Targon: Confidential Compute on Bittensor, with Intel

The thesis

Targon is the second-largest claimed-revenue subnet on Bittensor, a $10.5 million Series A backed by OSS Capital and Bittensor’s own co-founders, and the only subnet that has co-authored a research paper with Intel. The technical story is genuinely interesting. The commercial story is weaker than the marketing suggests, and the gap between the two is the part of Targon worth understanding.

The technical claim is straightforward to state and harder to deliver on: confidential GPUGPUGraphics Processing Unit. Originally designed to render video game graphics, GPUs turned out to be exceptionally good at the massively parallel math that AI models need. Modern AI training and inference runs almost entirely on GPUs.Like a factory with 10,000 workers doing the same simple task in parallel, versus a CPU which is more like 10 workers each doing different complex tasks. AI training involves doing simple math a million times per second on a million numbers, which is exactly what the GPU factory is designed for.Read more → compute for AI inferenceInferenceRunning a trained AI model to produce an answer. Inference is what happens when you type a prompt into ChatGPT and get a response. The model takes your input, computes a best guess, and returns it.Like asking an expert for their opinion. The training was the decades they spent becoming an expert. The inference is the 30 seconds it takes them to answer your specific question.Read more →, where neither the operator nor the host hardware can see the data being processed. Intel TDX handles encryption on the CPU side. NVIDIA Confidential ComputingConfidential ComputeHardware-enforced computation where data and code are encrypted in memory and only the authorised application can access them. The machine's operator cannot read what the application is doing even though they own the machine.Like renting space in a bank vault. The bank owns the building and runs the security, but what you put in the vault is invisible even to the bank staff. Only you have the key.Read more → extends the trust boundary across PCIe to the GPU. Cryptographic attestation lets a buyer verify they’re talking to genuine hardware before sending a single byte. For regulated buyers (healthcare, finance, defence) this is the architectural unlock that makes decentralised compute usable for workloads that would otherwise have to stay on a private cloud.

The commercial claim is harder to verify. Manifold Labs reports approximately $10.4 million in annual recurring revenue, but Pine Analytics flags this as “a projection cited across multiple analyst reports, not an audited number.” There is no public revenue dashboard. There are no named enterprise customers. The marketing copy talks about “regulated industries” as a target, not as a customer list. Three weeks after the Intel whitepaper landed, no named healthcare, finance, or government customer has been publicised.

This article looks at both sides honestly. The technical innovation deserves credit. The commercial reality deserves scrutiny.

What Targon actually is

Targon is Bittensor subnet 4, run by Manifold Labs. The product is a GPU compute and inference marketplace where miners contribute hardware and validators score performance, with the twist that all workloads run inside hardware-attested confidential enclaves rather than on raw GPUs.

The architecture has three layers:

Intel TDX (Trust Domain Extensions) is a CPU feature on recent Xeon processors that creates cryptographically isolated VMs. The host hypervisor cannot read the VM’s memory. Remote attestationAttestationA cryptographic proof that a piece of code is running on a specific hardware enclave in an unmodified state. Attestation lets remote users verify that a service is genuinely running what it claims to be running.Like a tamper-evident seal on a medicine bottle. The seal itself doesn't make the medicine safe, but it gives you a way to verify that nobody opened the bottle and swapped the contents before you bought it.Read more → lets a client verify that the VM is running on genuine Intel hardware before sending data. This isn’t new technology, but using it as the foundation for a public decentralised compute network is.

NVIDIA Confidential Computing, available on H100 and H200 GPUs, extends the trust boundary from the CPU enclaveEnclaveAn isolated region of CPU or GPU memory protected by hardware. Code and data inside the enclave are inaccessible to the operating system, the hypervisor, or even the machine's physical owner.Like a secure room inside a much larger office building. The building's caretakers have keys to every other room but not this one. What happens inside is invisible to them by design.Read more → across the PCIe bus to GPU memory. Without this, data leaving the CPU enclave and entering the GPU would be exposed in transit and at rest in GPU memory. With it, the entire inference path stays encrypted from when the promptPromptThe text you give an AI model to tell it what to generate. A prompt can be a simple question, a long instruction, a chunk of context plus a task, or a conversation history the model uses to produce its response.Like a brief you give to a junior designer. A vague brief gets a vague result. A detailed brief with context, constraints, and examples gets something usable. The quality of the output depends heavily on the quality of the brief.Read more → enters the enclave to when the response leaves it.

Targon Virtual Machine (TVM) is Manifold’s proprietary runtime that orchestrates attestation, key exchange, and workload scheduling across the network of untrusted Targon miners. This is the part that’s specific to Bittensor and the part that Manifold has not open-sourced. The subnet incentive code is on GitHub under MIT licence, but the orchestration layer that makes the confidential compute promise actually work is closed.

The Intel paper

On 23 March 2026, Manifold Labs and Intel co-authored a research paper titled Decentralized Compute on Untrusted Hardware Using Intel TDX and Encrypted CVMs. It’s hosted on both Manifold’s site and Intel’s community blog. The Intel co-authors are Haidong Xia and Sathi Nair. The Manifold authors are Venish Patidar, Dhruv Bindra, Ahmed Darwich, and Josh Brown.

This is more substantive than the typical crypto-native partnership announcement. Intel doesn’t host co-authored research on community.intel.com without internal review. The paper isn’t a marketing document with Intel’s logo on it. It’s a technical collaboration that Intel was willing to put its name on. For a Bittensor subnet trying to convince enterprise buyers that decentralised compute is production-ready, that’s a meaningful credibility marker.

The paper’s core argument is worth quoting because it captures the right framing for the entire decentralised compute thesis: “Decentralization does not eliminate the trust problem, it redistributes it.” Without hardware-rooted attestation, decentralised inference asks the buyer to trust that none of the operators they don’t know are malicious. With attestation, the trust collapses into “trust Intel.” That’s a meaningfully smaller and more credible trust assumption.

It is not, however, a commercial partnership announcement. There’s no Intel customer. No revenue. No joint product. The paper is research collaboration, and treating it as anything more than that would be overreading.

The team and the funding

Manifold Labs is run by people who built Bittensor. Robert Myers, the CEO, was previously Senior Software Engineer at the Opentensor Foundation and is described as a founding Bittensor contributor. James Woodman, the President, was COO of the Bittensor Foundation. Josh Brown is CTO. The team isn’t a group of crypto opportunists who showed up after TAO went up. They’re insiders who left the foundation to build something specific.

The $10.5 million Series A closed on 28 July 2025, led by OSS Capital. The participant list is unusually strong for a Bittensor-native company:

• Digital Currency Group
• Tobi Lütke (Shopify CEO)
• Ram Shriram (Google founding board member)
• Zachary Smith (Packet co-founder)
• Jacob Steeves and Ala Shaabana (both Bittensor co-founders)
• Logan Kilpatrick (then Google DeepMind Group PM)

Two things to note. First, two of Bittensor’s own co-founders backed Manifold financially, which is the strongest possible internal endorsement. Second, the participation of Tobi Lütke, Ram Shriram, and Logan Kilpatrick is the kind of strategic angel list that gives a company genuine enterprise-introduction capability. These aren’t crypto-native investors. They’re people who can open doors at companies that buy compute at scale.

The post-money valuation hasn’t been disclosed. The corporate jurisdiction hasn’t been disclosed either. Both are gaps worth flagging.

The revenue question

This is where the story gets harder.

Manifold Labs reports approximately $10.4 million in annual recurring revenue. The figure is repeated across analyst reports (Unsupervised Capital, simplytao.ai, OAK Research) but every citation traces back to Manifold’s own reporting. There is no audit. There is no live revenue dashboard. Pine Analytics’ bear case paper explicitly flags this: “The $10.4 million is a projection cited across multiple analyst reports, not an audited number” and notes “the absence of a live revenue dashboard excluding emissionsEmissionsNew tokens created and distributed by a blockchain protocol over time as rewards to validators, stakers, or miners. Emissions fund network security and participation at the cost of diluting existing holders.Like a company that pays employees partly in newly printed shares. Every year the total number of shares goes up, which means existing shareholders own a slightly smaller slice of the same company unless the company grows faster than the printing.Read more → as a transparency concern.”

Pine puts Targon’s emission-to-revenue ratio at approximately 1.7 to 1. That’s significantly better than Chutes’ 22-40 to 1 ratio, which would mean Targon is closer to economic sustainability than any other Bittensor subnet. If the $10.4M figure is accurate, Targon is the strongest sustainability story on the network.

If.

I want to believe the number. The Series A backing, the Intel paper, the team’s Bittensor pedigree all point in the right direction. But “trust the team’s projection” is not verification, and Pine Analytics has the same access to the underlying data as we do, which is to say none. A meaningful percentage of analyst confidence in Targon comes from the strength of the surrounding signals (investors, Intel, founders) rather than from independent revenue verification. That’s a reasonable heuristic but it’s not the same as proof.

The thing that would change my read materially is a public revenue dashboard. Anything that gets the ARR figure from “Manifold’s own number” to “verifiable on a URL” closes the gap with Pine’s scepticism. Until then, every published ARR figure should carry attribution.

The Dippy clarification

You’ll often see Targon described as “powering Dippy AI, an app with 4 million plus users.” This framing is misleading in two ways and worth correcting.

First, Dippy is not a Manifold product. It’s owned by Impel Intelligence, which raised a separate $2.1 million pre-seed led by Drive Capital. Dippy also runs Bittensor subnet 11 directly. Dippy is a customer of Targon, buying inference at negotiated rates. The customer revenue from Dippy users flows to Impel Intelligence, not to Manifold. When you read “Targon powers Dippy”, what that means is “Dippy is one of several Bittensor-ecosystem product teams that buys inference from Targon.”

Second, the user count is overstated. Independent data from AppBrain shows roughly 1 million Android downloads with about 150,000 monthly downloads. Different sources cite “1M+ users” or “around 600K MAU.” The “4 to 8.6 million users” figure that gets repeated in some Targon coverage doesn’t match any verifiable source I could find.

This matters because the implied story (Targon has millions of consumer users through Dippy) is different from the actual story (Targon sells inference wholesale to a handful of Bittensor-ecosystem product teams, the largest of which has hundreds of thousands of users on Android). Both are real. They’re just not the same story.

The customer gap

Targon’s marketing positions confidential compute for healthcare, financial services, and government workloads. The Intel paper reinforces that positioning. The Series A press release leans into it. The targon.com landing page claims “99% uptime, sub-50ms latency, 1000+ GPUs.”

What’s missing is a single named enterprise customer.

I went looking. Three weeks after the Intel whitepaper, no healthcare, finance, or government customer has been publicised. No case studies. No customer logos on the website. No testimonials. Pine Analytics’ coverage doesn’t name one. The Series A press release doesn’t either. The named Targon customers in any source are Dippy, Ridges, and Score, all of which are Bittensor-ecosystem product teams, not external enterprise buyers.

This isn’t a death sentence. Sales cycles in regulated industries are long. A confidential compute deal with a healthcare buyer might take 12-18 months from first conversation to first invoice. Three weeks of silence after a research paper isn’t proof that nothing’s happening. But it is an absence of evidence where, if the thesis were materialising, you’d expect to see something.

The most charitable interpretation is that Manifold has signed customers under NDA and can’t publicise them yet. The less charitable interpretation is that the enterprise sales motion hasn’t started producing yet. We don’t know which. What we know is that the publicly observable customer base is Bittensor-internal.

The December 2026 halving

Bittensor halves emissions on a fixed schedule. The next halvingHalvingA protocol event that cuts the rate of new token emissions by half. Halvings are scheduled in advance, happen automatically at fixed intervals, and are a core mechanism for enforcing declining token supply growth over time.Like a savings account where the interest rate is contractually cut in half every four years. You still earn interest, but the rate drops on a known schedule, and the issuer can't change it without breaking the contract.Read more → is approximately 14 December 2026. Targon’s daily emission drops from roughly 206 TAO (5.73% of 3,600) to roughly 103 TAO. Annualised TAO subsidy roughly halves.

Pine’s 1.7:1 ratio means Targon is closer to break-even than Chutes is, but it’s not at break-even today. After the halving, even if customer revenue stays exactly flat, the subsidy ratio improves to roughly 0.85 to 1, which would put Targon at structural break-even on the self-reported number. The math is materially better than Chutes’ situation.

The question is whether the customer revenue is real. If Manifold’s $10.4M is accurate, Targon is the closest thing Bittensor has to a sustainable subnet, and the December halving doesn’t break the modelModelA trained neural network that takes inputs (text, images, audio) and produces outputs (more text, classifications, generated content). In DeAI the model is the thing that actually does the work.Like a very experienced apprentice who has spent years watching thousands of masters make furniture. They can't explain how they know when a joint is right, but they can make a chair that looks and functions like a Chippendale. The training is invisible. The output is what matters.Read more →. If the actual figure is materially lower (say half the self-reported), Targon enters the same trap Chutes is in, just with a slightly later deadline.

What I’d want to see

Same five things I asked for from Chutes, with one Targon-specific addition:

1. A public revenue dashboard. The $10.4M figure needs verification. Pine’s scepticism is reasonable until there’s an external source.
2. Named enterprise customers. Even one healthcare or financial services case study would change the entire narrative.
3. Open-sourcing the Targon Virtual Machine. The subnet incentive code being MIT is fine. The orchestration runtime staying closed undermines the decentralisation framing.
4. Manifold Labs entity disclosure. Jurisdiction, structure, accountability framework. The Series A backing makes this gap stand out more, not less.
5. GPU count clarity. Earlier materials said 1,500+ H100s. Recent materials say 1,500+ H200s. Either there was an upgrade (worth announcing) or there’s an inconsistency (worth correcting).
6. Actual attestation evidence in production. A live demo where a buyer can verify a remote enclave attestation, not just a description of how it works in the whitepaper.

The honest assessment

Targon is the strongest Bittensor subnet on paper. Real funding. Real founders. Real research collaboration with Intel. A genuinely interesting technical thesis around confidential compute that addresses a real enterprise need. A revenue figure that, if accurate, would make Targon the closest thing Bittensor has to economic sustainability.

What’s missing is the bridgeBridgeA protocol that lets you move assets from one blockchain to another. Bridges typically lock the asset on the source chain and mint a wrapped version on the destination chain. Bridges are notoriously the most-attacked component in crypto.Like a coat check at a club. You hand over your coat, get a numbered ticket, and the club promises to return the coat when you bring back the ticket. The trust assumption is that the coat check doesn't lose your coat or run away with it.Read more → from “compelling on paper” to “verified in production.” The customer base is Bittensor-internal. The revenue is self-reported. The Intel partnership is research collaboration, not commercial. The platform isn’t fully open source. None of these are individually fatal, but together they describe a project that has done the hard technical work and the hard fundraising work but hasn’t yet done the commercial work that would justify the valuation.

I’m more positive on Targon than on Chutes. The team’s pedigree is stronger, the technical thesis is more durable, and the unit economics are closer to working. The asymmetry is that Targon has more upside if the commercial motion engages, and roughly the same downside as Chutes if it doesn’t.

For the broader Bittensor revenue picture, see Bittensor subnets: where the revenue actually is. For the parallel deep-dive on Chutes, see Chutes: Bittensor’s revenue machine, subsidised. For how to actually buy and stakeStakingLocking up a cryptocurrency to help secure a blockchain network, usually in exchange for rewards. The locked tokens act as a security deposit that can be taken away if the staker misbehaves.Like putting down a large rental deposit for an apartment. You get the money back if you behave, you earn interest while it's locked, and the landlord takes it if you trash the place.Read more → into subnet 4, see our Bittensor subnet staking guide.