Zero-knowledge proofs of training constraints

How it works

A zero-knowledge proof of training (zkPoT) lets a party prove "that they have correctly trained a committed model based on a committed dataset", revealing nothing further about the model or the data ¹. A survey calls this verifiable training: certifying that updated parameters result from the declared procedure ⁴.

Small-scale protocols. Published systems follow three steps:

1. The prover commits to the dataset ^{1 2}.
2. It fixes the data order using verified randomness ².
3. It proves each gradient-descent step: the forward pass, the backward pass and the weight update ².

Kaizen adds three techniques ¹:

• sumcheck-based proofs specialised for gradient descent;
• recursive composition, so that proof size and verifier time do not grow with the number of iterations;
• aggregatable polynomial commitments.

ZkAudit adds proofs of arbitrary audit functions over the committed data and weights ².

A frontier-scale design. Peigné et al. propose a design for frontier training with four parts ³:

• Commitment. Before training, the trainer publishes a hashed commitment that combines the architecture specification, a Merkle root of the dataset and the root of the initial weights ³.
• Hash chain. During training, the GPUs compute Merkle roots of per-layer tensors at every step and publish them in a hash chain ³.
• Network anchor. An auditor-controlled network tap, or an attested SmartNIC, records hashes of traffic between nodes as an independent anchor ³ (see Network taps and certifiers).
• Challenges. After the chain is frozen, the auditor challenges sampled steps. The trainer re-executes those steps, and a zero-knowledge virtual machine, with native precompiles mostly for floating-point operations, checks them against the committed roots ³.

The design also includes genesis proofs and "ex-ante" attestations that enforce policy invariants, such as compute thresholds ³.

What it establishes

What it can establish.

• A zkPoT shows that the committed weights resulted from the declared training procedure on the committed dataset ^{1 2}. This bears on A training run stayed within declared limits.
• Peigné et al. aim to verify further properties: that training followed a pre-committed specification, stayed below compute thresholds and ran on the declared hardware ³.

What it cannot establish.

• That the data is acceptable. A proof binds data to a commitment but does not vet it. ZkAudit does not protect against data poisoning ².
• Every step, in the frontier design. Sparse auditing is "detection-grade, not universal" ³.
• Full confidentiality. ZkAudit reveals the model architecture ².

Threat model

The small-scale systems assume a cheating prover bounded by cryptographic assumptions, and a public training algorithm and architecture ^{1 2}. The frontier design adds trust anchors ³:

• deterministic GPU execution;
• a physical network tap, or secure boot and device identity for the SmartNIC tier;
• the soundness of the zkVM;
• a public proof-checker binary.

It does not cover traffic inside a server, and its SmartNIC tier is weaker against supply-chain adversaries ³.

Evidence

• Kaizen (CCS 2024). It proves training of a 10-million-parameter VGG-11 on CIFAR-10 at batch size 16. The prover takes 15 minutes per iteration; the proof is 1.63 MB and verifies in 130 milliseconds, independent of the number of iterations ¹. Its authors report "24× faster prover time" than generic recursive proof systems ¹.
• ZkAudit (ICML 2024). It proved single SGD steps for MobileNet v2 image classifiers and a recommender model on AWS g4dn.8xlarge instances. Proving one step on a single image took 47.5 to 328.3 seconds for MobileNet v2 (1.0, 224), depending on the fixed-point scale factor. The authors estimated, rather than generated, proofs of full training runs, at costs of hundreds to thousands of dollars ².
• Other systems. The survey lists further verifiable-training systems in its Table IV ⁴.
• The frontier design. Peigné et al. estimate 2 to 10% training-side overhead for a Llama 3.1 405B-scale run, and deployment "within approximately 36 months" ³. The paper reports no prototype or measurements of its own, and marks its target values as "not yet measured" ³.

The zkLLM authors wrote in 2024 that zero-knowledge proofs of LLM training "may pose insurmountable challenges" ⁵.

Limitations

Cost. A 10-million-parameter model needs minutes of proving per step ¹. ZkAudit's authors leave scaling to larger models, such as language models, to future work ².

Open problems in the frontier design. Peigné et al. list 13, including ³:

• zero-knowledge proofs of backpropagation;
• deterministic attention backward passes with under 5% overhead;
• an open-hardware network tap at line rate;
• a way to tell silent data corruption apart from adversarial deviation;
• coverage of mixture-of-experts, reinforcement-learning post-training and multi-site training.

They also report that current deterministic tensor-parallel all-reduce configurations lose 64 to 89% of bandwidth ³.

Attacks. As of September 2026 no attack on these proof systems has been published.