{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "I-0003",
    "slug": "zkllm",
    "title": "zkLLM",
    "aliases": [
      "zkLLM-CCS2024"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights.",
    "summary": "zkLLM is an academic zero-knowledge proof system for large language models, published at ACM CCS 2024. It lets a model's owner prove that its committed model computed an output, without revealing the weights. The verifier supplies the prompt and sees the output. On one NVIDIA A100 GPU, zkLLM proved one 2,048-token forward pass of LLaMa-2-13B in about 13 minutes. The 188 kB proof verifies in about four seconds. The code is public and passed the conference's artifact evaluation. The main obstacles to real use are cost and engineering maturity. Its authors state the code is unaudited, not ready for industrial use and no longer maintained. For verification, the main weakness is that it proves a fixed-point approximation of a model whose architecture must be public. Its zero-knowledge guarantee also assumes a verifier that follows the protocol.",
    "technical": "The design has four parts [[S-0023]]:\n\n- tlookup is a parallel lookup argument for non-arithmetic tensor operations. The authors state it adds no asymptotic overhead in memory or running time (§4).\n- zkAttn proves softmax attention by splitting the exponentiation into K segments, each checked with tlookup (§5).\n- The commitments use Hyrax, a Pedersen variant, over BLS12-381 under discrete-log hardness (§3).\n- Tensors are scaled by 2^16 and rounded into the field. The resulting total L1 error on the output is about 10^-2 (§7–8).\n\nThe paper's security analysis is in §7.2 [[S-0023]]:\n\n- Theorems 7.2 and 7.3 give tlookup a completeness error of O(N/|F|). They show that a cheating probabilistic polynomial-time prover succeeds only with negligible probability. The rest of the protocol applies the sumcheck protocol and proofs of opening for committed tensors.\n- Theorem 7.4 covers zero knowledge. It states that a simulator with only oracle access to the output produces a view indistinguishable from the real one. The theorem assumes zero-knowledge variants of sumcheck and Pedersen commitments. The threat model assumes a semi-honest verifier (§3.6).\n\nTable 1 reports these costs on an A100 40 GB GPU at sequence length 2,048 [[S-0023]]:\n\n- **OPT-13B** took 1,270 s to commit and 713 s to prove. The proof was 160 kB, verified in 3.71 s and used 22.9 GB of memory.\n- **LLaMa-2-13B** took 986 s to commit and 803 s to prove. The proof was 188 kB, verified in 3.95 s and used 23.1 GB of memory.\n\nThe public code covers LLaMa-2 7B and 13B, runs prover and verifier side by side, and is interactive [[S-1108]].",
    "category": "cryptographic-computational",
    "secondary_categories": [],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Proves an output follows from committed weights and a public architecture."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "analysis",
    "hardware_requirement": "none",
    "prover_cooperation": "required",
    "confidentiality": "partial",
    "depends_on": [],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.0",
      "rationale": "R2. Public, artifact-evaluated code proves 13-billion-parameter models in peer-reviewed tests, but its authors say it is unaudited and not ready for production.\n\n- **R1** met: the paper states the claim, the threat model and the security theorems [[S-0023]].\n- **R2** met: the code is public, tagged and archived on Zenodo. It received the CCS 2024 badges \"Artifacts Available\" and \"Artifacts Evaluated--Functional\" [[S-1108]]. The published end-to-end results use 13-billion-parameter models on a data-centre GPU [[S-0023]]. The stated adversary is a cheating polynomial-time prover [[S-0023]].\n- **R3** not met. The README says the code \"has NOT undergone security auditing and is NOT ready for industrial applications\", and that it is no longer maintained [[S-1108]]. As of September 2026 no third party is known to rely on it, and no independent security evaluation or reproduction of its results has been published.",
      "evidence": [
        "S-0023",
        "S-1108"
      ],
      "next_level_gaps": [
        "A production-grade implementation, with prover and verifier separated and non-interactive proofs, or reliance by a third party for a verification decision.",
        "An independent public security evaluation (audit, red-team or third-party peer-reviewed analysis)."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Reference code is interactive and runs prover and verifier together",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "The README states that prover and verifier work \"are implemented side-by-side\", and that intermediate values written to files are for the prover's reference only. It says an industrial deployment would need to separate the two and apply Fiat–Shamir to make proofs non-interactive [[S-1108]]. The released code gives a verifier no standalone check.",
        "sources": [
          "S-1108"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Proves a fixed-point approximation of a publicly known architecture",
        "kind": "theoretical-argument",
        "severity": "minor",
        "status": "open",
        "description": "The prover's model must have a \"publicly known structure\". Tensors are discretised by scaling and rounding [[S-0023]]. The authors report perplexity changes of 0.008 to 0.09 on C4 [[S-0023]]. The proof covers the quantised computation.",
        "sources": [
          "S-0023"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Proving takes about 12 to 13 minutes of A100 time per 2,048-token forward pass at 13B parameters, plus a one-time weight commitment of 16 to 21 minutes.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-0023"
        ]
      },
      {
        "text": "The repository was archived on 10 July 2025 and the author states there is no plan for upgrades or maintenance.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-1108"
        ]
      },
      {
        "text": "No security audit of the code has been carried out.",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": [
          "S-1108"
        ]
      }
    ],
    "challenge_themes": [
      "performance-compatibility",
      "adversarial-validation",
      "privacy-leakage"
    ],
    "organizations": [
      "O-0122"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-0023",
        "supports": "design, threat model, security theorems, overheads, accuracy, comparison with zkML",
        "locator": "abstract; §3.6; §4; §5; §7; §8 Table 1 and Fig. 4; §9"
      },
      {
        "source": "S-1108",
        "supports": "public code, artifact badges, supported models, README caveats, archive status",
        "locator": "README; Zenodo record 13621754"
      },
      {
        "source": "S-0018",
        "supports": "use of zkLLM's figures in a verification system design",
        "locator": "§5.2.4, pp. 59–60"
      },
      {
        "source": "S-1112",
        "supports": "independent Hollow-LLM analysis: valid proofs in zkLLM-style deployments do not bind computational effort; demonstrated with zkGPT",
        "locator": "Abstract; threat model; §V"
      }
    ],
    "concepts": [
      "K-0010",
      "K-0024",
      "K-0001",
      "K-0002"
    ],
    "kind": "research-prototype",
    "developer": [
      "O-0122"
    ],
    "realises": [
      "M-0004"
    ],
    "repo": "https://github.com/jvhs0706/zkllm-ccs2024",
    "type": "implementation",
    "url": "https://trustbutveri.fyi/implementations/zkllm/",
    "source_file": "content/implementations/zkllm.md",
    "flags_all": [
      "provider-reported",
      "ai-drafted"
    ],
    "body_markdown": "## What it is\n\nzkLLM is a system for [[M-0004|zero-knowledge proofs of inference]] on large language models. Researchers at the University of Waterloo published it at ACM CCS 2024 [[S-0023]] [[S-1108]]. Its authors call it \"the inaugural specialized zero-knowledge proof tailored for LLMs\" [[S-0023]].\n\nThe setting has two parties [[S-0023]]:\n- **The prover**, such as an AI company, owns a model with a publicly known structure and treats the weights as intellectual property.\n- **The verifier**, such as a regulator, submits a prompt and asks for proof that the output returned is correct for that prompt and the confidential model.\n\nThe CUDA implementation is public under an MIT license [[S-1108]]. A tagged release, archived on Zenodo, received artifact-evaluation badges [[S-1108]].\n\n## How it works\n\nThe weights are committed once, using Hyrax commitments over the BLS12-381 curve [[S-0023]]. For each prompt, the prover shows that the model's tensor operations were computed correctly, using sumcheck-based arguments [[S-0023]].\n\nTwo new components handle the hard parts of a transformer:\n- **tlookup** is a parallel lookup argument for non-arithmetic tensor operations. The authors state it adds no asymptotic overhead in memory or running time [[S-0023]].\n- **zkAttn** is a proof for softmax attention. It splits the exponential into segments, each checked by lookups [[S-0023]].\n\nAll values are scaled by 2^16 and rounded into a finite field [[S-0023]].\n\nThe public code works through a LLaMa-2 model one layer at a time:\n1. Generate public parameters.\n2. Commit the weights.\n3. Run the proofs for normalisation, attention and feed-forward components [[S-1108]].\n\nIt supports LLaMa-2 models of 7 and 13 billion parameters [[S-1108]].\n\n## Evidence\n- **Setup.** The paper reports results on one NVIDIA A100 GPU with 40 GB of memory, 12 CPU cores and 124.5 GB of system memory [[S-0023]]. The models were OPT (125M to 13B) and LLaMa-2 (7B and 13B), run on 2,048-token samples from C4 [[S-0023]].\n- **LLaMa-2-13B.** Proving took 803 seconds and produced a 188 kB proof that verified in 3.95 seconds, using 23.1 GB of memory; the one-time weight commitment took 986 seconds [[S-0023]].\n- **Accuracy.** Perplexity changed little: for LLaMa-2-13B it moved from 6.520 to 6.528 [[S-0023]].\n- **Comparison.** The authors compare zkLLM with an earlier system, zkML, on the same hardware [[S-0023]]. zkML ran out of memory beyond the size of GPT-2 (1.5 billion parameters), so its times for larger models are the authors' estimates [[S-0023]].\n- **Artifact evaluation.** The artifact received the CCS 2024 badges \"Artifacts Available\" and \"Artifacts Evaluated--Functional\" [[S-1108]].\n- **Use by others.** A verification system design for AI agreements uses zkLLM's figure of 803 seconds per 2,048-token forward pass on an A100 to judge ZKP overheads [[S-0018]].\n\n## Limitations\n**Code maturity.** The README states the code \"has NOT undergone security auditing and is NOT ready for industrial applications\" [[S-1108]]. It also names these gaps:\n- prover and verifier run side by side;\n- intermediate files are not meant as verifier inputs;\n- an industrial deployment would need to separate the two parties and apply Fiat–Shamir [[S-1108]].\n\n**Maintenance.** The repository was archived in July 2025 [[S-1108]]. The author states the project is no longer actively maintained [[S-1108]].\n\n**Assumptions.** The paper assumes a publicly known model structure [[S-0023]]. Its zero-knowledge guarantee is stated for a semi-honest verifier, which \"accurately reports the outcome of the proof verification\" but tries to learn the hidden parameters [[S-0023]].\n\n**Scope.** Proofs cover inference only [[S-0023]]. The authors write that extending zero-knowledge proofs to training LLMs \"may pose insurmountable challenges\" [[S-0023]].\n\n**Attacks.** As of September 2026 no attack on the soundness of zkLLM's proofs has been published. Its security rests on the paper's soundness and zero-knowledge theorems [[S-0023]]. An independent analysis, whose setting follows deployments such as zkLLM, shows that valid proofs do not bind the computation spent, so a much smaller model can pass as the declared one [[S-1112]]. Its authors demonstrated this with another system, zkGPT, on a small transformer [[S-1112]]. See [[M-0004]].",
    "body_text": "What it is zkLLM is a system for zero-knowledge proofs of inference on large language models. Researchers at the University of Waterloo published it at ACM CCS 2024 [S-0023] [S-1108]. Its authors call it \"the inaugural specialized zero-knowledge proof tailored for LLMs\" [S-0023]. The setting has two parties [S-0023]: - The prover, such as an AI company, owns a model with a publicly known structure and treats the weights as intellectual property. - The verifier, such as a regulator, submits a prompt and asks for proof that the output returned is correct for that prompt and the confidential model. The CUDA implementation is public under an MIT license [S-1108]. A tagged release, archived on Zenodo, received artifact-evaluation badges [S-1108]. How it works The weights are committed once, using Hyrax commitments over the BLS12-381 curve [S-0023]. For each prompt, the prover shows that the model's tensor operations were computed correctly, using sumcheck-based arguments [S-0023]. Two new components handle the hard parts of a transformer: - tlookup is a parallel lookup argument for non-arithmetic tensor operations. The authors state it adds no asymptotic overhead in memory or running time [S-0023]. - zkAttn is a proof for softmax attention. It splits the exponential into segments, each checked by lookups [S-0023]. All values are scaled by 2^16 and rounded into a finite field [S-0023]. The public code works through a LLaMa-2 model one layer at a time: 1. Generate public parameters. 2. Commit the weights. 3. Run the proofs for normalisation, attention and feed-forward components [S-1108]. It supports LLaMa-2 models of 7 and 13 billion parameters [S-1108]. Evidence - Setup. The paper reports results on one NVIDIA A100 GPU with 40 GB of memory, 12 CPU cores and 124.5 GB of system memory [S-0023]. The models were OPT (125M to 13B) and LLaMa-2 (7B and 13B), run on 2,048-token samples from C4 [S-0023]. - LLaMa-2-13B. Proving took 803 seconds and produced a 188 kB proof that verified in 3.95 seconds, using 23.1 GB of memory; the one-time weight commitment took 986 seconds [S-0023]. - Accuracy. Perplexity changed little: for LLaMa-2-13B it moved from 6.520 to 6.528 [S-0023]. - Comparison. The authors compare zkLLM with an earlier system, zkML, on the same hardware [S-0023]. zkML ran out of memory beyond the size of GPT-2 (1.5 billion parameters), so its times for larger models are the authors' estimates [S-0023]. - Artifact evaluation. The artifact received the CCS 2024 badges \"Artifacts Available\" and \"Artifacts Evaluated--Functional\" [S-1108]. - Use by others. A verification system design for AI agreements uses zkLLM's figure of 803 seconds per 2,048-token forward pass on an A100 to judge ZKP overheads [S-0018]. Limitations Code maturity. The README states the code \"has NOT undergone security auditing and is NOT ready for industrial applications\" [S-1108]. It also names these gaps: - prover and verifier run side by side; - intermediate files are not meant as verifier inputs; - an industrial deployment would need to separate the two parties and apply Fiat–Shamir [S-1108]. Maintenance. The repository was archived in July 2025 [S-1108]. The author states the project is no longer actively maintained [S-1108]. Assumptions. The paper assumes a publicly known model structure [S-0023]. Its zero-knowledge guarantee is stated for a semi-honest verifier, which \"accurately reports the outcome of the proof verification\" but tries to learn the hidden parameters [S-0023]. Scope. Proofs cover inference only [S-0023]. The authors write that extending zero-knowledge proofs to training LLMs \"may pose insurmountable challenges\" [S-0023]. Attacks. As of September 2026 no attack on the soundness of zkLLM's proofs has been published. Its security rests on the paper's soundness and zero-knowledge theorems [S-0023]. An independent analysis, whose setting follows deployments such as zkLLM, shows that valid proofs do not bind the computation spent, so a much smaller model can pass as the declared one [S-1112]. Its authors demonstrated this with another system, zkGPT, on a small transformer [S-1112]. See Zero-knowledge proofs of inference.",
    "referenced_by": [
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "C-0005",
        "title": "The declared model is the one being served",
        "url": "https://trustbutveri.fyi/claims/declared-model-is-served/"
      },
      {
        "id": "O-0122",
        "title": "University of Waterloo",
        "url": "https://trustbutveri.fyi/organizations/university-of-waterloo/"
      }
    ]
  }
}