What is the difference between Brevis's "off-chain computation on-chain verification" model?

Author: Blue Fox Notes; Source: X, @lanhubiji

Seeing Vitalik mention Brevis, it seems to place great importance on L1 scaling. In the Ethereum roadmap, there is a concept of “off-chain computation and on-chain verification”. Eigenlayer, Succinct, and Zksync have had similar ideas, indicating a consensus in the industry that to truly scale L1 in a decentralized manner, one can leverage off-chain advantages; Brevis has also adopted this model, so what makes Brevis different?

What is the “off-chain computation and on-chain verification” model? To help more ordinary users understand, we can use a simplified analogy: “off-chain computation and on-chain verification” can be seen as “condensing” off-chain facts (computation results or data) into a concise proof or summary, which is then verified on-chain. To some extent, its thinking is similar to L2 Rollup at an abstract level, where L2 Rollup packages multiple transactions into a batch, submits it to L1 for verification and execution. Although the specific mechanisms are different, this is helpful in understanding Brevis's ZkVM design philosophy: “condensation and verification”. Through mathematics, a large amount of off-chain computational work is compressed into small pieces of information, enabling efficient processing on-chain, which is costly and has low throughput, thus addressing the scalability challenges of blockchain.

The core mechanism of Brevis is to perform efficient computations off-chain, generate ZK proofs, and then complete verification on-chain at a fast low cost, without the need to re-execute the entire complex computation. This is not novel, but what sets Brevis apart is that:

The Combination of Generality and Specialized Optimization

Brevis's tech stack is modular design, where Pico zkVM serves as its general-purpose verifiable computing engine, supporting the generation of ZK proofs for any computation. Developers write code in Rust without needing ZK expertise, as the platform automatically handles proof generation, lowering the barrier for developers to build complex cryptographic applications (the technology abstracts the complexity of ZK, allowing developers to build applications as if they were writing regular code). Its modular architecture supports the addition of specific co-processors, and in addition to general settlement, it can optimize complex computations for specific scenarios, achieving more targeted improvements.

It has a built-in protocol processor called ZK Data Coprocessor, designed for blockchain historical data analysis, which can solve the “memory loss” problem of smart contracts (the inability to access historical data cheaply). It is in

Off-chain retrieval and analysis of data, providing results and proofs, ensuring data existence and computational correctness. For example, PancakeSwap can use Brevis hooks to implement fee discounts based on user transaction volume; Uniswap uses Brevis for gas refunds. They achieve complex functionalities while saving significant costs through the zK Data Coprocessor.

Providing an “Accelerator” for Ethereum L1

Pico Prism is one of the key technologies of Brevis, which has made breakthroughs in multi-server GPU clusters and supports “real-time proof” for Ethereum L1. This “real-time proof” can be understood as the ability to cryptographically “stamp” each block (a page of transaction records) of Ethereum L1 to confirm its correctness within seconds, eliminating the need for everyone to recalculate to verify its reliability.

According to the current Ethereum Foundation real-time proof framework benchmark, the current L1 block with a 45M gas limit achieves a 99.6% coverage rate (<12 seconds proof) and a 96.8% real-time coverage rate (<10 seconds); the average proof time for 36M gas blocks is 6.04 seconds, and for 45M gas blocks, it is 6.9 seconds; the hardware consists of 64 RTX 5090 GPUs, costing 128K dollars.

The data above looks very professional, but for the average user, this information might feel irrelevant.

For a simple understanding, it can be simplified to a comparison where Pico Prism is like an accelerator installed on Ethereum L1. Previously, Ethereum required all nodes to recalculate for each block, but with technologies like Pico Prism, it means that it can validate the network in just a few seconds through “concentration” (quickly generating a proof, super-compressing the summary), without requiring each node to recalculate. In other words, this means that Ethereum L1 will become faster, cheaper, and more efficient, capable of handling more complex implementations, all while not sacrificing decentralization and security. If the previous Ethereum was like an old-fashioned bicycle, with Brevis's Pico Prism technology, Ethereum has upgraded to a car.

The effect of this acceleration can unlock more scenarios, such as real-time AI-driven DeFi lending, on-chain games, anonymous voting, and more.

DeFi Scenarios: In the past, smart contracts on Ethereum L1 could only check balances for borrowing money, without the ability to analyze users' stability based on their historical transaction data (as analyzing massive historical data was not feasible). With this accelerator, L1 can support real-time analysis of massive historical data (proven in seconds), thereby constructing an “AI lending robot.” The contract derives a credit score based on the user's DeFi trading history and offers personalized interest rates. Additionally, for high-frequency scenarios, such as flash loans, borrowing/investing/repaying can all be completed in one block, with AI optimizing the path in real-time to avoid “slippage” losses. This is similar to a decentralized Robinhood. Furthermore, high-frequency auctions can be achieved, allowing hundreds to thousands of bids to be completed every minute.

On-chain games: Previously, L1 wanted to build a multiplayer game (like on-chain Axie Infinity), with a block confirmation time of 12 seconds per round, causing player lag and skyrocketing fees; by using Pico Prism to support “simulated real-time” gaming, off-chain servers calculate damage and other values, and each round uses ZK proofs to settle on L1, simulating “real-time” gaming for a better gaming experience.

Anonymous on-chain voting scenario: Currently, L1 voting is transparent, easy to track or manipulate, and has high complexity in statistical costs and slow speed. By implementing “zero-knowledge privacy computing” through Pico Prism, high-frequency privacy applications can run on L1, enabling high-frequency anonymous voting for DAO governance with real-time results.

What do the above scenarios mean for Ethereum? They can unlock more DeFi and other application scenarios, bringing more assets to L1, leading to more transactions and liquidity, and greater activity.

As for what scenarios can emerge in the future, they still need to be verified in specific practices.

Gradual Implementation

According to public information, Brevis is gradually being deployed, having generated 147.5 million ZK proofs; there are over 190,000 independent users; it supports 5 blockchains; and it has more than 20 major partners (such as Metamask, Linea, etc.). It is currently integrated into already running applications, such as the distribution of annual rewards through Brevis technology on the Incentra Platform; PancakeSwap implementing discounts based on trading volume and other data; and Linea distributing 1 billion LINEA tokens based on user contributions.