{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "I-0005",
    "slug": "attestable-zk-inference",
    "title": "Attestable zero-knowledge inference prover",
    "aliases": [
      "Attestable ZK prover"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second.",
    "summary": "Attestable, a company, reports a zero-knowledge prover for transformer inference. It would let an AI developer prove that an output came from a committed model, input and random seed without revealing the weights. On one NVIDIA H100 GPU, Attestable reports proving a 31-billion-parameter model at 53 tokens per second for one 16,000-token sequence, and 77 tokens per second across four 4,000-token sequences. It reports proofs of a few megabytes that a CPU verifies in under a second. It also proposes using such proofs to support verifiable limits on AI development. All evidence comes from the company's blog, and no paper, protocol specification or code is public, so the results cannot be checked. The company lists its own limits: a 16,000-token context, 8-bit integer matrix multiplications, and proofs that cover only the computation they are about.",
    "category": "cryptographic-computational",
    "secondary_categories": [],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Attestable reports proving y = F(W, x, r) for committed weights W."
      },
      {
        "claim": "C-0004",
        "role": "supporting",
        "note": "Proposed use: showing an accounted workload used an approved, unchanged model."
      },
      {
        "claim": "C-0006",
        "role": "supporting",
        "note": "Proposed use: showing an agreed input classifier was applied."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "none",
    "hardware_requirement": "none",
    "prover_cooperation": "required",
    "confidentiality": "preserving",
    "depends_on": [],
    "readiness": {
      "assessment": true,
      "level": "R1",
      "rubric_version": "1.0",
      "rationale": "R1: Attestable states the claim, its security basis and its limits, but has published no code, protocol description or artifact.\n\n- **R1** met: Attestable publicly states the claim proven (an output y = F(W, x, r) for committed weights W, input x and seed r), its security basis (hash functions only, 100-bit security) and its limits [[S-1101]]. It also states the verification uses it proposes [[S-1102]] [[S-1103]].\n- **R2** not met. The rubric excludes results that are claimed but not public or not reproducible, and Attestable's figures are published without code, a protocol description or an artifact [[S-1101]].",
      "evidence": [
        "S-1101",
        "S-1102",
        "S-1103"
      ],
      "next_level_gaps": [
        "A public working implementation, or reproducible published end-to-end results, such as a paper with a protocol specification and benchmarks others can rerun.",
        "Any independent security analysis of the proof system."
      ],
      "confidence": "low",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Proves an 8-bit quantised variant of the model",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "Attestable reports that matrix multiplications are dynamically quantised to 8-bit integers, while non-linear operations are proven in floating point. It reports that its IFEval result \"shows where the current quantization still needs improvement\" [[S-1101]]. The proven model is therefore a quantised variant, which a verifier must accept as the declared model.",
        "sources": [
          "S-1101"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "A proof covers only the computation it is about",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Attestable states that \"a proof of some computation is not a proof of all computation\" and that a proof \"cannot discover a datacenter that was never declared\" [[S-1102]].",
        "sources": [
          "S-1102"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "No paper, protocol specification or code is public, so the reported results cannot be reproduced.",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": [
          "S-1101"
        ]
      },
      {
        "text": "Attestable reports a context window limited to 16K tokens.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-1101"
        ]
      },
      {
        "text": "Covering computation that is not proven relies on proof-of-work accounting, which Attestable has only proposed.",
        "theme": "coverage-hidden-compute",
        "blocked_by": "M-0007",
        "sources": [
          "S-1102"
        ]
      }
    ],
    "challenge_themes": [
      "adversarial-validation",
      "coverage-hidden-compute",
      "performance-compatibility"
    ],
    "organizations": [
      "O-0120"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-1101",
        "supports": "statement proven, security basis, performance figures, limitations (provider-reported)"
      },
      {
        "source": "S-1102",
        "supports": "proposed verification uses and proof-of-work accounting; coverage argument (provider-reported)"
      },
      {
        "source": "S-1103",
        "supports": "verification-firewall proposal with random sampling of outputs; stated threats (provider-reported)"
      }
    ],
    "concepts": [
      "K-0010",
      "K-0024",
      "K-0020"
    ],
    "kind": "product",
    "developer": [
      "O-0120"
    ],
    "realises": [
      "M-0004"
    ],
    "homepage": "https://attestable.com/",
    "type": "implementation",
    "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/",
    "source_file": "content/implementations/attestable-zk-inference.md",
    "flags_all": [
      "provider-reported",
      "ai-drafted"
    ],
    "body_markdown": "## What it is\n\nIn an August 2026 blog post, the company Attestable ([[O-0120]]) reports a prover for [[M-0004|zero-knowledge proofs of inference]] on \"production-scale transformer inference\" [[S-1101]]. The post links no paper, code or technical documentation [[S-1101]].\n\nAttestable reports that a proof \"can establish that a committed model produced a specific output from a specific input, without revealing the model's weights or other private information\" [[S-1101]].\n\n## How it works\n\n**The statement proven.** Attestable writes the proven statement as y = F(W, x, r), where:\n- F is the model;\n- W is the committed weights;\n- x is the input;\n- r is a random seed;\n- y is the output [[S-1101]].\n\nThe proof can also bind the model configuration, the decoding parameters and \"other policy-relevant values\" [[S-1101]]. A standalone CPU verifier checks it without the weights and without rerunning the model [[S-1101]].\n\n**Security basis.** Attestable reports that its results rest \"only on the security of cryptographic hash functions\" [[S-1101]]. It claims 100-bit security and post-quantum security [[S-1101]].\n\n**Arithmetic.** Matrix multiplications are dynamically quantised to 8-bit integers, and non-linear operations are proven in floating point [[S-1101]]. The post does not name the proof system [[S-1101]].\n\n**Proposed uses.** Attestable proposes two ways to deploy the prover:\n- **A verification firewall** at the external interfaces of an environment that holds model weights. It would select outputs for proof at random. The selection \"must remain unpredictable to the datacenter\" and happen only after each output is committed [[S-1103]]. Attestable describes its solution as \"already practical today\" [[S-1103]].\n- **Support for pacing agreements.** An auditor \"could verify that an accounted workload used an approved, unchanged model rather than a newly trained replacement\". Where an input classifier is required, a proof could show that the agreed classifier accepted the input [[S-1102]].\n\n## Evidence\nAll results come from Attestable's own blog. Attestable reports these figures on a single NVIDIA H100 GPU:\n- **Proofs.** Proof sizes range from 4.35 to 7.92 MiB, and CPU verification takes 157 to 648 milliseconds [[S-1101]].\n- **Throughput.** For a 31-billion-parameter Gemma model, it reports proving 53 tokens per second for one 16K-token sequence, and 77 tokens per second across four 4K-token sequences [[S-1101]].\n- **Accuracy.** It reports that its quantisation preserved performance on the GPQA Diamond reasoning benchmark better than a standard INT8 baseline [[S-1101]].\n- **Comparison.** It sets these figures against an ezkl result from the end of 2023: 16 minutes to prove a 1-million-parameter model on a CPU [[S-1101]].\n\nAs of September 2026 no independent reproduction of these results has been published.\n\n## Limitations\nAttestable lists its current limits:\n- a context window of up to 16K tokens;\n- matrix multiplications quantised to 8-bit integers [[S-1101]].\n\nIt reports that its IFEval result \"shows where the current quantization still needs improvement\" [[S-1101]].\n\nOn coverage, Attestable writes that \"a proof of some computation is not a proof of all computation\" [[S-1102]]. It proposes pairing inference proofs with [[M-0007|proof-of-work accounting]], which would need \"a credible estimate of the compute available\" to the actor [[S-1102]].\n\nFor the firewall proposal, Attestable lists threats that the proofs do not address:\n- physical attacks, such as probing memory buses;\n- leakage through timing, packet sizes, power and proof-generation latency [[S-1103]].\n\nAs of September 2026 the protocol is unpublished, and no attack on it or security analysis of it has been published.",
    "body_text": "What it is In an August 2026 blog post, the company Attestable (Attestable) reports a prover for zero-knowledge proofs of inference on \"production-scale transformer inference\" [S-1101]. The post links no paper, code or technical documentation [S-1101]. Attestable reports that a proof \"can establish that a committed model produced a specific output from a specific input, without revealing the model's weights or other private information\" [S-1101]. How it works The statement proven. Attestable writes the proven statement as y = F(W, x, r), where: - F is the model; - W is the committed weights; - x is the input; - r is a random seed; - y is the output [S-1101]. The proof can also bind the model configuration, the decoding parameters and \"other policy-relevant values\" [S-1101]. A standalone CPU verifier checks it without the weights and without rerunning the model [S-1101]. Security basis. Attestable reports that its results rest \"only on the security of cryptographic hash functions\" [S-1101]. It claims 100-bit security and post-quantum security [S-1101]. Arithmetic. Matrix multiplications are dynamically quantised to 8-bit integers, and non-linear operations are proven in floating point [S-1101]. The post does not name the proof system [S-1101]. Proposed uses. Attestable proposes two ways to deploy the prover: - A verification firewall at the external interfaces of an environment that holds model weights. It would select outputs for proof at random. The selection \"must remain unpredictable to the datacenter\" and happen only after each output is committed [S-1103]. Attestable describes its solution as \"already practical today\" [S-1103]. - Support for pacing agreements. An auditor \"could verify that an accounted workload used an approved, unchanged model rather than a newly trained replacement\". Where an input classifier is required, a proof could show that the agreed classifier accepted the input [S-1102]. Evidence All results come from Attestable's own blog. Attestable reports these figures on a single NVIDIA H100 GPU: - Proofs. Proof sizes range from 4.35 to 7.92 MiB, and CPU verification takes 157 to 648 milliseconds [S-1101]. - Throughput. For a 31-billion-parameter Gemma model, it reports proving 53 tokens per second for one 16K-token sequence, and 77 tokens per second across four 4K-token sequences [S-1101]. - Accuracy. It reports that its quantisation preserved performance on the GPQA Diamond reasoning benchmark better than a standard INT8 baseline [S-1101]. - Comparison. It sets these figures against an ezkl result from the end of 2023: 16 minutes to prove a 1-million-parameter model on a CPU [S-1101]. As of September 2026 no independent reproduction of these results has been published. Limitations Attestable lists its current limits: - a context window of up to 16K tokens; - matrix multiplications quantised to 8-bit integers [S-1101]. It reports that its IFEval result \"shows where the current quantization still needs improvement\" [S-1101]. On coverage, Attestable writes that \"a proof of some computation is not a proof of all computation\" [S-1102]. It proposes pairing inference proofs with proof-of-work accounting, which would need \"a credible estimate of the compute available\" to the actor [S-1102]. For the firewall proposal, Attestable lists threats that the proofs do not address: - physical attacks, such as probing memory buses; - leakage through timing, packet sizes, power and proof-generation latency [S-1103]. As of September 2026 the protocol is unpublished, and no attack on it or security analysis of it has been published.",
    "referenced_by": [
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "O-0120",
        "title": "Attestable",
        "url": "https://trustbutveri.fyi/organizations/attestable/"
      }
    ]
  }
}