Proposal Explorer

Add claims to see which ones the mechanisms address.

Built for an adversarial prover

Whole-workload recomputation (reproducible packets)

Not counted

Excluded by your filters: Zero-knowledge proofs of inference

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

• Zero-knowledge proofs of inference: Independent red-team · excluded by filters

Excluded by your filters

• Zero-knowledge proofs of inference Shows inputs and outputs to the verifier. The weights stay committed and hidden; the verifier knows each input and output it checks.

Scope limitations

• The proof covers a fixed-point approximation, not the floating-point model in Zero-knowledge proofs of inference

  Current ZK inference systems prove a quantised version of the network. zkLLM scales values by 2^16 and reports small perplexity changes. Attestable reports quantising matrix multiplications to 8-bit integers while proving other operations in floating point. A verifier therefore learns about the proof-friendly variant, and must separately accept that this variant is the declared model. Trail of Bits built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation; whether it persists through proving was left for further investigation. A verification system design notes that ZKPs can emulate floating-point operations. Rounding makes floating-point results depend on summation order, so bit-for-bit replay of an accelerator's results needs its original reduction tree. The report calls emulating that tree inside a ZKP an open, intricate problem and asks what it would cost. ^{1 5 7 11}

  Scope limitation · Open question. On the record

• A proof speaks only for the computations that were proven in Zero-knowledge proofs of inference

  Attestable writes that "a proof of some computation is not a proof of all computation", and that a proof cannot discover a datacenter that was never declared. Proofs of inference do not by themselves show that no other workload ran on the same or other hardware. ¹²

  Scope limitation · Theoretical argument. On the record

  Related mechanism Proposed Proofs of useful work for capacity accounting: The record names proof-of-work accounting as the kind of compute accounting needed to show that proven inference was the only work done. A pointer, not evidence that this failure is mitigated. Add

• The model architecture is disclosed in Zero-knowledge proofs of inference

  ZKML "requires that the model architecture (but not weights) is revealed", and zkLLM assumes a publicly known model structure. Architecture can be commercially sensitive. ^{1 3}

  Scope limitation · Theoretical argument. On the record

• Proofs do not bind computational effort (Hollow-LLM) in Zero-knowledge proofs of inference

  Researchers at the University of Southern California show that a proof of inference certifies that an output is consistent with committed weights under the declared architecture, but not how much computation produced it. In their Hollow-LLM attack, a provider keeps the declared architecture and parameter count but commits to "ghost weights". Some layers pass their inputs through unchanged, and wide layers carry the signal in a small subspace, so a much smaller inner model does the real work. The ghost weights satisfy the verification circuit and yield valid proofs.

  The authors ran the attack with the proof procedure of zkGPT, a separate ZK inference system, on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were identical to the inner model's, and serving cost stayed at the inner model's level. An honest model of the declared size cost 2.4 times as much to prefill and 3.1 times as much to decode. Proving cost still grew with the declared architecture.

  The authors note that results may be served before any proof, with the provider building the witness only when a call is selected for audit. They describe their constructions as "compatible with state-of-the-art zkLLM pipelines", and state that the attack does not imply a flaw in the proof system itself. They propose challenge-based audits and ablation tests, which raise the cost of cheating but give no guarantee. ¹⁰

  Scope limitation · Demonstrated attack. On the record

• Spare compute is outside the scheme in Whole-workload recomputation (reproducible packets)

  The plan states that it does not verify that spare compute is not used for unapproved workloads, because this seems very challenging. Recomputation checks the correctness of declared work, not its completeness. ^{13 14}

  Scope limitation · Theoretical argument. On the record

  Related mechanism Proposed Proofs of useful work for capacity accounting: Proposed as one input to accounting for spare capacity on declared hardware. A pointer, not evidence that this failure is mitigated. Add

Open questions

• Non-compliant work could be encoded inside compliant-looking packets in Whole-workload recomputation (reproducible packets)

  The plan notes that an AI company might try to encode a non-compliant workload inside a workload that looks compliant on the surface. ¹³

  Open question · Theoretical argument. On the record

Not yet demonstrated

Proposed Whole-workload recomputation (reproducible packets)

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• Operational use Deterministic and bit-exact inference Add
  • Whole-workload recomputation (reproducible packets) waits on it. Workloads are not reproducible by default, and achieving reproducibility may cost performance.
• Proposed Network taps and certifiers Add
  • Whole-workload recomputation (reproducible packets) waits on it. All traffic must reach the recomputation server via network taps, and the server's integrity is critical.
• Proposed Proofs of useful work for capacity accounting Add
  • Zero-knowledge proofs of inference waits on it. Showing that proven inference was the only work done needs a compute-accounting mechanism such as proof-of-work accounting, which is only proposed.

Missing prerequisites

• Operational use Deterministic and bit-exact inference needed by Whole-workload recomputation (reproducible packets) Add
• Proposed Network taps and certifiers needed by Whole-workload recomputation (reproducible packets) Add

Blockers

8 blockers recorded

• Zero-knowledge proofs of inference
  • Proving takes about 13 minutes (803 seconds) per 2,048-token forward pass of a 13B model on one A100, and a verification system design calls the overhead heavy. Performance & compatibility ^{1 11}
  • ZKML and zkLLM prove fixed-point arithmetic, and a verification system design calls emulating an accelerator's original floating-point reduction tree inside a zero-knowledge proof, which bit-for-bit replay needs, an open and intricate problem whose cost is also unsettled. Performance & compatibility ^{1 3 11}
  • zkLLM's code is unaudited, interactive and archived; the one audited ZK inference library, ezkl, had high-severity circuit soundness bugs before its fixes. Adversarial validation ^{2 7}
  • Showing that proven inference was the only work done needs a compute-accounting mechanism such as proof-of-work accounting, which is only proposed. Coverage & hidden compute. Waits on Proofs of useful work for capacity accounting ¹²
• Whole-workload recomputation (reproducible packets)
  • Workloads are not reproducible by default, and achieving reproducibility may cost performance. Performance & compatibility. Waits on Deterministic and bit-exact inference ¹³
  • Network packets are not individually reproducible by default; making them so may need considerable software, firmware and hardware work. Amodo rates this 'not on track'. Performance & compatibility ¹⁶
  • All traffic must reach the recomputation server via network taps, and the server's integrity is critical. Hardware trust. Waits on Network taps and certifiers ^{13 16}
  • Recomputing training steps needs checkpoints: writing one at every step would cost more than 100% overhead, so Amodo's design needs a spare data-parallel replica that tracks the weights instead. Performance & compatibility ¹⁴

From the family or selected implementation's record. ?

Model weights

Depends on the design for Whole-workload recomputation (reproducible packets).

Hidden by Zero-knowledge proofs of inference.

Inputs and outputs

Shown by Zero-knowledge proofs of inference.

Depends on the design for Whole-workload recomputation (reproducible packets).

Training data

Depends on the design for Whole-workload recomputation (reproducible packets).

Not involved: Zero-knowledge proofs of inference.

Zero-knowledge proofs of inference

• Proposed Attestable zero-knowledge inference prover Product, Attestable
• Research demo EZKL Product, Zkonduit
• Proposed Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• Research demo zkLLM Research prototype, University of Waterloo

Whole-workload recomputation (reproducible packets)

• Proposed AI 2040 inference-only verification stack Proposed architecture, AI Futures Project

1. zkLLM: Zero Knowledge Proofs for Large Language Models, H. Sun et al. (2024). Original
2. zkllm-ccs2024: code for zkLLM: Zero Knowledge Proofs for Large Language Models, H. Sun (2024). Original
3. ZKML: An Optimizing System for ML Inference in Zero-Knowledge Proofs, B.-J. Chen et al. (2024). Original
4. NanoZK: Privacy-Preserving Verifiable Inference for Large Language Models via Layerwise Zero-Knowledge Proofs, Z. Wang (2026). Original
5. Proving LLMs at Scale, Attestable (2026). Original
6. Verifiable evaluations of machine learning models using zkSNARKs, T. South et al. (2024). Original
7. Zkonduit EZKL Security Assessment, F. Casal et al. (2025). Original
8. DeepProve-1: The First zkML System to Prove a Full LLM Inference, Lagrange Labs (2025). Original
9. Lagrange-Labs/deep-prove (GitHub repository), Lagrange Labs (2026). Original
10. Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference, C. Gong et al. (2026). Original
11. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
12. Pacing AI Requires Proof, Attestable (2026). Original
13. Verification Plan, R. Dean (2026). Original
14. Example Schemes for Verifying High-Stakes AI Agreements, Amodo Design (2026). Original
15. Scaling Recomputation Inference Verification, Amodo Design (2026). Original
16. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). Original
17. Get Involved in Verification, AI Futures Project (2026). Original
18. Proof-of-Learning is Currently More Broken Than You Think, C. Fang et al. (2023). Original