AI Verification Tech MapSearch

Mechanism · Cryptographic & computational

Suggest an edit

Zero-knowledge proofs of inference

R2Demonstrated

Zero-knowledge proofs of inference let an AI developer show that a committed model computed an output from a given input, without disclosing the weights.

A verifier checks a small proof in seconds. The peer-reviewed system zkLLM proved one 2,048-token forward pass of a 13-billion-parameter model in about 13 minutes on one A100 GPU. Its zero-knowledge guarantee assumes a verifier that follows the protocol, and its public research code is unaudited.

A company, Attestable, reports proving a 31-billion-parameter model at 53 tokens per second for one 16,000-token sequence on one H100, without a paper or code. The main obstacle is cost. The main weaknesses are coverage and fidelity: a proof covers only the computation proven, and that computation is a fixed-point approximation of the model.

Proofs also do not show how much computation produced an output. An independent audit of one proving library, ezkl, found high-severity soundness bugs, since fixed.

Readinessmedium confidence

R2 through zkLLM, which has public, artifact-evaluated code and peer-reviewed results at 13 billion parameters; no implementation is yet production-grade for language models.

Rubric assessment

Assessed use: proving each output came from committed weights, against a prover who cheats

  • R1 met: ZKML, zkLLM and NanoZK describe the claim (an output equals the committed model applied to an input) and their assumptions 1 3 4.
  • R2 met through zkLLM. Its code is public and received CCS 2024 artifact-evaluation badges 2. Its published end-to-end results use a 13-billion-parameter model on a data-centre GPU, against a stated adversary: a cheating polynomial-time prover 1.
  • R3 not met for this use. zkLLM's README says the code is not ready for industrial applications 2. Attestable's results come without public code, paper or reproducible artifacts 8. The ezkl library is public, and Trail of Bits reports that other projects use its verifier contracts in production 6. The language model South et al. prove with ezkl is a 250,000-parameter nanoGPT, and the largest model in their results is a VAE decoder of about 1.07 million parameters 5. Both are far below the scale this use concerns. Lagrange calls DeepProve "production-ready" 14, but its repository has no releases, and its reported benchmarks are GPT-2 and Gemma 3 at 512 tokens 15. No source documents a party other than a developer relying on any of these systems for a verification decision about a language model.
  • R4 not met. Only ezkl has an independent audit: it left no high-severity finding unresolved 6. As of September 2026 no independent audit or red-team of zkLLM has been published. One independent analysis, tested on a small transformer, shows that valid proofs of LLM inference do not bind the computation spent, so a much smaller model can pass as the declared one 12.
Gaps to the next level
  • An implementation that is production-grade and available for language models, or relied on by a party other than its developer for a verification decision.
  • An independent public security evaluation (audit, red-team or peer-reviewed analysis) of a proof system that handles language models.

Assessed 2026-09-25 against rubric v1.1.

On this page

How it works

A zero-knowledge proof of inference lets a prover convince a verifier that an output came from a specific model on a specific input, without revealing the model's weights 7. A survey describes ZKPs as letting one party certify that a training, testing or inference result "was produced by the claimed computation without revealing sensitive data or proprietary model parameters" 7.

The protocol has two steps:

  1. The prover publishes a cryptographic commitment to the weights once. For LLaMa-2-13B, zkLLM's commitment took 986 seconds 1.
  2. For each query, the prover proves that the output equals the committed model applied to the input 1 3. The verifier checks the proof without the weights and without rerunning the model 1.

The weights are hidden, and the input and output are known to the verifier. In zkLLM's setting the verifier submits the prompt and receives the output with its proof 1. South et al. likewise keep weights private and inputs and outputs public 5.

Systems turn the network's operations into arithmetic over a finite field, with tensors as fixed-point numbers 1 3. Softmax, GELU and normalisation need special handling:

  • zkLLM uses a parallel lookup argument (tlookup) and an attention-specific protocol (zkAttn) 1.
  • NanoZK uses 16-bit lookup tables 4.

Proof systems differ:

  • ZKML compiles models to halo2 circuits with either KZG commitments, which need a trusted setup, or transparent IPA commitments 3.
  • zkLLM uses sumcheck-based protocols with Hyrax commitments 1.
  • zkGPT uses the GKR protocol with Lasso lookups and Hyrax commitments, made non-interactive with Fiat–Shamir 13.
  • NanoZK proves each transformer layer separately and links the layers with a chain of SHA-256 commitments 4.
  • Attestable reports a prover whose security rests "only on the security of cryptographic hash functions" 8.

Proofs over many inputs can be packaged into attestations that a model with fixed private weights reaches a stated benchmark score 5.

What it establishes

What it can establish.

  • A valid proof shows that the output follows from the committed weights, the public architecture and the input 1 3. This bears directly on The declared model is the one being served.
  • The weights stay confidential against a verifier that follows the protocol. zkLLM's zero-knowledge theorem shows that such a verifier's view reveals nothing about the weights beyond the output 1.
  • Attestable proposes proofs that an accounted workload "used an approved, unchanged model rather than a newly trained replacement", which bears on This compute runs inference, not training 9.

What it cannot establish.

  • Which model the commitment is. The proof does not tie the committed weights to an outside identity such as "the declared model". Proven benchmark results over the committed weights are one way to link them 5. Committed weights can also be hollow. Weights with the declared architecture and parameter count can route the work through a much smaller model and still yield valid proofs 12.
  • Work that was not proven. Attestable notes that "a proof of some computation is not a proof of all computation", and that a proof cannot find an undeclared datacenter 9.
  • Every output, when only some are proven. Assurance from sampling is probabilistic. Attestable proposes selecting outputs at random for proof after they have been committed 10. NanoZK bounds the chance of detecting tampering when auditors check a subset of layers 4.
  • The floating-point model. What is proven is a fixed-point approximation of the model 1. Attestable reports 8-bit integer matrix multiplications 8.
  • A hidden architecture. ZKML requires the architecture to be revealed 3, and zkLLM assumes it is publicly known 1.

Threat model

Soundness rests on computational assumptions against a cheating prover:

  • zkLLM proves its lookup argument sound: a cheating probabilistic polynomial-time prover succeeds only with negligible probability. The rest of its protocol applies sumcheck and proofs of opening for commitments whose binding rests on discrete-log hardness 1.
  • NanoZK assumes a polynomial-time adversary that controls the inference infrastructure and may substitute models or fabricate outputs. It relies on discrete-log hardness over the Pallas curve and SHA-256 collision resistance 4.
  • Attestable reports 100-bit security, and post-quantum security because it avoids public-key cryptography 8.

Confidentiality rests on further assumptions:

  • zkLLM assumes a semi-honest verifier, which "accurately reports the outcome of the proof verification" but tries to learn the weights. Its zero-knowledge theorem also assumes zero-knowledge variants of the sumcheck protocols 1.
  • NanoZK leaves side channels, denial of service and hiding the input from the provider out of scope 4.
  • Attestable treats physical-access and metadata channels as separate threats 10.

Evidence

  • ZKML. It proved a distilled 81.3-million-parameter GPT-2 in 3,651.67 seconds on a 128-vCPU, 1 TB machine. This was the largest model its authors could prove with under 1 TB of RAM 3.
  • South et al. They used ezkl to prove evaluations of small models. A 250,000-parameter nanoGPT took 2,781 seconds to prove and needed a 219 GB proving key 5.
  • zkLLM. It proved OPT models up to 13B and LLaMa-2 models of 7B and 13B, each proof covering one 2,048-token forward pass on one A100 GPU. LLaMa-2-13B took 803 seconds to prove and 3.95 seconds to verify, with a 188 kB proof 1. Its code is public 2.
  • zkGPT. It proved GPT-2 inference in 21.8 seconds with 32 threads on a 16-core CPU server, with a 101 KB non-interactive proof that verifies in 0.35 seconds. Its code is public 13.
  • NanoZK. It reports proofs of 3.2 to 3.7 KB per attention or MLP sub-circuit, about 83 KB in total for 12 layers. It measured full transformer blocks on CPU only up to width 128. Assuming a GPU speedup, it projects that a 12-layer GPT-2 would take about 14 minutes to prove sequentially 4.
  • Attestable. It reports proving a 31-billion-parameter Gemma model at 53 tokens per second for one 16K-token sequence on one H100 GPU, with 4.35 to 7.92 MiB proofs and 157 to 648 ms CPU verification. No code or paper accompanies these results 8.
  • Lagrange DeepProve. Lagrange reports a zero-knowledge proof of full GPT-2 inference 14. Its public repository, under Lagrange's own licence, reports proving 512 tokens of GPT-2 in 7.6 minutes on a 24-core CPU server with 504 GB of memory, with a 10.7 MiB proof that verifies in 1.3 seconds 15.
  • Independent audit of ezkl. Trail of Bits reviewed the ezkl library in January 2025, at its developer's request. It reported three high-severity circuit soundness issues and four ways to bypass data attestation in ezkl's smart contracts. Its fix review found every high-severity finding resolved 6.
  • Hollow-LLM attack. Researchers at the University of Southern California ran a ghost-weight attack through zkGPT's proof procedure on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were unchanged and serving cost stayed at the small model's level 12.

A verification system design for AI agreements lists ZKPs as a "tentative plan B" that, if they mature, could "remove the need for secure computing hardware setups" 11.

Limitations

Cost.

  • zkLLM needs about 12 to 13 minutes per 2,048-token forward pass at 13B scale on one A100 1.
  • The verification system design calls the overhead "heavy" 11.
  • The survey names "limited circuit expressiveness, high proving cost, and deployment complexity" as the main implementation bottlenecks 7.

Expressiveness. ZKML does not support branching or variable-length loops, so language models need fixed-length inputs 3. Floating-point emulation remains open 11. Attestable reports a 16K-token context limit 8.

Implementation soundness. In ezkl, Trail of Bits found circuits with missing constraints that "would allow a malicious prover to convince a verifier of incorrect calculations"; these were fixed 6. The zkLLM README says its code "has NOT undergone security auditing and is NOT ready for industrial applications". It also says prover and verifier run side by side, and that a deployment would need Fiat–Shamir to be non-interactive 2.

Quantisation. Trail of Bits also built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation. Whether it persists through proving was left for further investigation 6.

Coverage. A proof covers only the outputs proven 9. For accounting of other work, see Proofs of useful work for capacity accounting. A proof also does not show how much computation produced an output. In the Hollow-LLM attack, weights with the declared architecture let a much smaller model do the work, and the proofs remain valid 12.

Known flaws

Published flaws, with their severity, kind and status. How flaws are rated.

  • The proof covers a fixed-point approximation, not the floating-point modelSignificantOpen questionOpen

    Current ZK inference systems prove a quantised version of the network. zkLLM scales values by 2^16 and reports small perplexity changes 1. Attestable reports quantising matrix multiplications to 8-bit integers while proving other operations in floating point 8. A verifier therefore learns about the proof-friendly variant, and must separately accept that this variant is the declared model. Trail of Bits built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation; whether it persists through proving was left for further investigation 6. A verification system design calls floating-point emulation in ZKPs an open problem 11.

  • A proof speaks only for the computations that were provenSignificantTheoretical argumentOpen

    Attestable writes that "a proof of some computation is not a proof of all computation", and that a proof cannot discover a datacenter that was never declared 9. Proofs of inference do not by themselves show that no other workload ran on the same or other hardware.

  • The model architecture is disclosedMinorTheoretical argumentOpen

    ZKML "requires that the model architecture (but not weights) is revealed" 3, and zkLLM assumes a publicly known model structure 1. Architecture can be commercially sensitive.

  • Proofs do not bind computational effort (Hollow-LLM)SignificantDemonstrated attackOpen

    Researchers at the University of Southern California show that a proof of inference certifies that an output is consistent with committed weights under the declared architecture, but not how much computation produced it 12. In their Hollow-LLM attack, a provider keeps the declared architecture and parameter count but commits to "ghost weights". Some layers pass their inputs through unchanged, and wide layers carry the signal in a small subspace, so a much smaller inner model does the real work. The ghost weights satisfy the verification circuit and yield valid proofs 12.

    The authors ran the attack with the proof procedure of zkGPT, a separate ZK inference system, on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were identical to the inner model's, and serving cost stayed at the inner model's level. An honest model of the declared size cost 2.4 times as much to prefill and 3.1 times as much to decode. Proving cost still grew with the declared architecture 12.

    The authors note that results may be served before any proof, with the provider building the witness only when a call is selected for audit. They describe their constructions as "compatible with state-of-the-art zkLLM pipelines", and state that the attack does not imply a flaw in the proof system itself. They propose challenge-based audits and ablation tests, which raise the cost of cheating but give no guarantee 12.

Blockers

Technical detail

Systems encode a network as an arithmetic circuit, or as sumcheck and lookup relations, over a finite field, with tensors scaled to fixed point 1 3.

  • ZKML (EuroSys 2024) compiles models to halo2 circuits with KZG commitments (trusted setup) or IPA commitments (transparent), and optimises circuit layout. A distilled GPT-2 (81.3M parameters) took 3,651.67 s to prove with KZG, 18.70 s to verify and a 28,128-byte proof on a 128-vCPU, 1 TB machine 3.
  • ezkl also targets halo2 with KZG. South et al. proved a 250,000-parameter nanoGPT in 2,781 s, verified it in 2.69 s and needed a 219 GB proving key 5. A Trail of Bits audit of ezkl (January 2025, commit bdcba5c) reported 34 findings, 8 of high severity; three high-severity findings were circuit soundness issues, and all high-severity findings were resolved at the March 2025 fix review 6.
  • zkLLM (CCS 2024) uses sumcheck-based arguments, a parallel lookup argument (tlookup) for non-arithmetic tensor operations, an attention protocol (zkAttn) and Hyrax commitments over BLS12-381, with values scaled by 2^16. On one A100 40 GB GPU with 2,048-token inputs, LLaMa-2-13B needed 986 s for the one-time weight commitment, 803 s to prove, 188 kB of proof, 3.95 s to verify and 23.1 GB of memory. Perplexity on C4 moved from 6.520 to 6.528 1.
  • zkGPT (USENIX Security 2025) combines the GKR protocol, Lasso lookups and Hyrax commitments, and is made non-interactive with Fiat–Shamir. On a 16-core Xeon server with 200 GB of memory, it proved GPT-2 inference in 21.8 s with 32 threads, with a 101 KB proof verified in 0.35 s. Its code is archived on Zenodo 13.
  • NanoZK (ICICS 2026) proves each transformer layer separately with Halo2/IPA over the Pallas curve, uses 16-bit lookup tables for softmax, GELU and normalisation, and chains layer boundaries with SHA-256 commitments. It reports 3.2 to 3.7 KB per sub-circuit (attention or MLP) proof, about 83 KB in total for 12 layers. It measured full-block proofs on CPU up to width 128 and, assuming a GPU speedup, projects about 68 s per block at GPT-2 width, or about 14 minutes to prove a 12-layer GPT-2 sequentially 4.
  • Attestable reports a prover whose security rests only on hash functions, at 100-bit security, with 8-bit integer matrix multiplications. On one H100 it reports 4.35 to 7.92 MiB proofs, 157 to 648 ms CPU verification, and 53 tokens per second for one 16K-token sequence of a 31B Gemma model 8.

Sources

  1. AH. Sun et al. (2024). zkLLM: Zero Knowledge Proofs for Large Language Models. 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS 2024). Source recordSupports: zkLLM design, threat model, security theorems, overheads, fixed-point effects · abstract; §3.6; §4–5; §7.2 Theorems 7.3–7.4; §8 Table 1; §9
  2. BH. Sun (2024). zkllm-ccs2024: code for zkLLM: Zero Knowledge Proofs for Large Language Models. GitHub; archived on Zenodo. Source recordSupports: zkLLM code availability, artifact badges and README caveats · README; Zenodo record
  3. AB.-J. Chen et al. (2024). ZKML: An Optimizing System for ML Inference in Zero-Knowledge Proofs. 19th European Conference on Computer Systems (EuroSys 2024). Source recordSupports: ZKML design, halo2 backends, GPT-2 overheads, limitations · §3; §4.1; §4.4; §9 Tables 5–7
  4. AZ. Wang (2026). NanoZK: Privacy-Preserving Verifiable Inference for Large Language Models via Layerwise Zero-Knowledge Proofs. International Conference on Information and Communications Security (ICICS 2026). Source recordSupports: NanoZK layerwise proofs, threat model, proof sizes, partial audits · Definition 1; §5; §6; Table 8; App. A.4
  5. BT. South et al. (2024). Verifiable evaluations of machine learning models using zkSNARKs. arXiv. Source recordSupports: verifiable evaluation attestations with ezkl; public inputs and outputs; costs of small models · abstract; §5; §6.1 Table 1
  6. BF. Casal et al. (2025). Zkonduit EZKL Security Assessment. Trail of Bits (prepared for Zkonduit Inc.). Source recordSupports: independent audit of ezkl: circuit soundness findings, quantisation-activated backdoor, production use, fix review · Executive Summary; findings TOB-EZKL-4 to 6 and 17; App. D
  7. AZ. Peng et al. (2026). A Survey of Zero-Knowledge Proof Based Verifiable Machine Learning. Artificial Intelligence Review, vol. 59, no. 7, article 157. Source recordSupports: definition and categorisation of ZKML; main implementation bottlenecks · abstract; §III; Table VI
  8. CAttestable (2026). Proving LLMs at Scale. Attestable blog. Source recordSupports: Attestable's reported prover, statement proven, performance and limits (provider-reported)
  9. CAttestable (2026). Pacing AI Requires Proof. Attestable blog. Source recordSupports: Attestable's coverage argument and pacing proposal (provider-reported)
  10. CAttestable (2026). From Verifiability to Model-Weight Security. Attestable blog. Source recordSupports: Attestable's proposal to prove randomly sampled outputs (provider-reported)
  11. BN. Cankaya (2026). A System Overview for Near-Term, Low-Trust AI Compute Verification. Machine Intelligence Research Institute. Source recordSupports: ZKPs as a 'tentative plan B' in a verification system; overhead assessment; floating-point gap · §5.2.4
  12. BC. Gong et al. (2026). Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference. arXiv. Source recordSupports: independent Hollow-LLM analysis: proofs do not bind computational effort; ghost-weight constructions; zkGPT-based experiment and cost results; countermeasures · Abstract; §I contributions; §V Table 2; §VI
  13. AW. Qu et al. (2025). zkGPT: An Efficient Non-interactive Zero-knowledge Proof Framework for LLM Inference. 34th USENIX Security Symposium (USENIX Security 25), pp. 2045–2063. Source recordSupports: zkGPT design, non-interactive proofs, GPT-2 proving and verification figures, public code · abstract; §3; §6 Table 3
  14. CLagrange Labs (2025). DeepProve-1: The First zkML System to Prove a Full LLM Inference. Lagrange blog. Source recordSupports: Lagrange's reported proof of full GPT-2 inference and 'production-ready' description (provider-reported)
  15. BLagrange Labs (2026). Lagrange-Labs/deep-prove (GitHub repository). GitHub. Source recordSupports: DeepProve public code, licence and reported GPT-2 proving figures (provider-reported) · README

Search

Full search page