A model approved the loan. Or flagged the transaction. Or read the scan and returned a diagnosis.
In each case, the party on the receiving end has roughly the operator's word that the right model ran on the right data and produced the stated output. The model itself remains a black box, the data remains hidden, the computation runs on servers belonging to someone else. That is AI's trust problem, and it is structural, not a matter of better intentions.
The radical alternative is zero-knowledge cryptography: mathematical proof that a specific model transformed a specific input into a specific output — verifiable by anyone, while revealing nothing else. No trusted operator required. No private data exposed. Zero-knowledge machine learning (zkML) is the name for this emerging field, an intersection that ranks among the most technically ambitious in modern computing.
A receipt, not a promise
A zero-knowledge proof is a cryptographic technique that lets one party prove a statement is true without revealing why it is true. For AI, the statement takes this form: "this neural network, with these weights, applied to this input, produced this output." The owner compiles the model into a mathematical circuit, runs the computation through it, and produces a compact proof. Anyone with the verification key can check the proof's validity — confirming the computation was performed correctly — without ever seeing the model's weights or the user's private input.
That combination — correctness you can verify, privacy you can keep — is what makes zkML interesting for confidential inference. A hospital could show proof that its diagnostic model produced a given result, without exposing patient data. A lender could offer proof that its credit model followed the logic it published, without giving away the proprietary model itself. In an on-chain game, proof could show that the AI opponent had played fairly. In each case the proof does the work of reputation, contracts and audits, without asking anyone to hand over the thing they most want to protect.
Notice the shape those three examples share: in each, someone must be convinced — a patient, a regulator, a player — and the convincing thing is exactly what cannot be shown. Ordinary transparency solves this by disclosure, and disclosure is what privacy forbids. A zero-knowledge proof refuses the trade: the verifier learns that the computation was done correctly, and literally nothing else.
The pioneers are already shipping
The zkML ecosystem, while young, already has recognizable pioneers. EZKL is a Rust-based open framework that compiles machine learning models — typically in the ONNX open format — into zero-knowledge circuits using Halo2. Developer accessibility is its pitch: a standard trained model goes in and comes out with proofs of inference, verifiable on-chain.
On-chain verification is the demanding version of the idea: a smart contract cannot take anyone's word, call an auditor, or inspect a model without the whole world inspecting it too. If a proof can be checked there — cheaply, publicly, by code — it can be checked anywhere.
Modulus Labs has pushed the "verifiable AI" concept furthest into public demos, building ZK proofs for neural networks from game-playing agents to decision models, under the tagline "AI you can trust, because you can verify." Giza's route differs: it compiles models for Cairo-based proving systems aligned with the StarkNet ecosystem, emphasizing provable AI agents for game logic and on-chain strategy. Alongside them, general-purpose zkVMs (zero-knowledge virtual machines) built by RISC Zero and others can express ML workloads.
The pipeline, laid out concretely: a team trains or selects a model in a standard framework — PyTorch is the common starting point — and exports it to the ONNX open format, which describes the model's architecture and weights portably. Then a zkML compiler — EZKL is the canonical example — turns the ONNX graph into an arithmetic circuit for a proving system such as Halo2, each neural-network layer becoming constraints in a circuit; the art lies in converting efficiently — quantizing weights, choosing circuit-friendly operations, keeping the constraint count manageable. At inference time, the prover runs the model on the private input inside the circuit and generates a succinct proof — typically a few hundred bytes to a few kilobytes, regardless of model size — so verification cost stays roughly constant as the proven computation grows. Anyone — a user, an auditor, a smart contract — checks the proof against the public verification key, and successful verification guarantees the claimed output is correct for the committed model and input. The toolchain is immature compared with mainstream ML deployment, but it is recognizably a toolchain — not a lab curiosity.
A thousand times the cost
An honest accounting of cost should temper enthusiasm for zkML. Compiling a deep neural network into zero-knowledge circuits is extraordinarily expensive — both to set up and to run. Modulus Labs estimates generating proofs for neural network inference carries overhead on the order of 1000x compared with running the model normally — a figure industry analyses cite widely. For a small model, a proof may take seconds; for anything approaching frontier scale, far longer. As of early 2026, proving full-scale large language model inference remains impractical for most production settings, though smaller workloads — image classification, fraud scoring, compact decision models — are within reach.
That is why, in the near term, use cases cluster not around giant models but around small, high-value ones: a credit-risk classifier auditable for fairness, a medical scoring model handling sensitive records, an on-chain agent with trustless logic. For cybersecurity teams: in outsourced inference, an enterprise sends sensitive data to a third-party AI service and today must trust the provider's claims about which model ran and how the data was handled. With zkML, the provider could return the result alongside a proof — the enterprise verifies the proof locally and never needs to trust the provider's word.
Model integrity is another angle: in regulated industries, demonstrating that a deployed model matches the audited, approved version is a compliance headache, and a proving pipeline turns "trust our deployment process" into "verify this proof". In decentralized systems, where no central operator exists to trust at all, verifiable inference may be the only workable foundation — the same verification instinct now reshaping decentralized inference networks that settle for proof over promises.
Hardware offers the cheaper road
Zero-knowledge proofs are not the only route to trustworthy AI inference. The other major approach is confidential computing — running models inside hardware-isolated Trusted Execution Environments (TEEs) that encrypt data in use and produce hardware-signed attestations of what code ran. It is the approach examined in our reporting on how confidential computing protects data even while it is in use, and for large models it is currently the pragmatic one.
Intel's TDX provides confidential virtual machines on the CPU side, while NVIDIA's Confidential Computing extends the trust boundary onto GPUs — Hopper-generation H100 and H200 chips and newer Blackwell hardware — with encrypted memory and transport. For full-scale LLMs, this path offers near-native performance, in many workloads only single-digit-percentage overhead.
As much as it is technical, the tradeoff is philosophical. TEE attestation proves which code executed, but the trust is rooted in the hardware vendor and its attestation service — you trust Intel or NVIDIA, not mathematics. In principle, zkML offers the stronger guarantee (pure cryptographic proof, vendor-independent); in practice, it costs vastly more. In 2026, serious architectures weigh both against the threat model: TEEs where performance matters and a vendor is acceptable, ZK proofs where the guarantee must be absolute.
So where does this go? Roughly where zero-knowledge proofs themselves sat a decade ago is where zkML sits today: demonstrably real, tantalizingly powerful, too expensive for most everyday use. Watch for three things: proving-system performance (Lagrange's DeepProve and Polyhedra have reported major speedups, including transformer-scale demonstrations), model-to-circuit toolchains becoming standardized, and regulated-industry deployments arriving where auditability justifies the cost.
One open question keeps following it around: is zkML quantum-safe? It depends on the proving system. Most deployed zkML uses SNARKs and STARKs with varying assumptions; STARK-based systems, like those in the Cairo/StarkNet lineage, rely on hash functions and are generally more quantum-resistant than pairing-based SNARKs — one more reason the wider post-quantum migration roadmap matters beyond TLS, and why teams watching cloud security's move to eBPF-based observed visibility will recognize the pattern: replace what you assumed with what you can check.
The rollup analogy carries a specific prediction. Zero-knowledge rollups did not win by making proofs cheap in the abstract; they won workload by workload, as proving costs fell through the threshold where each new use case became economical. zkML should be expected to diffuse the same way — fraud scoring and compact decision models first, larger workloads as provers accelerate. A decade from demonstrably real to routinely deployed is the timeline the parent technology already ran.
Culturally, the significance runs deeper: bigger models will not solve AI's trust problem, and neither will better intentions. Mechanisms that make trust unnecessary will. The most principled attempt yet to build such a mechanism is zero-knowledge machine learning. Confidential inference inherits cryptography's oldest scheduling problem: the proofs must outlive the machines trying to break them. That is the logic of the post-quantum migration roadmap — NIST standards, Kyber-768 and TLS 1.3 — which applies to proof systems as much as to key exchange. The deployment pattern is already visible in infrastructure, where zero-knowledge cloud security defends sovereign multi-tenant enclaves against side-channel exploits uses the same primitives this work applies to models.
Sources
- Mitosis University — "How zkML Will Redefine AI x Web3" (EZKL, Giza, Modulus Labs overview): university.mitosis.org
- CoinMonks/Medium — "AI meets Zero Knowledge: what is zkML and why does it matter" (projects, proving systems, use cases): medium.com
- Haseeb Qureshi — "Don't Trust, Verify: An Overview of Decentralized Inference" (three approaches; ~1000x proving cost estimate attributed to Modulus Labs): github.com
