Zero-knowledge proofs of inference

How it works

A zero-knowledge proof of inference lets a prover convince a verifier that an output came from a specific model on a specific input, without revealing the model's weights ⁷. A survey describes ZKPs as letting one party certify that a training, testing or inference result "was produced by the claimed computation without revealing sensitive data or proprietary model parameters" ⁷.

The protocol has two steps:

1. The prover publishes a cryptographic commitment to the weights once. For LLaMa-2-13B, zkLLM's commitment took 986 seconds ¹.
2. For each query, the prover proves that the output equals the committed model applied to the input ^{1 3}. The verifier checks the proof without the weights and without rerunning the model ¹.

The weights are hidden, and the input and output are known to the verifier. In zkLLM's setting the verifier submits the prompt and receives the output with its proof ¹. South et al. likewise keep weights private and inputs and outputs public ⁵.

Systems turn the network's operations into arithmetic over a finite field, with tensors as fixed-point numbers ^{1 3}. Softmax, GELU and normalisation need special handling:

• zkLLM uses a parallel lookup argument (tlookup) and an attention-specific protocol (zkAttn) ¹.
• NanoZK uses 16-bit lookup tables ⁴.

Proof systems differ:

• ZKML compiles models to halo2 circuits with either KZG commitments, which need a trusted setup, or transparent IPA commitments ³.
• zkLLM uses sumcheck-based protocols with Hyrax commitments ¹.
• zkGPT uses the GKR protocol with Lasso lookups and Hyrax commitments, made non-interactive with Fiat–Shamir ¹³.
• NanoZK proves each transformer layer separately and links the layers with a chain of SHA-256 commitments ⁴.
• Attestable reports a prover whose security rests "only on the security of cryptographic hash functions" ⁸.

Proofs over many inputs can be packaged into attestations that a model with fixed private weights reaches a stated benchmark score ⁵.

What it establishes

What it can establish.

• A valid proof shows that the output follows from the committed weights, the public architecture and the input ^{1 3}. This bears directly on whether the declared model is served.
• The weights stay confidential against a verifier that follows the protocol. zkLLM's zero-knowledge theorem shows that such a verifier's view reveals nothing about the weights beyond the output ¹.
• Attestable proposes proofs that an accounted workload "used an approved, unchanged model rather than a newly trained replacement", which bears on whether compute runs inference, not training ⁹.

What it cannot establish.

• Which model the commitment is. The proof does not tie the committed weights to an outside identity such as "the declared model". Proven benchmark results over the committed weights are one way to link them ⁵. Committed weights can also be hollow. Weights with the declared architecture and parameter count can route the work through a much smaller model and still yield valid proofs ¹².
• Work that was not proven. Attestable notes that "a proof of some computation is not a proof of all computation", and that a proof cannot find an undeclared datacenter ⁹.
• Every output, when only some are proven. Assurance from sampling is probabilistic. Attestable proposes selecting outputs at random for proof after they have been committed ¹⁰. NanoZK bounds the chance of detecting tampering when auditors check a subset of layers ⁴.
• The floating-point model. What is proven is a fixed-point approximation of the model ¹. Attestable reports 8-bit integer matrix multiplications ⁸.
• A hidden architecture. ZKML requires the architecture to be revealed ³, and zkLLM assumes it is publicly known ¹.

Threat model

Soundness rests on computational assumptions against a cheating prover:

• zkLLM proves its lookup argument sound: a cheating probabilistic polynomial-time prover succeeds only with negligible probability. The rest of its protocol applies sumcheck and proofs of opening for commitments whose binding rests on discrete-log hardness ¹.
• NanoZK assumes a polynomial-time adversary that controls the inference infrastructure and may substitute models or fabricate outputs. It relies on discrete-log hardness over the Pallas curve and SHA-256 collision resistance ⁴.
• Attestable reports 100-bit security, and post-quantum security because it avoids public-key cryptography ⁸.

Confidentiality rests on further assumptions:

• zkLLM assumes a semi-honest verifier, which "accurately reports the outcome of the proof verification" but tries to learn the weights. Its zero-knowledge theorem also assumes zero-knowledge variants of the sumcheck protocols ¹.
• NanoZK leaves side channels, denial of service and hiding the input from the provider out of scope ⁴.
• Attestable treats physical-access and metadata channels as separate threats ¹⁰.