Evidence & limits

Evidence

• Setup. The paper reports results on one NVIDIA A100 GPU with 40 GB of memory, 12 CPU cores and 124.5 GB of system memory ¹. The models were OPT (125M to 13B) and LLaMa-2 (7B and 13B), run on 2,048-token samples from C4 ¹.
• LLaMa-2-13B. Proving took 803 seconds and produced a 188 kB proof that verified in 3.95 seconds, using 23.1 GB of memory; the one-time weight commitment took 986 seconds ¹.
• Accuracy. Perplexity changed little: for LLaMa-2-13B it moved from 6.520 to 6.528 ¹.
• Comparison. The authors compare zkLLM with an earlier system, zkML, on the same hardware ¹. zkML ran out of memory beyond the size of GPT-2 (1.5 billion parameters), so its times for larger models are the authors' estimates ¹.
• Artifact evaluation. The artifact received the CCS 2024 badges "Artifacts Available" and "Artifacts Evaluated--Functional" ².
• Use by others. A verification system design for AI agreements uses zkLLM's figure of 803 seconds per 2,048-token forward pass on an A100 to judge ZKP overheads ³.

Limitations

Code maturity. The README states the code "has NOT undergone security auditing and is NOT ready for industrial applications" ². It also names these gaps:

• prover and verifier run side by side;
• intermediate files are not meant as verifier inputs;
• an industrial deployment would need to separate the two parties and apply Fiat–Shamir ².

Maintenance. The repository was archived in July 2025 ². The author states the project is no longer actively maintained ².

Assumptions. The paper assumes a publicly known model structure ¹. Its zero-knowledge guarantee is stated for a semi-honest verifier, which "accurately reports the outcome of the proof verification" but tries to learn the hidden parameters ¹.

Scope. Proofs cover inference only ¹. The authors write that extending zero-knowledge proofs to training LLMs "may pose insurmountable challenges" ¹.

Attacks. As of September 2026 no attack on the soundness of zkLLM's proofs has been published. Its security rests on the paper's soundness and zero-knowledge theorems ¹. An independent analysis, whose setting follows deployments such as zkLLM, shows that valid proofs do not bind the computation spent, so a much smaller model can pass as the declared one ⁴. Its authors demonstrated this with another system, zkGPT, on a small transformer ⁴. See Zero-knowledge proofs of inference.