Evidence & limits

Evidence

• ZKML. It proved a distilled 81.3-million-parameter GPT-2 in 3,651.67 seconds on a 128-vCPU, 1 TB machine. This was the largest model its authors could prove with under 1 TB of RAM ³.
• South et al. They used ezkl to prove evaluations of small models. A 250,000-parameter nanoGPT took 2,781 seconds to prove and needed a 219 GB proving key ⁵.
• zkLLM. It proved OPT models up to 13B and LLaMa-2 models of 7B and 13B, each proof covering one 2,048-token forward pass on one A100 GPU. LLaMa-2-13B took 803 seconds to prove and 3.95 seconds to verify, with a 188 kB proof ¹. Its code is public ².
• zkGPT. It proved GPT-2 inference in 21.8 seconds with 32 threads on a 16-core CPU server, with a 101 KB non-interactive proof that verifies in 0.35 seconds. Its code is public ¹³.
• NanoZK. It reports proofs of 3.2 to 3.7 KB per attention or MLP sub-circuit, about 83 KB in total for 12 layers. It measured full transformer blocks on CPU only up to width 128. Assuming a GPU speedup, it projects that a 12-layer GPT-2 would take about 14 minutes to prove sequentially ⁴.
• Attestable. It reports proving a 31-billion-parameter Gemma model at 53 tokens per second for one 16K-token sequence on one H100 GPU, with 4.35 to 7.92 MiB proofs and 157 to 648 ms CPU verification. No code or paper accompanies these results ⁸.
• Lagrange DeepProve. Lagrange reports a zero-knowledge proof of full GPT-2 inference ¹⁴. Its public repository, under Lagrange's own licence, reports proving 512 tokens of GPT-2 in 7.6 minutes on a 24-core CPU server with 504 GB of memory, with a 10.7 MiB proof that verifies in 1.3 seconds ¹⁵.
• Independent audit of ezkl. Trail of Bits reviewed the ezkl library in January 2025, at its developer's request. It reported three high-severity circuit soundness issues and four ways to bypass data attestation in ezkl's smart contracts. Its fix review found every high-severity finding resolved ⁶.
• Hollow-LLM attack. Researchers at the University of Southern California ran a ghost-weight attack through zkGPT's proof procedure on a 6-layer, 512-dimensional transformer declared as up to 12 layers and 1,024 dimensions. Outputs were unchanged and serving cost stayed at the small model's level ¹².

A verification system design for AI agreements lists ZKPs as a "tentative plan B" that, if they mature, could "remove the need for secure computing hardware setups" ¹¹.

Limitations

Cost.

• zkLLM needs about 13 minutes (803 seconds) per 2,048-token forward pass at 13B scale on one A100 ¹.
• The verification system design calls the overhead "heavy" ¹¹.
• The survey names "limited circuit expressiveness, high proving cost, and deployment complexity" as the main implementation bottlenecks ⁷.

Expressiveness. ZKML does not support branching or variable-length loops, so language models need fixed-length inputs ³. Floating-point emulation remains open ¹¹. Attestable reports a 16K-token context limit ⁸.

Implementation soundness. In ezkl, Trail of Bits found circuits with missing constraints that "would allow a malicious prover to convince a verifier of incorrect calculations"; these were fixed ⁶. The zkLLM README says its code "has NOT undergone security auditing and is NOT ready for industrial applications". It also says prover and verifier run side by side, and that a deployment would need Fiat–Shamir to be non-interactive ².

Quantisation. Trail of Bits also built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation. Whether it persists through proving was left for further investigation ⁶.

Coverage. A proof covers only the outputs proven ⁹. For accounting of other work, see Proofs of useful work for capacity accounting. A proof also does not show how much computation produced an output. In the Hollow-LLM attack, weights with the declared architecture let a much smaller model do the work, and the proofs remain valid ¹².