{
  "schema_version": "1.0.0",
  "rubric_version": "1.1",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "I-0014",
    "slug": "ezkl",
    "title": "EZKL",
    "aliases": [
      "ezkl",
      "Easy Zero-Knowledge Inference"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-24",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [],
    "one_liner": "EZKL is a library from Zkonduit that turns neural networks into zero-knowledge circuits, so a prover can show an output came from a committed model.",
    "summary": "EZKL is a library and command-line tool, developed by the company Zkonduit, for proving neural-network inference in zero knowledge. It compiles a model exported in the ONNX format into a halo2 circuit, quantizing its values, so a prover can show that a model produced an output without revealing whichever of the model or the data is private. Its source code is public. A Trail of Bits audit in 2025 found proof-forgery bugs in its circuits and smart contracts, and all the high-severity ones were fixed. Other projects use its verifier contracts in production. Its main limit for AI verification is scale: the largest language model in South et al.'s published results is a 250,000-parameter nanoGPT, which took 46 minutes to prove with a 219 GB proving key. Quantization also leaves a gap between the proven circuit and the full-precision model.",
    "category": "cryptographic-computational",
    "secondary_categories": [],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Proves an output follows from a committed model. South et al.'s results reach about a million parameters (S-0024)."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "independent-red-team",
    "hardware_requirement": "none",
    "prover_cooperation": "required",
    "confidentiality": "partial",
    "depends_on": [],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.1",
      "rationale": "R2. Public, independently audited code proves small models against a cheating prover, but its published results stop far below the size of the language models that verification claims concern.\n\n- **R1** met: the claim is that a stated model produced an output from a stated input, with either kept private [[S-1806]]. South et al. set out its use for verifiable evaluations of models with private weights [[S-0024]].\n- **R2** met: the code is public [[S-1806]]. The stated adversary is a prover who tries to convince a verifier of an incorrect result, and an independent audit tested for exactly that [[S-0070]]. South et al. report end-to-end proofs for models of up to about a million parameters [[S-0024]].\n- **R3** not met for this use, which is checking that a served language model is the declared one. The library is public and versioned [[S-1806]], and Trail of Bits reports that other projects use its attestation and verifier contracts in production [[S-0070]]. No source says what those projects prove, and no party is documented relying on EZKL to verify a language model's outputs. The largest language model South et al. prove with it has 250,000 parameters [[S-0024]], far below the models that claims about served AI concern. This matches the assessment of [[M-0004]].\n- **R4** not met, because R3 is not. Trail of Bits' 2025 audit would otherwise count: at its fix review no high-severity finding remained unresolved [[S-0070]].",
      "evidence": [
        "S-1806",
        "S-0024",
        "S-0070"
      ],
      "next_level_gaps": [
        "A production-grade release that proves language models at the scale verification claims concern, or reliance by another party on such proofs for a verification decision."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-24",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Circuit and contract bugs allowed forged proofs",
        "kind": "demonstrated-attack",
        "severity": "critical",
        "status": "mitigated",
        "description": "Trail of Bits found three high-severity soundness bugs in EZKL's circuits: an unsound shuffle argument for min, max and top-k, a decomposition that did not fix the sign of zero, and missing range checks for division and reciprocals. Each would let a malicious prover convince a verifier of incorrect calculations, for example that [1,1,1] is a valid permutation of [1,2,3]. It also found four ways to bypass the data attestation and KZG commitments in EZKL's smart contracts. All were resolved at the March 2025 fix review. Some fixes were first made in private repositories, to allow disclosure to projects using the contracts in production [[S-0070]].",
        "sources": [
          "S-0070"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Quantization can activate a backdoor dormant in the full-precision model",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "open",
        "description": "EZKL quantizes values to represent them in a finite field. Trail of Bits built a ResNet-18 whose backdoor is dormant at full precision and active after EZKL's quantization. Larger models and smaller quantization scales make the attack easier. Whether the backdoor persists through the witness and proof stages was left for further investigation. The fix was documentation of the risk [[S-0070]].",
        "sources": [
          "S-0070"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Proving cost grows steeply with model size: a 250,000-parameter nanoGPT took 2,781 s to prove and needed a 219 GB proving key, which South et al. name as the main limit on model size.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-0024"
        ]
      }
    ],
    "challenge_themes": [
      "performance-compatibility",
      "adversarial-validation",
      "evidence-binding"
    ],
    "organizations": [],
    "people": [],
    "sources": [
      {
        "source": "S-1806",
        "supports": "what EZKL proves, ONNX input, halo2 backend, quantization note, maintainer (provider-reported)",
        "locator": "README"
      },
      {
        "source": "S-0024",
        "supports": "verifiable evaluation attestations with EZKL; model sizes, proving and verification times, proving-key sizes; proving key as the main limit",
        "locator": "abstract; §6.1 Table 1"
      },
      {
        "source": "S-0070",
        "supports": "independent audit: scope, soundness and contract findings, quantization backdoor, coverage limits, production use of the contracts, fix review",
        "locator": "Executive Summary; Project Coverage; TOB-EZKL-4 to 6, 13 to 17, 34; App. D"
      }
    ],
    "concepts": [
      "K-0010",
      "K-0024",
      "K-0001",
      "K-0002"
    ],
    "kind": "product",
    "developer": [],
    "realises": [
      "M-0004"
    ],
    "homepage": "https://docs.ezkl.xyz/",
    "repo": "https://github.com/zkonduit/ezkl",
    "type": "implementation",
    "url": "https://trustbutveri.fyi/implementations/ezkl/",
    "source_file": "content/implementations/ezkl.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "## What it is\n\nEZKL (\"Easy Zero-Knowledge Inference\") is a library and command-line tool for proving neural-network inference in zero knowledge, developed by Zkonduit [[S-1806]]. It supports statements such as \"I ran this publicly available neural network on some private data and it produced this output\", and the converse with a private model and public data [[S-1806]]. It implements [[M-0004|zero-knowledge proofs of inference]].\n\n## How it works\n\nEZKL takes a model exported in the ONNX format, for example from PyTorch or TensorFlow, and turns it into a circuit for the halo2 proof system [[S-1806]]. Operations are quantized on the way, so EZKL's outputs can differ slightly from the original model's [[S-1806]]. A verifier checks the resulting proof natively or through a smart contract on a blockchain [[S-0070]].\n\nSouth et al. use EZKL to bundle proofs over a dataset into an attestation that a model with fixed private weights reaches a stated score on public inputs [[S-0024]].\n\n## Evidence\n- South et al., whose authors include two from EZKL, report proofs for eight models, from a 30-parameter linear regression to a 1.07-million-parameter VAE decoder [[S-0024]]. A 250,000-parameter nanoGPT took 2,781 s to prove and 2.69 s to verify, with a 219 GB proving key [[S-0024]].\n- Trail of Bits reviewed EZKL and its verifier contracts for Zkonduit in January 2025, with 11 engineer-weeks of effort [[S-0070]]. It reported 34 findings, 8 of high severity, including circuit soundness bugs and ways to bypass data attestation. At its March 2025 fix review every high-severity finding was resolved [[S-0070]].\n- Trail of Bits reports that other projects use EZKL's attestation and verifier contracts in production [[S-0070]].\n\n## Limitations\n- South et al. write that proof time and resource requirements \"grow dramatically with large models\", and that the proving key's size limits model size [[S-0024]].\n- The proof covers the quantized circuit. Trail of Bits showed that quantization can activate a backdoor that is dormant in the full-precision model [[S-0070]].\n- The audit did not fully review several higher-level operations, such as einsum and scatter_nd, or all of the command-line tools [[S-0070]].\n- Limits common to proofs of inference, such as proofs that do not bind the computation spent, are covered in [[M-0004]].",
    "body_text": "What it is EZKL (\"Easy Zero-Knowledge Inference\") is a library and command-line tool for proving neural-network inference in zero knowledge, developed by Zkonduit [S-1806]. It supports statements such as \"I ran this publicly available neural network on some private data and it produced this output\", and the converse with a private model and public data [S-1806]. It implements zero-knowledge proofs of inference. How it works EZKL takes a model exported in the ONNX format, for example from PyTorch or TensorFlow, and turns it into a circuit for the halo2 proof system [S-1806]. Operations are quantized on the way, so EZKL's outputs can differ slightly from the original model's [S-1806]. A verifier checks the resulting proof natively or through a smart contract on a blockchain [S-0070]. South et al. use EZKL to bundle proofs over a dataset into an attestation that a model with fixed private weights reaches a stated score on public inputs [S-0024]. Evidence - South et al., whose authors include two from EZKL, report proofs for eight models, from a 30-parameter linear regression to a 1.07-million-parameter VAE decoder [S-0024]. A 250,000-parameter nanoGPT took 2,781 s to prove and 2.69 s to verify, with a 219 GB proving key [S-0024]. - Trail of Bits reviewed EZKL and its verifier contracts for Zkonduit in January 2025, with 11 engineer-weeks of effort [S-0070]. It reported 34 findings, 8 of high severity, including circuit soundness bugs and ways to bypass data attestation. At its March 2025 fix review every high-severity finding was resolved [S-0070]. - Trail of Bits reports that other projects use EZKL's attestation and verifier contracts in production [S-0070]. Limitations - South et al. write that proof time and resource requirements \"grow dramatically with large models\", and that the proving key's size limits model size [S-0024]. - The proof covers the quantized circuit. Trail of Bits showed that quantization can activate a backdoor that is dormant in the full-precision model [S-0070]. - The audit did not fully review several higher-level operations, such as einsum and scatternd, or all of the command-line tools [S-0070]. - Limits common to proofs of inference, such as proofs that do not bind the computation spent, are covered in Zero-knowledge proofs of inference.",
    "referenced_by": [
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      }
    ]
  }
}