Attestable zero-knowledge inference prover

What it is

In an August 2026 blog post, the company Attestable (Attestable) reports a prover for zero-knowledge proofs of inference on "production-scale transformer inference" ¹. The post links no paper, code or technical documentation ¹.

Attestable reports that a proof "can establish that a committed model produced a specific output from a specific input, without revealing the model's weights or other private information" ¹.

How it works

The statement proven. Attestable writes the proven statement as y = F(W, x, r), where:

• F is the model;
• W is the committed weights;
• x is the input;
• r is a random seed;
• y is the output ¹.

The proof can also bind the model configuration, the decoding parameters and "other policy-relevant values" ¹. A standalone CPU verifier checks it without the weights and without rerunning the model ¹.

Security basis. Attestable reports that its results rest "only on the security of cryptographic hash functions" ¹. It claims 100-bit security and post-quantum security ¹.

Arithmetic. Matrix multiplications are dynamically quantised to 8-bit integers, and non-linear operations are proven in floating point ¹. The post does not name the proof system ¹.

Proposed uses. Attestable proposes two ways to deploy the prover:

• A verification firewall at the external interfaces of an environment that holds model weights. It would select outputs for proof at random. The selection "must remain unpredictable to the datacenter" and happen only after each output is committed ³. Attestable describes its solution as "already practical today" ³.
• Support for pacing agreements. An auditor "could verify that an accounted workload used an approved, unchanged model rather than a newly trained replacement". Where an input classifier is required, a proof could show that the agreed classifier accepted the input ².

Evidence

All results come from Attestable's own blog. Attestable reports these figures on a single NVIDIA H100 GPU:

• Proofs. Proof sizes range from 4.35 to 7.92 MiB, and CPU verification takes 157 to 648 milliseconds ¹.
• Throughput. For a 31-billion-parameter Gemma model, it reports proving 53 tokens per second for one 16K-token sequence, and 77 tokens per second across four 4K-token sequences ¹.
• Accuracy. It reports that its quantisation preserved performance on the GPQA Diamond reasoning benchmark better than a standard INT8 baseline ¹.
• Comparison. It sets these figures against an ezkl result from the end of 2023: 16 minutes to prove a 1-million-parameter model on a CPU ¹.

As of September 2026 no independent reproduction of these results has been published.

Limitations

Attestable lists its current limits:

• a context window of up to 16K tokens;
• matrix multiplications quantised to 8-bit integers ¹.

It reports that its IFEval result "shows where the current quantization still needs improvement" ¹.

On coverage, Attestable writes that "a proof of some computation is not a proof of all computation" ². It proposes pairing inference proofs with proof-of-work accounting, which would need "a credible estimate of the compute available" to the actor ².

For the firewall proposal, Attestable lists threats that the proofs do not address:

• physical attacks, such as probing memory buses;
• leakage through timing, packet sizes, power and proof-generation latency ³.

As of September 2026 the protocol is unpublished, and no attack on it or security analysis of it has been published.