zkLLM

What it is

zkLLM is a system for zero-knowledge proofs of inference on large language models. Researchers at the University of Waterloo published it at ACM CCS 2024 ^{1 2}. Its authors call it "the inaugural specialized zero-knowledge proof tailored for LLMs" ¹.

The setting has two parties ¹:

• The prover, such as an AI company, owns a model with a publicly known structure and treats the weights as intellectual property.
• The verifier, such as a regulator, submits a prompt and asks for proof that the output returned is correct for that prompt and the confidential model.

The CUDA implementation is public under an MIT license ². A tagged release, archived on Zenodo, received artifact-evaluation badges ².

How it works

The weights are committed once, using Hyrax commitments over the BLS12-381 curve ¹. For each prompt, the prover shows that the model's tensor operations were computed correctly, using sumcheck-based arguments ¹.

Two new components handle the hard parts of a transformer:

• tlookup is a parallel lookup argument for non-arithmetic tensor operations. The authors state it adds no asymptotic overhead in memory or running time ¹.
• zkAttn is a proof for softmax attention. It splits the exponential into segments, each checked by lookups ¹.

All values are scaled by 2^16 and rounded into a finite field ¹.

The public code works through a LLaMa-2 model one layer at a time:

1. Generate public parameters.
2. Commit the weights.
3. Run the proofs for normalisation, attention and feed-forward components ².

It supports LLaMa-2 models of 7 and 13 billion parameters ².

Evidence

• Setup. The paper reports results on one NVIDIA A100 GPU with 40 GB of memory, 12 CPU cores and 124.5 GB of system memory ¹. The models were OPT (125M to 13B) and LLaMa-2 (7B and 13B), run on 2,048-token samples from C4 ¹.
• LLaMa-2-13B. Proving took 803 seconds and produced a 188 kB proof that verified in 3.95 seconds, using 23.1 GB of memory; the one-time weight commitment took 986 seconds ¹.
• Accuracy. Perplexity changed little: for LLaMa-2-13B it moved from 6.520 to 6.528 ¹.
• Comparison. The authors compare zkLLM with an earlier system, zkML, on the same hardware ¹. zkML ran out of memory beyond the size of GPT-2 (1.5 billion parameters), so its times for larger models are the authors' estimates ¹.
• Artifact evaluation. The artifact received the CCS 2024 badges "Artifacts Available" and "Artifacts Evaluated--Functional" ².
• Use by others. A verification system design for AI agreements uses zkLLM's figure of 803 seconds per 2,048-token forward pass on an A100 to judge ZKP overheads ³.

Limitations

Code maturity. The README states the code "has NOT undergone security auditing and is NOT ready for industrial applications" ². It also names these gaps:

• prover and verifier run side by side;
• intermediate files are not meant as verifier inputs;
• an industrial deployment would need to separate the two parties and apply Fiat–Shamir ².

Maintenance. The repository was archived in July 2025 ². The author states the project is no longer actively maintained ².

Assumptions. The paper assumes a publicly known model structure ¹. Its zero-knowledge guarantee is stated for a semi-honest verifier, which "accurately reports the outcome of the proof verification" but tries to learn the hidden parameters ¹.

Scope. Proofs cover inference only ¹. The authors write that extending zero-knowledge proofs to training LLMs "may pose insurmountable challenges" ¹.

Attacks. As of September 2026 no attack on the soundness of zkLLM's proofs has been published. Its security rests on the paper's soundness and zero-knowledge theorems ¹. An independent analysis, whose setting follows deployments such as zkLLM, shows that valid proofs do not bind the computation spent, so a much smaller model can pass as the declared one ⁴. Its authors demonstrated this with another system, zkGPT, on a small transformer ⁴. See Zero-knowledge proofs of inference.