{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "M-0004",
    "slug": "zk-proofs-of-inference",
    "title": "Zero-knowledge proofs of inference",
    "aliases": [
      "ZKML inference proofs",
      "verifiable inference with zkSNARKs"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [],
    "one_liner": "A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.",
    "summary": "Zero-knowledge proofs of inference let an AI developer show that an output was computed by a model it committed to in advance, on a given input, without disclosing the weights. A verifier checks a small proof in seconds instead of rerunning the model. The peer-reviewed system zkLLM proved one 2,048-token forward pass of a 13-billion-parameter model in about 13 minutes on one A100 GPU, and its code is public. A company, Attestable, reports proving a 31-billion-parameter model at 53 tokens per second on one H100, but has published no paper or code. The main obstacle is cost. The main weaknesses are coverage and fidelity: a proof covers only the computation proven, and that computation is a fixed-point approximation of the model. An independent audit of one proving library, ezkl, found high-severity soundness bugs, since fixed.",
    "technical": "Systems encode a network as an arithmetic circuit, or as sumcheck and lookup relations, over a finite field, with tensors scaled to fixed point [[S-0021]] [[S-0023]].\n\n- **ZKML (EuroSys 2024)** compiles models to halo2 circuits with KZG commitments (trusted setup) or IPA commitments (transparent), and optimises circuit layout. A distilled GPT-2 (81.3M parameters) took 3,651.67 s to prove with KZG, 18.70 s to verify and a 28,128-byte proof on a 128-vCPU, 1 TB machine [[S-0021]].\n- **ezkl** also targets halo2 with KZG. South et al. proved a 250,000-parameter nanoGPT in 2,781 s, verified it in 2.69 s and needed a 219 GB proving key [[S-0024]]. A Trail of Bits audit of ezkl (January 2025, commit bdcba5c) reported 34 findings, 8 of high severity; three high-severity findings were circuit soundness issues, and all high-severity findings were resolved at the March 2025 fix review [[S-0070]].\n- **zkLLM (CCS 2024)** uses sumcheck-based arguments, a parallel lookup argument (tlookup) for non-arithmetic tensor operations, an attention protocol (zkAttn) and Hyrax commitments over BLS12-381, with values scaled by 2^16. On one A100 40 GB GPU with 2,048-token inputs, LLaMa-2-13B needed 986 s for the one-time weight commitment, 803 s to prove, 188 kB of proof, 3.95 s to verify and 23.1 GB of memory. Perplexity on C4 moved from 6.520 to 6.528 [[S-0023]].\n- **NanoZK (ICICS 2026)** proves each transformer layer separately with Halo2/IPA over the Pallas curve, uses 16-bit lookup tables for softmax, GELU and normalisation, and chains layer boundaries with SHA-256 commitments. It reports 3.2 to 3.7 KB per sub-circuit (attention or MLP) proof, about 83 KB in total for 12 layers. From per-component timings it projects about 14 minutes to prove a 12-layer GPT-2 sequentially on CPU [[S-0068]].\n- **Attestable** reports a prover whose security rests only on hash functions, at 100-bit security, with 8-bit integer matrix multiplications. On one H100 it reports 4.35 to 7.92 MiB proofs, 157 to 648 ms CPU verification, and 53 tokens per second for one 16K-token sequence of a 31B Gemma model [[S-1101]].",
    "category": "cryptographic-computational",
    "secondary_categories": [],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Binds each proven output to committed weights and a public architecture."
      },
      {
        "claim": "C-0004",
        "role": "supporting",
        "note": "Attestable proposes using proofs to show accounted workloads used an approved, unchanged model."
      },
      {
        "claim": "C-0006",
        "role": "supporting",
        "note": "Attestable proposes that a proof could show an agreed input classifier was applied; South et al. prove evaluation results."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "analysis",
    "hardware_requirement": "none",
    "prover_cooperation": "required",
    "confidentiality": "partial",
    "depends_on": [],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.0",
      "rationale": "R2 through [[I-0003|zkLLM]], which has public, artifact-evaluated code and peer-reviewed results at 13 billion parameters; no implementation is yet production-grade for language models.\n\n- **R1** met: ZKML, zkLLM and NanoZK describe the claim (an output equals the committed model applied to an input) and their assumptions [[S-0021]] [[S-0023]] [[S-0068]].\n- **R2** met through zkLLM. Its code is public and received CCS 2024 artifact-evaluation badges [[S-1108]]. Its published end-to-end results use a 13-billion-parameter model on a data-centre GPU, against a stated adversary: a cheating polynomial-time prover [[S-0023]].\n- **R3** not met. Criterion (a) fails for this use. zkLLM's README says the code is not ready for industrial applications [[S-1108]]. Attestable's results come without public code, paper or reproducible artifacts [[S-1101]]. The ezkl library is public, and other projects use its verifier contracts in production [[S-0070]]. The language model South et al. prove with ezkl is a 250,000-parameter nanoGPT, and the largest model in their results is a VAE decoder of about 1.07 million parameters [[S-0024]]. Both are far below the scale this use concerns. Criterion (b) is met only for ezkl, whose 2025 audit left no high-severity finding unresolved [[S-0070]]. As of September 2026 no independent audit or red-team of zkLLM has been published. One independent analysis, tested on a small transformer, shows that valid proofs of LLM inference do not bind the computation spent, so a much smaller model can pass as the declared one [[S-1112]].",
      "evidence": [
        "S-0023",
        "S-1108",
        "S-0021",
        "S-0068",
        "S-1101",
        "S-0024",
        "S-0070",
        "S-1112"
      ],
      "next_level_gaps": [
        "An implementation that is production-grade and available for language models, or relied on by a party other than its developer for a verification decision.",
        "An independent public security evaluation (audit, red-team or peer-reviewed analysis) of a proof system that handles language models."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "The proof covers a fixed-point approximation, not the floating-point model",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "Current ZK inference systems prove a quantised version of the network. zkLLM scales values by 2^16 and reports small perplexity changes [[S-0023]]. Attestable reports quantising matrix multiplications to 8-bit integers while proving other operations in floating point [[S-1101]]. A verifier therefore learns about the proof-friendly variant, and must separately accept that this variant is the declared model. Trail of Bits built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation; whether it persists through proving was left for further investigation [[S-0070]]. A verification system design calls floating-point emulation in ZKPs an open problem [[S-0018]].",
        "sources": [
          "S-0023",
          "S-1101",
          "S-0070",
          "S-0018"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "A proof speaks only for the computations that were proven",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Attestable writes that \"a proof of some computation is not a proof of all computation\", and that a proof cannot discover a datacenter that was never declared [[S-1102]]. Proofs of inference do not by themselves show that no other workload ran on the same or other hardware.",
        "sources": [
          "S-1102"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "The model architecture is disclosed",
        "kind": "theoretical-argument",
        "severity": "minor",
        "status": "open",
        "description": "ZKML \"requires that the model architecture (but not weights) is revealed\" [[S-0021]], and zkLLM assumes a publicly known model structure [[S-0023]]. Architecture can be commercially sensitive.",
        "sources": [
          "S-0021",
          "S-0023"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Proofs do not bind computational effort (Hollow-LLM)",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "open",
        "description": "Researchers at the University of Southern California show that a proof of inference certifies that an output is consistent with committed weights under the declared architecture, but not how much computation produced it [[S-1112]]. In their Hollow-LLM attack, a provider keeps the declared architecture and parameter count but commits to \"ghost weights\". Some layers pass their inputs through unchanged, and wide layers carry the signal in a small subspace, so a much smaller inner model does the real work. The ghost weights satisfy the verification circuit and yield valid proofs [[S-1112]].\n\nThe authors ran the attack with the proof procedure of zkGPT, a separate ZK inference system, on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were identical to the inner model's, and serving cost stayed at the inner model's level. An honest model of the declared size cost 2.4 times as much to prefill and 3.1 times as much to decode. Proving cost still grew with the declared architecture [[S-1112]].\n\nThe authors note that results may be served before any proof, with the provider building the witness only when a call is selected for audit. They describe their constructions as compatible with state-of-the-art zkLLM pipelines, and state that the attack does not imply a flaw in the proof system itself. They propose challenge-based audits and ablation tests, which raise the cost of cheating but give no guarantee [[S-1112]].",
        "sources": [
          "S-1112"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Proving takes about 12 to 13 minutes per 2,048-token forward pass of a 13B model on one A100 [[S-0023]], and a verification system design calls the overhead heavy [[S-0018]].",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-0023",
          "S-0018"
        ]
      },
      {
        "text": "ZKML and zkLLM prove fixed-point arithmetic [[S-0021]] [[S-0023]], and floating-point emulation in ZKPs is described as an open problem [[S-0018]].",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-0021",
          "S-0023",
          "S-0018"
        ]
      },
      {
        "text": "zkLLM's code is unaudited, interactive and archived [[S-1108]]; the one audited ZK inference library, ezkl, had high-severity circuit soundness bugs before its fixes [[S-0070]].",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": [
          "S-1108",
          "S-0070"
        ]
      },
      {
        "text": "Showing that proven inference was the only work done needs a compute-accounting mechanism such as proof-of-work accounting, which is only proposed [[S-1102]].",
        "theme": "coverage-hidden-compute",
        "blocked_by": "M-0007",
        "sources": [
          "S-1102"
        ]
      }
    ],
    "challenge_themes": [
      "performance-compatibility",
      "coverage-hidden-compute",
      "evidence-binding",
      "adversarial-validation",
      "privacy-leakage"
    ],
    "organizations": [
      "O-0120",
      "O-0122"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-0023",
        "supports": "zkLLM design, threat model, security theorems, overheads, fixed-point effects",
        "locator": "abstract; §3.6; §4–5; §7.2 Theorems 7.3–7.4; §8 Table 1; §9"
      },
      {
        "source": "S-1108",
        "supports": "zkLLM code availability, artifact badges and README caveats",
        "locator": "README; Zenodo record"
      },
      {
        "source": "S-0021",
        "supports": "ZKML design, halo2 backends, GPT-2 overheads, limitations",
        "locator": "§3; §4.1; §4.4; §9 Tables 5–7"
      },
      {
        "source": "S-0068",
        "supports": "NanoZK layerwise proofs, threat model, proof sizes, partial audits",
        "locator": "Definition 1; §5; §6; Table 8; App. A.4"
      },
      {
        "source": "S-0024",
        "supports": "verifiable evaluation attestations with ezkl; public inputs and outputs; costs of small models",
        "locator": "abstract; §5; §6.1 Table 1"
      },
      {
        "source": "S-0070",
        "supports": "independent audit of ezkl: circuit soundness findings, quantisation-activated backdoor, production use, fix review",
        "locator": "Executive Summary; findings TOB-EZKL-4 to 6 and 17; App. D"
      },
      {
        "source": "S-1100",
        "supports": "definition and categorisation of ZKML; main implementation bottlenecks",
        "locator": "abstract; §III; Table VI"
      },
      {
        "source": "S-1101",
        "supports": "Attestable's reported prover, statement proven, performance and limits (provider-reported)"
      },
      {
        "source": "S-1102",
        "supports": "Attestable's coverage argument and pacing proposal (provider-reported)"
      },
      {
        "source": "S-1103",
        "supports": "Attestable's proposal to prove randomly sampled outputs (provider-reported)"
      },
      {
        "source": "S-0018",
        "supports": "ZKPs as a 'tentative plan B' in a verification system; overhead assessment; floating-point gap",
        "locator": "§5.2.4, pp. 59–60"
      },
      {
        "source": "S-1112",
        "supports": "independent Hollow-LLM analysis: proofs do not bind computational effort; ghost-weight constructions; zkGPT-based experiment and cost results; countermeasures",
        "locator": "Abstract; §I contributions; §V Table 2; §VI"
      }
    ],
    "concepts": [
      "K-0010",
      "K-0024",
      "K-0001",
      "K-0002",
      "K-0020",
      "K-0016",
      "K-0018"
    ],
    "complements": [
      "M-0007"
    ],
    "alternatives": [
      "M-0001",
      "M-0008"
    ],
    "type": "mechanism",
    "implementations": [
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "I-0003",
        "title": "zkLLM",
        "url": "https://trustbutveri.fyi/implementations/zkllm/"
      }
    ],
    "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/",
    "source_file": "content/mechanisms/zk-proofs-of-inference.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "## How it works\n\nA zero-knowledge proof of inference lets a [[K-0001|prover]] convince a [[K-0002|verifier]] that an output came from a specific model on a specific input, without revealing the model's weights [[S-1100]]. A survey describes ZKPs as letting one party certify that a training, testing or inference result \"was produced by the claimed computation without revealing sensitive data or proprietary model parameters\" [[S-1100]].\n\nThe protocol has two steps:\n1. The prover publishes a [[K-0024|cryptographic commitment]] to the weights once. For LLaMa-2-13B, zkLLM's commitment took 986 seconds [[S-0023]].\n2. For each query, the prover proves that the output equals the committed model applied to the input [[S-0023]] [[S-0021]]. The verifier checks the proof without the weights and without rerunning the model [[S-0023]].\n\nOnly the weights are hidden. In zkLLM's setting the verifier submits the prompt and receives the output with its proof [[S-0023]]. South et al. likewise keep weights private and inputs and outputs public [[S-0024]].\n\nSystems turn the network's operations into arithmetic over a finite field, with tensors as fixed-point numbers [[S-0021]] [[S-0023]]. Softmax, GELU and normalisation need special handling:\n- zkLLM uses a parallel lookup argument (tlookup) and an attention-specific protocol (zkAttn) [[S-0023]].\n- NanoZK uses 16-bit lookup tables [[S-0068]].\n\nProof systems differ:\n- ZKML compiles models to halo2 circuits with either KZG commitments, which need a trusted setup, or transparent IPA commitments [[S-0021]].\n- zkLLM uses sumcheck-based protocols with Hyrax commitments [[S-0023]].\n- NanoZK proves each transformer layer separately and links the layers with a chain of SHA-256 commitments [[S-0068]].\n- Attestable reports a prover whose security rests \"only on the security of cryptographic hash functions\" [[S-1101]].\n\nProofs over many inputs can be packaged into attestations that a model with fixed private weights reaches a stated benchmark score [[S-0024]].\n\n## What it establishes\n**What it can establish.**\n- A valid proof shows that the output follows from the committed weights, the public architecture and the input [[S-0023]] [[S-0021]]. This bears directly on [[C-0005]].\n- The weights stay confidential against a verifier that follows the protocol. zkLLM's zero-knowledge theorem shows that such a verifier's view reveals nothing about the weights beyond the output [[S-0023]].\n- Attestable proposes proofs that an accounted workload \"used an approved, unchanged model rather than a newly trained replacement\", which bears on [[C-0004]] [[S-1102]].\n\n**What it cannot establish.**\n- **Which model the commitment is.** The proof does not tie the committed weights to an outside identity such as \"the declared model\". Proven benchmark results over the committed weights are one way to link them [[S-0024]]. Committed weights can also be hollow. Weights with the declared architecture and parameter count can route the work through a much smaller model and still yield valid proofs [[S-1112]].\n- **Work that was not proven.** Attestable notes that \"a proof of some computation is not a proof of all computation\", and that a proof cannot find an undeclared datacenter [[S-1102]].\n- **Every output, when only some are proven.** Assurance from sampling is probabilistic. Attestable proposes selecting outputs at random for proof after they have been committed [[S-1103]]. NanoZK bounds the chance of detecting tampering when auditors check a subset of layers [[S-0068]].\n- **The floating-point model.** What is proven is a fixed-point approximation of the model [[S-0023]]. Attestable reports 8-bit integer matrix multiplications [[S-1101]].\n- **A hidden architecture.** ZKML requires the architecture to be revealed [[S-0021]], and zkLLM assumes it is publicly known [[S-0023]].\n\n## Threat model\nSoundness rests on computational assumptions against a cheating prover:\n- zkLLM proves its lookup argument sound: a cheating probabilistic polynomial-time prover succeeds only with negligible probability. The rest of its protocol applies sumcheck and proofs of opening for commitments whose binding rests on discrete-log hardness [[S-0023]].\n- NanoZK assumes a polynomial-time adversary that controls the inference infrastructure and may substitute models or fabricate outputs. It relies on discrete-log hardness over the Pallas curve and SHA-256 collision resistance [[S-0068]].\n- Attestable reports 100-bit security, and post-quantum security because it avoids public-key cryptography [[S-1101]].\n\nConfidentiality rests on further assumptions:\n- zkLLM assumes a semi-honest verifier, which \"accurately reports the outcome of the proof verification\" but tries to learn the weights. Its zero-knowledge theorem also assumes zero-knowledge variants of the sumcheck protocols [[S-0023]].\n- NanoZK leaves side channels, denial of service and hiding the input from the provider out of scope [[S-0068]].\n- Attestable treats physical-access and metadata channels as separate threats [[S-1103]].\n\n## Evidence\n- **ZKML.** It proved a distilled 81.3-million-parameter GPT-2 in 3,651.67 seconds on a 128-vCPU, 1 TB machine. This was the largest model its authors could prove with under 1 TB of RAM [[S-0021]].\n- **South et al.** They used ezkl to prove evaluations of small models. A 250,000-parameter nanoGPT took 2,781 seconds to prove and needed a 219 GB proving key [[S-0024]].\n- **[[I-0003|zkLLM]].** It proved OPT models up to 13B and LLaMa-2 models of 7B and 13B, each proof covering one 2,048-token forward pass on one A100 GPU. LLaMa-2-13B took 803 seconds to prove and 3.95 seconds to verify, with a 188 kB proof [[S-0023]]. Its code is public [[S-1108]].\n- **NanoZK.** It reports proofs of 3.2 to 3.7 KB per attention or MLP sub-circuit, about 83 KB in total for 12 layers. From per-component timings, it projects that a 12-layer GPT-2 would take about 14 minutes to prove sequentially on CPU [[S-0068]].\n- **[[I-0005|Attestable]].** It reports proving a 31-billion-parameter Gemma model at 53 tokens per second for one 16K-token sequence on one H100 GPU, with 4.35 to 7.92 MiB proofs and 157 to 648 ms CPU verification. No code or paper accompanies these results [[S-1101]].\n- **Independent audit of ezkl.** Trail of Bits reviewed the ezkl library in January 2025, at its developer's request. It reported three high-severity circuit soundness issues and four ways to bypass data attestation in ezkl's smart contracts. Its fix review found every high-severity finding resolved [[S-0070]].\n- **Hollow-LLM attack.** Researchers at the University of Southern California ran a ghost-weight attack through zkGPT's proof procedure on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were unchanged and serving cost stayed at the small model's level [[S-1112]].\n\nA verification system design for AI agreements lists ZKPs as a \"tentative plan B\" that could \"remove the need for secure computing hardware setups\" [[S-0018]].\n\n## Limitations\n**Cost.**\n- zkLLM needs about 12 to 13 minutes per 2,048-token forward pass at 13B scale on one A100 [[S-0023]].\n- The verification system design calls the overhead \"heavy\" [[S-0018]].\n- The survey names \"limited circuit expressiveness, high proving cost, and deployment complexity\" as the main implementation bottlenecks [[S-1100]].\n\n**Expressiveness.** ZKML does not support branching or variable-length loops, so language models need fixed-length inputs [[S-0021]]. Floating-point emulation remains open [[S-0018]]. Attestable reports a 16K-token context limit [[S-1101]].\n\n**Implementation soundness.** In ezkl, Trail of Bits found circuits with missing constraints that \"would allow a malicious prover to convince a verifier of incorrect calculations\"; these were fixed [[S-0070]]. The zkLLM README says its code \"has NOT undergone security auditing and is NOT ready for industrial applications\". It also says prover and verifier run side by side, and that a deployment would need Fiat–Shamir to be non-interactive [[S-1108]].\n\n**Quantisation.** Trail of Bits also built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation. Whether it persists through proving was left for further investigation [[S-0070]].\n\n**Coverage.** A proof covers only the outputs proven [[S-1102]]. For accounting of other work, see [[M-0007]]. A proof also does not show how much computation produced an output. In the Hollow-LLM attack, weights with the declared architecture let a much smaller model do the work, and the proofs remain valid [[S-1112]].",
    "body_text": "How it works A zero-knowledge proof of inference lets a prover convince a verifier that an output came from a specific model on a specific input, without revealing the model's weights [S-1100]. A survey describes ZKPs as letting one party certify that a training, testing or inference result \"was produced by the claimed computation without revealing sensitive data or proprietary model parameters\" [S-1100]. The protocol has two steps: 1. The prover publishes a cryptographic commitment to the weights once. For LLaMa-2-13B, zkLLM's commitment took 986 seconds [S-0023]. 2. For each query, the prover proves that the output equals the committed model applied to the input [S-0023] [S-0021]. The verifier checks the proof without the weights and without rerunning the model [S-0023]. Only the weights are hidden. In zkLLM's setting the verifier submits the prompt and receives the output with its proof [S-0023]. South et al. likewise keep weights private and inputs and outputs public [S-0024]. Systems turn the network's operations into arithmetic over a finite field, with tensors as fixed-point numbers [S-0021] [S-0023]. Softmax, GELU and normalisation need special handling: - zkLLM uses a parallel lookup argument (tlookup) and an attention-specific protocol (zkAttn) [S-0023]. - NanoZK uses 16-bit lookup tables [S-0068]. Proof systems differ: - ZKML compiles models to halo2 circuits with either KZG commitments, which need a trusted setup, or transparent IPA commitments [S-0021]. - zkLLM uses sumcheck-based protocols with Hyrax commitments [S-0023]. - NanoZK proves each transformer layer separately and links the layers with a chain of SHA-256 commitments [S-0068]. - Attestable reports a prover whose security rests \"only on the security of cryptographic hash functions\" [S-1101]. Proofs over many inputs can be packaged into attestations that a model with fixed private weights reaches a stated benchmark score [S-0024]. What it establishes What it can establish. - A valid proof shows that the output follows from the committed weights, the public architecture and the input [S-0023] [S-0021]. This bears directly on The declared model is the one being served. - The weights stay confidential against a verifier that follows the protocol. zkLLM's zero-knowledge theorem shows that such a verifier's view reveals nothing about the weights beyond the output [S-0023]. - Attestable proposes proofs that an accounted workload \"used an approved, unchanged model rather than a newly trained replacement\", which bears on This compute runs inference, not training [S-1102]. What it cannot establish. - Which model the commitment is. The proof does not tie the committed weights to an outside identity such as \"the declared model\". Proven benchmark results over the committed weights are one way to link them [S-0024]. Committed weights can also be hollow. Weights with the declared architecture and parameter count can route the work through a much smaller model and still yield valid proofs [S-1112]. - Work that was not proven. Attestable notes that \"a proof of some computation is not a proof of all computation\", and that a proof cannot find an undeclared datacenter [S-1102]. - Every output, when only some are proven. Assurance from sampling is probabilistic. Attestable proposes selecting outputs at random for proof after they have been committed [S-1103]. NanoZK bounds the chance of detecting tampering when auditors check a subset of layers [S-0068]. - The floating-point model. What is proven is a fixed-point approximation of the model [S-0023]. Attestable reports 8-bit integer matrix multiplications [S-1101]. - A hidden architecture. ZKML requires the architecture to be revealed [S-0021], and zkLLM assumes it is publicly known [S-0023]. Threat model Soundness rests on computational assumptions against a cheating prover: - zkLLM proves its lookup argument sound: a cheating probabilistic polynomial-time prover succeeds only with negligible probability. The rest of its protocol applies sumcheck and proofs of opening for commitments whose binding rests on discrete-log hardness [S-0023]. - NanoZK assumes a polynomial-time adversary that controls the inference infrastructure and may substitute models or fabricate outputs. It relies on discrete-log hardness over the Pallas curve and SHA-256 collision resistance [S-0068]. - Attestable reports 100-bit security, and post-quantum security because it avoids public-key cryptography [S-1101]. Confidentiality rests on further assumptions: - zkLLM assumes a semi-honest verifier, which \"accurately reports the outcome of the proof verification\" but tries to learn the weights. Its zero-knowledge theorem also assumes zero-knowledge variants of the sumcheck protocols [S-0023]. - NanoZK leaves side channels, denial of service and hiding the input from the provider out of scope [S-0068]. - Attestable treats physical-access and metadata channels as separate threats [S-1103]. Evidence - ZKML. It proved a distilled 81.3-million-parameter GPT-2 in 3,651.67 seconds on a 128-vCPU, 1 TB machine. This was the largest model its authors could prove with under 1 TB of RAM [S-0021]. - South et al. They used ezkl to prove evaluations of small models. A 250,000-parameter nanoGPT took 2,781 seconds to prove and needed a 219 GB proving key [S-0024]. - zkLLM. It proved OPT models up to 13B and LLaMa-2 models of 7B and 13B, each proof covering one 2,048-token forward pass on one A100 GPU. LLaMa-2-13B took 803 seconds to prove and 3.95 seconds to verify, with a 188 kB proof [S-0023]. Its code is public [S-1108]. - NanoZK. It reports proofs of 3.2 to 3.7 KB per attention or MLP sub-circuit, about 83 KB in total for 12 layers. From per-component timings, it projects that a 12-layer GPT-2 would take about 14 minutes to prove sequentially on CPU [S-0068]. - Attestable. It reports proving a 31-billion-parameter Gemma model at 53 tokens per second for one 16K-token sequence on one H100 GPU, with 4.35 to 7.92 MiB proofs and 157 to 648 ms CPU verification. No code or paper accompanies these results [S-1101]. - Independent audit of ezkl. Trail of Bits reviewed the ezkl library in January 2025, at its developer's request. It reported three high-severity circuit soundness issues and four ways to bypass data attestation in ezkl's smart contracts. Its fix review found every high-severity finding resolved [S-0070]. - Hollow-LLM attack. Researchers at the University of Southern California ran a ghost-weight attack through zkGPT's proof procedure on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were unchanged and serving cost stayed at the small model's level [S-1112]. A verification system design for AI agreements lists ZKPs as a \"tentative plan B\" that could \"remove the need for secure computing hardware setups\" [S-0018]. Limitations Cost. - zkLLM needs about 12 to 13 minutes per 2,048-token forward pass at 13B scale on one A100 [S-0023]. - The verification system design calls the overhead \"heavy\" [S-0018]. - The survey names \"limited circuit expressiveness, high proving cost, and deployment complexity\" as the main implementation bottlenecks [S-1100]. Expressiveness. ZKML does not support branching or variable-length loops, so language models need fixed-length inputs [S-0021]. Floating-point emulation remains open [S-0018]. Attestable reports a 16K-token context limit [S-1101]. Implementation soundness. In ezkl, Trail of Bits found circuits with missing constraints that \"would allow a malicious prover to convince a verifier of incorrect calculations\"; these were fixed [S-0070]. The zkLLM README says its code \"has NOT undergone security auditing and is NOT ready for industrial applications\". It also says prover and verifier run side by side, and that a deployment would need Fiat–Shamir to be non-interactive [S-1108]. Quantisation. Trail of Bits also built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation. Whether it persists through proving was left for further investigation [S-0070]. Coverage. A proof covers only the outputs proven [S-1102]. For accounting of other work, see Proofs of useful work and resource exhaustion. A proof also does not show how much computation produced an output. In the Hollow-LLM attack, weights with the declared architecture let a much smaller model do the work, and the proofs remain valid [S-1112].",
    "referenced_by": [
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/"
      },
      {
        "id": "M-0002",
        "title": "Deterministic and bit-exact inference",
        "url": "https://trustbutveri.fyi/mechanisms/deterministic-inference/"
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/"
      },
      {
        "id": "M-0007",
        "title": "Proofs of useful work and resource exhaustion",
        "url": "https://trustbutveri.fyi/mechanisms/proofs-of-useful-work/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "I-0003",
        "title": "zkLLM",
        "url": "https://trustbutveri.fyi/implementations/zkllm/"
      },
      {
        "id": "C-0005",
        "title": "The declared model is the one being served",
        "url": "https://trustbutveri.fyi/claims/declared-model-is-served/"
      },
      {
        "id": "K-0024",
        "title": "Cryptographic commitment",
        "url": "https://trustbutveri.fyi/concepts/cryptographic-commitment/"
      },
      {
        "id": "K-0001",
        "title": "Prover",
        "url": "https://trustbutveri.fyi/concepts/prover/"
      },
      {
        "id": "K-0010",
        "title": "Zero-knowledge proof",
        "url": "https://trustbutveri.fyi/concepts/zero-knowledge-proof/"
      },
      {
        "id": "O-0120",
        "title": "Attestable",
        "url": "https://trustbutveri.fyi/organizations/attestable/"
      },
      {
        "id": "O-0122",
        "title": "University of Waterloo",
        "url": "https://trustbutveri.fyi/organizations/university-of-waterloo/"
      }
    ]
  }
}