Verifiable inference & computation

Survey of zero-knowledge machine learning (zkML) research from June 2017 to August 2025. In zkML, zero-knowledge proofs let others check a machine-learning computation without seeing secrets such as model weights. The survey groups the work into verifiable training, testing and inference, and analyzes bottlenecks such as the cost of generating proofs.

Interactive-proof protocol that lets a client check that an untrusted cloud ran neural-network inference correctly. It applies to networks that can be expressed as arithmetic circuits, built only from additions and multiplications.

Presents a zk-SNARK proof of valid inference for an ImageNet-scale model. A zk-SNARK is a short zero-knowledge proof that is quick to verify. The paper also gives protocols that use such proofs to verify the predictions and accuracy of ML services.

Zero-knowledge proof system for large language models. It handles non-arithmetic operations with a lookup argument, which checks values against a precomputed table. A dedicated proof handles attention. The authors report proving a 13-billion-parameter model's inference in under 15 minutes.

Zero-knowledge system, built on the sum-check protocol and lookup arguments, that proves all the tokens generated for a prompt. It was demonstrated on GPT-2 at about 174 proven tokens per minute and on Gemma 3 at about 86.

Library and command-line tool that turns models and other computational graphs exported as ONNX into zk-SNARK circuits. With these circuits, the models' inference can be proven and verified. EZKL can be used from Python, JavaScript or the command line.

The inference provider commits to locality-sensitive hashes of intermediate activations, the values computed inside the model. These hashes stay similar when the activations are similar. A validator can then detect changes to the model, prompt or numerical precision while tolerating differences across GPU types.

Refereed-delegation protocol for ML training and inference. When compute providers disagree, a referee narrows the dispute to a single operator. The protocol comes with RepOps, a library of operators that return bit-for-bit identical results when rerun.

Frames the detection of quantized (reduced-precision), watermarked or fine-tuned models behind an API as a two-sample test. Such a test asks whether two sets of outputs come from the same distribution. The paper reports that 11 of 31 tested endpoints served distributions different from Meta's reference weights.

Auditing framework that checks a small fraction of API requests with verifiable computation, in which the provider returns evidence that a result is correct. It looks for model substitution, quantization abuse and token overbilling, without relying on trusted hardware.

Introduces proof-of-learning, a record of checkpoints (weights saved during training) and training metadata. It lets a verifier check that a party performed the training that produced a set of weights.

Uses higher-precision training and shared rounding decisions to control nondeterminism, the small differences in numerical results across GPU types. An auditor can then replicate training exactly and contest a trainer's result.

Shows that LLM inference servers return different outputs for the same input mainly because their kernels lack batch invariance while server load varies. Without batch invariance, a request's result depends on how many other requests are processed with it. The post demonstrates batch-invariant kernels that made 1,000 temperature-zero completions identical.

Verifiable computation system that compiles a subset of C into a protocol. A worker returns a 288-byte proof of correct execution. Anyone holding the public verification key can check it, typically in about 10 milliseconds. An optional zero-knowledge variant adds little extra cost.

Zero-knowledge proof scheme built on a new sum-check protocol for convolutions. A model owner can use it to prove that a convolutional neural network's prediction came from a secret model, without revealing the model. The scheme can also prove the model's accuracy on a public dataset. For VGG16, the proof took 88.3 seconds to generate and 59.3 milliseconds to verify.

Free draft textbook on interactive proofs, arguments and zero-knowledge proofs. Topics include the sum-check protocol, the Fiat-Shamir transformation, polynomial commitments and SNARKs built from polynomial interactive oracle proofs (IOPs). It links to video lectures.

Presents spoofing attacks on proof-of-learning: the attacker forges a training record for weights it did not train. The attacks reproduce across verification settings at a fraction of the cost of earlier attacks. The authors argue that a provably robust proof-of-learning verifier requires a better understanding of optimization in deep learning.

Defines zero-knowledge proofs of training (zkPoT). Such a proof lets a model owner prove that a model was trained according to a specification, without revealing the data or the model. The authors implement a protocol for logistic regression that combines MPC-in-the-head with zk-SNARKs, and benchmark it on a 4 GB dataset.

Protocol for checking whether a decentralized computing provider ran the requested open-source LLM. The provider returns hidden-layer representations, the model's internal values, along with the generated text. The user checks them with a trained proxy task and a secret mechanism. The authors report false negative rates below 5% and false positive rates below 3%.

Optimistic approach to on-chain machine-learning inference. Instead of zero-knowledge proofs, it relies on an interactive fraud-proof protocol similar to optimistic rollups. A result stands unless someone challenges it. The authors report running a 7B-parameter LLaMA model on a standard PC without a GPU.

Moonshot AI tool that sends 4,000 tool-calling requests to third-party providers of its Kimi K2 models. It measures how closely their decisions on whether to call a tool match Moonshot's official API. It also measures how often their tool-call JSON passes schema validation, a check of its format. The test is now one of the benchmarks in Moonshot's broader Kimi Vendor Verifier.

Packages zk-SNARK proofs of a model's outputs on datasets into evaluation attestations. Each attestation shows that a model with fixed, private weights achieves stated performance or fairness metrics.

Finds that software-only methods cannot reliably detect covert model substitution in LLM APIs. In model substitution, a provider secretly serves a different model from the one it advertises. The paper evaluates trusted execution environments (TEEs) as a way to guarantee model integrity.

Statistical tests of whether two language models, given their weights, were trained from independent random initializations (starting weights). One test, on matched hidden activations, resists adversarial changes and can locate components derived from another model. For example, it shows how Llama 3.1-8B was pruned to initialize Llama 3.2-3B.