The proof covers a fixed-point approximation, not the floating-point model

Current ZK inference systems prove a quantised version of the network. zkLLM scales values by 2^16 and reports small perplexity changes ¹. Attestable reports quantising matrix multiplications to 8-bit integers while proving other operations in floating point ⁸. A verifier therefore learns about the proof-friendly variant, and must separately accept that this variant is the declared model. Trail of Bits built a ResNet-18 backdoor that is dormant in the full-precision model and active after ezkl's quantisation; whether it persists through proving was left for further investigation ⁶. A verification system design calls floating-point emulation in ZKPs an open problem ¹¹.