Proposal Explorer

Add claims to see which ones the mechanisms address.

Built for an adversarial prover

Zero-knowledge proofs of inference and Timed challenge-response and memory-occupation challenges

No new hardware needed

Timed challenge-response and memory-occupation challenges

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• Zero-knowledge proofs of inference, Low-trust AI compute verification system overview: Analysis
• Timed challenge-response and memory-occupation challenges: Analysis

Family findings

• Zero-knowledge proofs of inference

  Context for Low-trust AI compute verification system overview. These findings concern the family or other implementations; applicability must be checked against their stated scope.

  • The proof covers a fixed-point approximation, not the floating-point model in Zero-knowledge proofs of inference

    Current ZK inference systems prove a quantised version of the network. zkLLM scales values by 2^16 and reports small perplexity changes. Attestable reports quantising matrix multiplications to 8-bit integers while proving other operations in floating point. A verifier therefore learns about the proof-friendly variant, and must separately accept that this variant is the declared model. Trail of Bits built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation; whether it persists through proving was left for further investigation. A verification system design calls floating-point emulation in ZKPs an open problem. ^{1 3 4 5}

    Open question · Significant · Open. On the record

  • A proof speaks only for the computations that were proven in Zero-knowledge proofs of inference

    Attestable writes that "a proof of some computation is not a proof of all computation", and that a proof cannot discover a datacenter that was never declared. Proofs of inference do not by themselves show that no other workload ran on the same or other hardware. ⁶

    Theoretical argument · Significant · Open. On the record

    Related mechanism R1 Proofs of useful work for capacity accounting: The record names proof-of-work accounting as the kind of compute accounting needed to show that proven inference was the only work done. A pointer, not evidence that this flaw is mitigated. Add

  • The model architecture is disclosed in Zero-knowledge proofs of inference

    ZKML "requires that the model architecture (but not weights) is revealed", and zkLLM assumes a publicly known model structure. Architecture can be commercially sensitive. ^{3 7}

    Theoretical argument · Minor · Open. On the record

  • Proofs do not bind computational effort (Hollow-LLM) in Zero-knowledge proofs of inference

    Researchers at the University of Southern California show that a proof of inference certifies that an output is consistent with committed weights under the declared architecture, but not how much computation produced it. In their Hollow-LLM attack, a provider keeps the declared architecture and parameter count but commits to "ghost weights". Some layers pass their inputs through unchanged, and wide layers carry the signal in a small subspace, so a much smaller inner model does the real work. The ghost weights satisfy the verification circuit and yield valid proofs.

    The authors ran the attack with the proof procedure of zkGPT, a separate ZK inference system, on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were identical to the inner model's, and serving cost stayed at the inner model's level. An honest model of the declared size cost 2.4 times as much to prefill and 3.1 times as much to decode. Proving cost still grew with the declared architecture.

    The authors note that results may be served before any proof, with the provider building the witness only when a call is selected for audit. They describe their constructions as "compatible with state-of-the-art zkLLM pipelines", and state that the attack does not imply a flaw in the proof system itself. They propose challenge-based audits and ablation tests, which raise the cost of cheating but give no guarantee. ⁸

    Demonstrated attack · Significant · Open. On the record

Open significant flaws

3 flaws in 2 mechanisms

• Mismatches cannot be attributed to cheating or error in Low-trust AI compute verification system overview

  A failed hash or replay does not show whether it came from an evasion attempt, a random bit flip or an evaluation error. The author notes that if detected anomalies can plausibly be waved off as malfunctions, deterrence becomes less effective, so the parties need an agreed escalation procedure that ends in attribution. ¹

  Theoretical argument · Significant · Open. On the record

• Inspector agents may be manipulable in Low-trust AI compute verification system overview

  Automated compliance screening with LLM-based inspector agents must resist prompt-injection attacks. Adversarially trained systems might hide malicious actions with steganography, which makes backdoor detection an open problem. ¹

  Open question · Significant · Open. On the record

• Remote memory narrows the timing margin in Timed challenge-response and memory-occupation challenges

  Data-centre remote memory access returns in about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview says verification of memory saturation depends on ruling out remote access by latency or physical disconnection. It adds that pre-staging data is ruled out only by unpredictable, capacity-filling challenges. ¹

  Theoretical argument · Significant · Open. On the record

  Related mechanism R2 Bandwidth limits and compartmentalization: Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced. A pointer, not evidence that this flaw is mitigated. Add

Open minor flaws

2 mechanisms with minor findings

• Deliberate faults leak a bit each in Low-trust AI compute verification system overview

  A malicious device can leak one bit by deliberately outputting a wrong result, which blocks a disclosure when the cross-comparison fails. The design therefore needs a pre-agreed budget of tolerated faults. ¹

  Theoretical argument · Minor · Open. On the record

• Error rates not quantified in Timed challenge-response and memory-occupation challenges

  Monfared et al. show separable timing distributions but do not define thresholds or statistical tests, so false-positive and false-negative rates are not quantified. ¹⁰

  Open question · Minor · Open. On the record

Not yet demonstrated

R1 Zero-knowledge proofs of inference

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• R2 Bandwidth limits and compartmentalization Add
  • Bears on the open significant flaw “Remote memory narrows the timing margin” in Timed challenge-response and memory-occupation challenges. Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced.
  • Timed challenge-response and memory-occupation challenges waits on it. Outside help, such as remote memory, must be excluded during challenges.
• R3 Deterministic and bit-exact inference Add
  • Zero-knowledge proofs of inference waits on it. Exact replay needs complete hardware and software metadata, and the tolerable slowdown from emulation is an open question.
• R2 Tamper evidence for verifier devices Add
  • Zero-knowledge proofs of inference waits on it. Tamper-evident, rapidly mass-manufacturable and retrofittable enclosures for side-channel defence are an open research question, and physical security against covert communication in every monitored data centre is challenging.
• R1 Network taps and certifiers Add
  • Zero-knowledge proofs of inference waits on it. Empirical feasibility of passive optical splitting at 53–112 GBaud under realistic conditions is an open question.
• R1 Side-channel suppression for isolated facilities Add
  • Zero-knowledge proofs of inference waits on it. A mass-manufacturable, good-enough side-channel defence, particularly power-line filtering, has not been constructed or red-teamed.

Missing prerequisites

• R1 Network taps and certifiers needed by Zero-knowledge proofs of inference Add
• R3 Deterministic and bit-exact inference needed by Zero-knowledge proofs of inference Add

Blockers

9 blockers recorded

• Zero-knowledge proofs of inference
  • Empirical feasibility of passive optical splitting at 53–112 GBaud under realistic conditions is an open question. Performance & compatibility. Waits on Network taps and certifiers ¹
  • Exact replay needs complete hardware and software metadata, and the tolerable slowdown from emulation is an open question. Performance & compatibility. Waits on Deterministic and bit-exact inference ¹
  • Tamper-evident, rapidly mass-manufacturable and retrofittable enclosures for side-channel defence are an open research question, and physical security against covert communication in every monitored data centre is challenging. Hardware trust. Waits on Tamper evidence for verifier devices ¹
  • A mass-manufacturable, good-enough side-channel defence, particularly power-line filtering, has not been constructed or red-teamed. Coverage & hidden compute. Waits on Side-channel suppression for isolated facilities ¹
  • Distinguishing one server's DRAM contents from another's by challenge-response timing, and a general challenge-response protocol for diverse data types, are open. Coverage & hidden compute. Waits on Timed challenge-response and memory-occupation challenges ¹
  • The threat model is under-developed and needs input from cybersecurity and AI threat-modelling experts. Adversarial validation ¹
• Timed challenge-response and memory-occupation challenges
  • No network-level memory challenge across data-centre servers has been demonstrated. Adversarial validation ¹
  • Challenges that fill memory displace workloads; filling a pod's volatile memory takes tens of minutes and SSDs take hours. Performance & compatibility ^{1 10}
  • Outside help, such as remote memory, must be excluded during challenges. Coverage & hidden compute. Waits on Bandwidth limits and compartmentalization ¹

From the family or selected implementation's record. ?

Model weights

Not involved: Timed challenge-response and memory-occupation challenges.

Unspecified for Zero-knowledge proofs of inference. Check the implementation record.

Inputs and outputs

Not involved: Timed challenge-response and memory-occupation challenges.

Unspecified for Zero-knowledge proofs of inference. Check the implementation record.

Training data

Not involved: Timed challenge-response and memory-occupation challenges.

Unspecified for Zero-knowledge proofs of inference. Check the implementation record.

Zero-knowledge proofs of inference

• R1 Attestable zero-knowledge inference prover Product, Attestable
• R2 EZKL Product, Zkonduit
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R2 zkLLM Research prototype, University of Waterloo

Timed challenge-response and memory-occupation challenges

• R1 Data-centre memory challenging Proposed architecture, Machine Intelligence Research Institute
• R2 GPU contention probes Research prototype
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R2 SAGE Research prototype
• R2 VRAM-residency challenge Research prototype

1. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
2. Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors, N. Cankaya et al. (2026). Original
3. zkLLM: Zero Knowledge Proofs for Large Language Models, H. Sun et al. (2024). Original
4. Proving LLMs at Scale, Attestable (2026). Original
5. Zkonduit EZKL Security Assessment, F. Casal et al. (2025). Original
6. Pacing AI Requires Proof, Attestable (2026). Original
7. ZKML: An Optimizing System for ML Inference in Zero-Knowledge Proofs, B.-J. Chen et al. (2024). Original
8. Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference, C. Gong et al. (2026). Original
9. Verification Plan, R. Dean (2026). Original
10. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). Original
11. SAGE: Software-based Attestation for GPU Execution, A. Ivanov et al. (2023). Original
12. SWATT: SoftWare-based ATTestation for Embedded Devices, A. Seshadri et al. (2004). Original
13. Proofs of Space, S. Dziembowski et al. (2015). Original
14. Secure Code Update for Embedded Devices via Proofs of Secure Erasure, D. Perito & G. Tsudik (2010). Original
15. Software-Based Memory Erasure with Relaxed Isolation Requirements, S. Bursuc et al. (2024). Original
16. On the Difficulty of Software-Based Attestation of Embedded Devices, C. Castelluccia et al. (2009). Original
17. Refutation of "On the Difficulty of Software-Based Attestation of Embedded Devices", A. Perrig & L. van Doorn (2010). Original