Attestable, a company, reports a zero-knowledge prover for transformer inference that would let an AI developer prove that an output came from a committed model, input and random seed without revealing the weights.
On one NVIDIA H100 GPU, Attestable reports proving a 31-billion-parameter model at 53 tokens per second for one 16,000-token sequence, and 77 tokens per second across four 4,000-token sequences. It reports proofs of a few megabytes that a CPU verifies in under a second. The company calls these alpha results.
It also proposes using such proofs to support verifiable limits on AI development. All evidence comes from the company's blog, and no paper, protocol specification or code is public, so the results cannot be independently checked. The company lists its own limits: a 16,000-token context, 8-bit integer matrix multiplications, and proofs that cover only the computation they are about.
Attestable states the claim, its security basis and its limits, but has published no code, protocol description or artifact.
Assessed use: proving an output came from committed weights
On this page
What it is
In an August 2026 blog post, the company Attestable reports a prover for zero-knowledge proofs of inference on "production-scale transformer inference" 1. The post links no paper, code or technical documentation 1.
Attestable reports that a proof "can establish that a committed model produced a specific output from a specific input, without revealing the model's weights or other private information" 1.
How it works
The statement proven. Attestable writes the proven statement as y = F(W, x, r), where:
- F is the model;
- W is the committed weights;
- x is the input;
- r is a random seed;
- y is the output 1.
The proof can also bind the model configuration, the decoding parameters and "other policy-relevant values" 1. A standalone CPU verifier checks it without the weights and without rerunning the model 1.
Security basis. Attestable reports that its results rest "only on the security of cryptographic hash functions" 1. It claims 100-bit security and post-quantum security 1.
Arithmetic. Matrix multiplications are dynamically quantised to 8-bit integers, and non-linear operations are proven in floating point 1. The post does not name the proof system 1.
Proposed uses. Attestable proposes two ways to deploy the prover:
- A verification firewall at the external interfaces of an environment that holds model weights. It would select outputs for proof at random. The selection "must remain unpredictable to the datacenter" and happen only after each output is committed 3. Attestable describes its solution as "already practical today" 3.
- Support for pacing agreements. Under agreements that pace AI development, an auditor "could verify that an accounted workload used an approved, unchanged model rather than a newly trained replacement". Where an input classifier is required, a proof could show that the agreed classifier accepted the input 2.