed.

Neurolix PoC - LLM inside AMD SEV Enclave

undefined

https://www.loom.com

Proof of Execution — watch the protocol primitive run live

Honest Limits of This PoC

I could have waited six more months to publish this. I didn’t, and here’s exactly why — and what’s still missing.

This proof of concept demonstrates that the architecture works. It does not, on its own, demonstrate a production-ready protocol. The honest limits:

The model is small. GPT-2 124M is from 2019. Production workloads will require Llama 3 70B, Mixtral, Claude-class models. The architecture supports them. We have not yet tested them.

The enclave runs on a single cloud. True decentralization requires multi-cloud, multi-operator attestation. Phase 2 of the roadmap brings Azure Confidential Computing and AWS Nitro Enclaves into the network.

AMD SEV is a strong baseline, not the strongest TEE. AMD SEV-SNP and Intel TDX provide stronger memory integrity guarantees. Future iterations will support both.

The compute is CPU-only. Real AI workloads require GPUs inside confidential VMs — NVIDIA H100 with TEE-IO, or AMD MI300X confidential mode. Phase 3 milestone.

We chose to ship the PoC fast and document its limits openly, rather than wait for a perfect demo nobody could see.

The Smart Contract Story — Including What’s Still Broken

The Neurolix protocol consists of six smart contracts on Base L2. Over the past four days they went through four major iterations, audited internally with a structured Devil’s Advocate methodology — actively looking for vulnerabilities before the network goes live.

Issues found and resolved (v1 → v4):

• Missing NeurolixGovernor contract (governance was non-functional)

• Quorum overflow vulnerability (4% of total supply instead of locked supply)

• Missing burn function on the OLIX token

• Tax application to system contracts (NodeRegistry, vesting, vault transfers)

• Slash timer reset exploit

• One-shot setProtocolContracts enforcement

• VotingEscrow missing IVotes checkpoints

These are now fixed in v4 and the codebase is significantly hardened.

Issues identified and NOT yet resolved — to be fixed before mainnet:

1. Heartbeat farming risk. The current heartbeat function does not enforce that the work was actually done — it can be called from a script. Mitigation: heartbeats must include a workloadCommitment plus an oracle-signed proof. Implementation pending.

2. MEV exit during SLA breach. A node operator can call deregisterNode() while sessions are active, escaping slashing. Mitigation: deregisterNode must revert if any active session exists for the node. One-line fix, scheduled for v5.

3. SLA parameter trust. Session parameters are currently set by the client unilaterally. A malicious client could set impossible SLAs to claim refunds. Mitigation: bilateral signature (client + miner) required on session creation. Architecture defined, implementation pending.

These three are blockers for mainnet. They are not blockers for the testnet PoC, where the goal is to validate the architecture and gather feedback from early users.

We document them publicly because that is the difference between security theater and actual security.

Why $OLIX Is the Fuel

The OLIX token is not a marketing layer wrapped around the protocol. It is the economic primitive that makes the protocol work.

Three roles, hardcoded in the contracts:

1. Payment for compute.

Every confidential AI session is paid in OLIX. No stablecoin escape hatch — using the network requires the token. Demand is anchored to real usage, not speculation.

2. Deflationary burn.

Every compute session burns a percentage of OLIX permanently. The hard cap is immutable — but circulating supply decreases with every job. More AI on Neurolix → structurally less OLIX in circulation.

3. Node operator collateral.

Running a node requires staking OLIX. Bad behavior gets slashed. Good behavior gets rewarded with a vesting structure designed to align long-term node operator incentives with protocol health.

This is the difference between a token that exists to be sold and a token that exists because the protocol cannot function without it.

The complete tokenomics — including exact distribution, vesting schedules, and burn parameters — will be published as a dedicated whitepaper before mainnet launch.

Roadmap

Phase 1 — Hardening & Multi-Cloud

Resolution of open security issues. External audit. Azure + AWS attestation.

Phase 2 — Base Mainnet Launch

OLIX token deployment. NodeRegistry live. First node operators onboarded.

Phase 3 — GPU Confidential Compute

NVIDIA H100 with TEE-IO support. Production-grade LLM inference inside enclaves.

Phase 4 — Enterprise Pilot Program

First regulated-sector partners. Closed beta. Commercial agreements

Phase 5 — General Availability

Open network. Permissionless node onboarding. Public SDK.

What This Is, and What It Isn’t

Neurolix is not a generic GPU compute marketplace. It is not competing on price per hour.

Neurolix is the first vertical DePIN product built specifically for AI teams operating on regulated data — healthcare, finance, biotech, legal.

Sectors where data privacy is not a feature. It is a legal requirement.

The thesis is simple: in the coming years, no serious enterprise will train AI on sensitive data without cryptographic proof of confidentiality.

Neurolix is building the protocol that will provide that proof — at scale, on-chain, with hardware guarantees.

Want to Follow the Build?

This is Day 7. Follow what comes next.

This is the beginning of a build log. New posts every week.

Follow @NEUROLIX on X for daily progress updates.

Subscribe on Paragraph for technical deep-dives.

Visit our official website: neurolixprotocol.com

Email: info@neurolixprotocol

Built by @BartLee99

---

Disclaimer: This article is for informational and technical purposes only. $OLIX is a utility token designed to access Neurolix computational resources. It does not constitute a financial product, investment advice, or an offer to buy or sell securities. The Neurolix protocol is in active development and this document describes a proof of concept, not a
production-ready system. Participation in any future token event involves risk. Please conduct your own research.