Multi-Prover

A multi-prover architecture validates the same result with more than one independent proving system. Its purpose is to reduce the risk that a bug or compromise in a single proof implementation can finalize an invalid state transition.

Prover diversity

The strongest designs use proof systems with different assumptions and implementations. For example, a rollup might compare a zero-knowledge validity proof with execution performed by a TEE Prover. Agreement provides additional confidence because the two paths are less likely to share the same failure mode.

The protocol must define how results are compared and what happens when provers disagree. Depending on the design, disagreement may pause finalization, trigger a dispute process, or require another independent verifier.

Security considerations

Adding provers is not automatically safer. A multi-prover design should consider:

• Whether implementations are genuinely independent
• How each prover's keys and software are updated
• Whether disagreement can halt the system indefinitely
• Which verifier or governance process resolves failures
• Whether shared dependencies create correlated risk

Automata's maintained TEE Prover documentation describes an SGX-based execution proving design that can serve as one independent path in a multi-prover rollup architecture.