What is the difference between Brevis's "off-chain computation on-chain verification" model?

Author: Blue Fox Notes; Source: X, @lanhubiji

Seeing Vitalik mention Brevis, it seems to place great importance on L1 scaling. In the Ethereum roadmap, there is a concept of “off-chain computation and on-chain verification”. Eigenlayer, Succinct, and Zksync have had similar ideas, indicating a consensus in the industry that to truly decentralize L1 scaling, one can leverage off-chain advantages. Brevis has also adopted this model, so what makes Brevis different?

What is the “off-chain computation and on-chain verification” model? To help more ordinary users understand, we can use a simplified analogy: “off-chain computation and on-chain verification” can be seen as “condensing” off-chain facts (computation results or data) into a concise proof or summary, which is then verified on-chain. To some extent, its thinking is similar to L2 Rollup at an abstract level. L2 Rollup packages multiple transactions into a batch and submits them to L1 for verification and execution. Although the specific mechanisms differ, this helps in understanding Brevis's ZkVM design philosophy: “condensation and verification.” Through mathematics, a large amount of off-chain computation work is compressed into small pieces of information, achieving efficient processing on-chain, which is expensive and has low throughput, thus addressing the blockchain scalability issue.

The core mechanism of Brevis is to perform efficient calculations off-chain, generating ZK proofs, and then completing verification on-chain at a fast and low cost, without the need to re-execute the entire complex computation. This is not new, but what sets Brevis apart is:

Combination of Generality and Specialized Optimization

Brevis's tech stack is modular design, where Pico zkVM serves as its general verifiable computing engine, supporting the generation of ZK proofs for any computation. Developers write code in Rust without needing ZK expertise, as the platform automatically handles proof generation, lowering the barrier for developers to build complex cryptographic applications (the technology abstracts the complexity of ZK, allowing developers to build applications as if they were writing regular code). Its modular architecture supports the addition of specific co-processors, and in addition to general settlement, it can also optimize complex computations for specific scenarios, achieving more targeted improvements.

It has a built-in protocol processor called ZK Data Coprocessor, designed for blockchain historical data analysis, which can solve the “memory loss” problem of smart contracts (inability to access historical data cheaply). It is at

Off-chain retrieval and analysis of data, providing results and proof, ensuring data existence and computational correctness. For example, pancakeswap can use Brevis hooks to implement fee discounts based on user trading volume; uniswap uses Brevis for gas refunds. They achieve complex functions through the zK Data Coprocessor while saving a substantial amount of costs.

Providing an “Accelerator” for Ethereum L1

Pico Prism is one of the key technologies of Brevis, making breakthroughs in multi-server GPU clusters and supporting “real-time proofs” for Ethereum L1. This “real-time proof” can be understood as the ability for each block (a page of transaction records) on Ethereum L1 to be cryptographically “stamped” for correctness within seconds, eliminating the need for everyone to recalculate to verify reliability.

According to the current Ethereum Foundation real-time proof framework benchmark, for the current L1 block with a 45M gas limit, a coverage rate of 99.6% (proof in <12 seconds) and a real-time coverage rate of 96.8% (proof in <10 seconds) are achieved; the average proof time is 6.04 seconds for a 36M gas block and 6.9 seconds for a 45M gas block; the hardware consists of 64 RTX 5090 GPUs, costing 128K dollars.

The data above looks very professional, but for ordinary users, this information may be unremarkable.

To simplify understanding, we can liken Pico Prism to an accelerator added to Ethereum L1. Previously, Ethereum required all nodes to recalculate for each block, but with technology like Pico Prism, it means that it can validate in just a few seconds through “condensation” (rapid proof generation, super-compressed summary), without each node having to recalculate. In other words, this means Ethereum L1 will become faster, cheaper, and more efficient, able to handle more complex implementations, while still not sacrificing decentralization and security. If the previous Ethereum was akin to an old-fashioned bicycle, with Brevis's Pico Prism technology, Ethereum has upgraded to a car.

The effect of this acceleration can unlock more scenarios, such as real-time AI-driven DeFi lending, on-chain gaming, anonymous voting, etc.

DeFi Scenario: Previously, smart contracts on Ethereum L1 could only check balances to borrow money, without being able to analyze the user's stability based on historical transaction data (because analyzing massive historical data was not feasible). With this accelerator, real-time analysis of massive historical data on L1 is supported (proven in a few seconds), enabling the creation of an “AI Lending Robot.” The contract derives a credit score based on the user's DeFi transaction history, providing personalized interest rates. Additionally, for high-frequency scenarios such as flash loans, borrowing/investing/repaying are completed within a single block, with AI optimizing the path in real-time to avoid “slippage” losses. It's similar to a decentralized Robinhood. There can also be high-frequency auctions, completing hundreds or thousands of bids per minute.

On-chain games: Previously, L1 wanted to build a multiplayer game (such as on-chain Axie Infinity), with a block confirmation time of 12 seconds per round, resulting in player lag and soaring costs; by using Pico Prism to support “simulated real-time” gaming, off-chain servers calculate damage and other values, with each round settled to L1 using ZK proofs, simulating a “real-time” game for a better gaming experience.

Anonymous voting scenarios on the blockchain: Currently, L1 voting is transparent, making it easy to track or manipulate, and the cost of complex statistics is high, with slow speeds. By implementing “zero-knowledge privacy computing” through Pico Prism, high-frequency privacy applications running on L1 can achieve high-frequency anonymous voting for DAO governance, with results available in real time.

What the above scenario means for Ethereum is that it can unlock more DeFi and other application scenarios, bringing more assets to L1 sedimentation, leading to more transactions and liquidity, and greater activity.

As for what scenarios may emerge in the future, they still need to be tested in specific practices.

Gradual Implementation

According to public information, Brevis is gradually being deployed, generating 147.5 million ZK proofs; there are over 190,000 independent users; it supports 5 blockchains; there are more than 20 main partners (such as Metamask, Linea, etc.), and it is currently integrated into applications that are already running. For example, through Brevis technology, the Incentra Platform distributes annual rewards; PancakeSwap implements discounts based on trading volume and other data; Linea distributes 1 billion LINEA tokens based on user contributions, etc.