Proposal Explorer

Add claims to see which ones the mechanisms address.

Not counted

Excluded by your filters: Zero-knowledge proofs of inference and Whole-workload recomputation (reproducible packets)

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

Excluded by your filters

• Zero-knowledge proofs of inference Attack testing is none; the filter asks for at least published analysis.
• Whole-workload recomputation (reproducible packets) Attack testing is none; the filter asks for at least published analysis.

Family findings

• Zero-knowledge proofs of inference

  Context for Attestable zero-knowledge inference prover. Findings from the mechanism family appear here as context. They apply to an implementation only when its own record lists them, under the conditions stated there.

  • The proof covers a fixed-point approximation, not the floating-point model in Zero-knowledge proofs of inference

    Current ZK inference systems prove a quantised version of the network. zkLLM scales values by 2^16 and reports small perplexity changes. Attestable reports quantising matrix multiplications to 8-bit integers while proving other operations in floating point. A verifier therefore learns about the proof-friendly variant, and must separately accept that this variant is the declared model. Trail of Bits built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation; whether it persists through proving was left for further investigation. A verification system design notes that ZKPs can emulate floating-point operations. Rounding makes floating-point results depend on summation order, so bit-for-bit replay of an accelerator's results needs its original reduction tree. The report calls emulating that tree inside a ZKP an open, intricate problem and asks what it would cost. ^{1 4 5 6}

    Scope limitation · Open question. On the record

  • A proof speaks only for the computations that were proven in Zero-knowledge proofs of inference

    Attestable writes that "a proof of some computation is not a proof of all computation", and that a proof cannot discover a datacenter that was never declared. Proofs of inference do not by themselves show that no other workload ran on the same or other hardware. ²

    Scope limitation · Theoretical argument. On the record

    Related mechanism Proposed Proofs of useful work for capacity accounting: The record names proof-of-work accounting as the kind of compute accounting needed to show that proven inference was the only work done. A pointer, not evidence that this failure is mitigated. Add

  • The model architecture is disclosed in Zero-knowledge proofs of inference

    ZKML "requires that the model architecture (but not weights) is revealed", and zkLLM assumes a publicly known model structure. Architecture can be commercially sensitive. ^{4 7}

    Scope limitation · Theoretical argument. On the record

  • Proofs do not bind computational effort (Hollow-LLM) in Zero-knowledge proofs of inference

    Researchers at the University of Southern California show that a proof of inference certifies that an output is consistent with committed weights under the declared architecture, but not how much computation produced it. In their Hollow-LLM attack, a provider keeps the declared architecture and parameter count but commits to "ghost weights". Some layers pass their inputs through unchanged, and wide layers carry the signal in a small subspace, so a much smaller inner model does the real work. The ghost weights satisfy the verification circuit and yield valid proofs.

    The authors ran the attack with the proof procedure of zkGPT, a separate ZK inference system, on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were identical to the inner model's, and serving cost stayed at the inner model's level. An honest model of the declared size cost 2.4 times as much to prefill and 3.1 times as much to decode. Proving cost still grew with the declared architecture.

    The authors note that results may be served before any proof, with the provider building the witness only when a call is selected for audit. They describe their constructions as "compatible with state-of-the-art zkLLM pipelines", and state that the attack does not imply a flaw in the proof system itself. They propose challenge-based audits and ablation tests, which raise the cost of cheating but give no guarantee. ⁸

    Scope limitation · Demonstrated attack. On the record

Scope limitations

• Proves an 8-bit quantised variant of the model in Attestable zero-knowledge inference prover

  Attestable reports that matrix multiplications are dynamically quantised to 8-bit integers, while non-linear operations are proven in floating point. It reports that its IFEval result "shows where the current quantization still needs improvement". The proven model is therefore a quantised variant, which a verifier must accept as the declared model. ¹

  Scope limitation · Open question. On the record

• A proof covers only the computation it is about in Attestable zero-knowledge inference prover

  Attestable states that "a proof of some computation is not a proof of all computation" and that a proof "cannot discover a datacenter that was never declared". ²

  Scope limitation · Theoretical argument. On the record

• Spare compute is outside the scheme in Whole-workload recomputation (reproducible packets)

  The plan states that it does not verify that spare compute is not used for unapproved workloads, because this seems very challenging. Recomputation checks the correctness of declared work, not its completeness. ^{9 10}

  Scope limitation · Theoretical argument. On the record

  Related mechanism Proposed Proofs of useful work for capacity accounting: Proposed as one input to accounting for spare capacity on declared hardware. A pointer, not evidence that this failure is mitigated. Add

Open questions

• Non-compliant work could be encoded inside compliant-looking packets in Whole-workload recomputation (reproducible packets)

  The plan notes that an AI company might try to encode a non-compliant workload inside a workload that looks compliant on the surface. ⁹

  Open question · Theoretical argument. On the record

Not yet demonstrated

Proposed Zero-knowledge proofs of inference and Proposed Whole-workload recomputation (reproducible packets)

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• Operational use Deterministic and bit-exact inference Add
  • Whole-workload recomputation (reproducible packets) waits on it. Workloads are not reproducible by default, and achieving reproducibility may cost performance.
• Proposed Network taps and certifiers Add
  • Whole-workload recomputation (reproducible packets) waits on it. All traffic must reach the recomputation server via network taps, and the server's integrity is critical.
• Proposed Proofs of useful work for capacity accounting Add
  • Zero-knowledge proofs of inference waits on it. Covering computation that is not proven relies on proof-of-work accounting, which Attestable has only proposed.

Missing prerequisites

• Operational use Deterministic and bit-exact inference needed by Whole-workload recomputation (reproducible packets) Add
• Proposed Network taps and certifiers needed by Whole-workload recomputation (reproducible packets) Add

Blockers

7 blockers recorded

• Zero-knowledge proofs of inference
  • No paper, protocol specification or code is public, so the reported results cannot be reproduced. Adversarial validation ¹
  • Attestable reports a context window limited to 16K tokens. Performance & compatibility ¹
  • Covering computation that is not proven relies on proof-of-work accounting, which Attestable has only proposed. Coverage & hidden compute. Waits on Proofs of useful work for capacity accounting ²
• Whole-workload recomputation (reproducible packets)
  • Workloads are not reproducible by default, and achieving reproducibility may cost performance. Performance & compatibility. Waits on Deterministic and bit-exact inference ⁹
  • Network packets are not individually reproducible by default; making them so may need considerable software, firmware and hardware work. Amodo rates this 'not on track'. Performance & compatibility ¹²
  • All traffic must reach the recomputation server via network taps, and the server's integrity is critical. Hardware trust. Waits on Network taps and certifiers ^{9 12}
  • Recomputing training steps needs checkpoints: writing one at every step would cost more than 100% overhead, so Amodo's design needs a spare data-parallel replica that tracks the weights instead. Performance & compatibility ¹⁰

From the family or selected implementation's record. ?

Model weights

Depends on the design for Whole-workload recomputation (reproducible packets).

Unspecified for Zero-knowledge proofs of inference. Check the implementation record.

Inputs and outputs

Depends on the design for Whole-workload recomputation (reproducible packets).

Unspecified for Zero-knowledge proofs of inference. Check the implementation record.

Training data

Depends on the design for Whole-workload recomputation (reproducible packets).

Unspecified for Zero-knowledge proofs of inference. Check the implementation record.

Zero-knowledge proofs of inference

• Proposed Attestable zero-knowledge inference prover Product, Attestable
• Research demo EZKL Product, Zkonduit
• Proposed Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• Research demo zkLLM Research prototype, University of Waterloo

Whole-workload recomputation (reproducible packets)

• Proposed AI 2040 inference-only verification stack Proposed architecture, AI Futures Project

1. Proving LLMs at Scale, Attestable (2026). Original
2. Pacing AI Requires Proof, Attestable (2026). Original
3. From Verifiability to Model-Weight Security, Attestable (2026). Original
4. zkLLM: Zero Knowledge Proofs for Large Language Models, H. Sun et al. (2024). Original
5. Zkonduit EZKL Security Assessment, F. Casal et al. (2025). Original
6. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
7. ZKML: An Optimizing System for ML Inference in Zero-Knowledge Proofs, B.-J. Chen et al. (2024). Original
8. Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference, C. Gong et al. (2026). Original
9. Verification Plan, R. Dean (2026). Original
10. Example Schemes for Verifying High-Stakes AI Agreements, Amodo Design (2026). Original
11. Scaling Recomputation Inference Verification, Amodo Design (2026). Original
12. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). Original
13. Get Involved in Verification, AI Futures Project (2026). Original
14. Proof-of-Learning is Currently More Broken Than You Think, C. Fang et al. (2023). Original