What is Zero-Knowledge Machine Learning (zkML)?

Zero-knowledge machine learning is a cryptographic technique that lets one party prove an AI model executed correctly and produced a given output, without revealing the model's weights, the input data, or any intermediate computation. It converts a claim of correctness into a mathematical object anyone can check.

The problem it solves is structural. When you query a hosted model, you send data to a server and receive a result with no way to confirm which model actually ran, whether the output was tampered with, or whether the provider substituted a cheaper model. You trust it completely, which is untenable when the output carries financial, medical, or legal weight.

zkML replaces that trust with verification. The model operator generates a succinct cryptographic proof alongside each inference, attesting that a specific committed model processed a specific input to yield a specific output. The proof contains none of the secrets, yet any third party, including a smart contract, can validate it in milliseconds.

The asymmetry is what makes it viable. Computation can be expensive while verification stays cheap: a prover may burn GPU hours generating the proof, but the receipt verifies in <1 second. That imbalance is precisely what blockchains need, since onchain resources are scarce and consuming an off-chain AI output otherwise requires trusting an oracle.

How Does zkML Work?

zkML translates a neural network's forward pass into a system of arithmetic constraints, then proves a valid assignment to those constraints exists.

Here is how a model moves from training to a verifiable on-chain output:

1. Training: The developer trains a model conventionally, off-chain, using proprietary data and techniques. zkML does not alter training itself, and the resulting weights stay private intellectual property.
2. Export: The finished model is exported to a standard interchange format, typically ONNX or GGUF, which the proving framework can parse into a computational graph of layers and operations.
3. Quantization: Floating-point weights are approximated as fixed-point integers, since ZK circuits operate over finite fields rather than IEEE 754 arithmetic, a step that costs a small amount of accuracy.
4. Compilation: The framework arithmetizes the graph, converting matrix multiplications, convolutions, and non-linear activations into circuits or constraint systems that a proof system can consume.
5. Proving: A prover executes the inference and generates a succinct proof attesting the output derived from the committed model and the given input, using systems like Halo2, GKR, or lookup-based arguments.
6. Verification: Any verifier, a smart contract, an auditor, or a user's device, checks the zero-knowledge proof against public commitments such as a model hash, confirming correctness without exposing weights or raw data.

The quantization step deserves attention because it is where cryptographic rigour meets machine-learning reality. Converting real-valued arithmetic to modular integer arithmetic introduces a typical accuracy penalty of around 0.5% to 2% on benchmark tasks, a trade most applications accept in exchange for provability.

Why Proving Is So Expensive

The cost problem is arithmetic rather than incidental. Encoding every multiplication and activation in a neural network as a constraint inflates the work dramatically, which is why early zkVM approaches carried overheads between 100,000 and 1,000,000 times native inference.

That figure has collapsed. Purpose-built provers, GPU acceleration, and smarter proof systems have driven overhead down toward the 10,000-times range, and specialised frameworks now prove mid-sized models in seconds rather than hours. The trajectory, not the current absolute cost, is what makes the field investable.

Non-linear operations remain the stubborn bottleneck. Activations like ReLU and softmax, along with attention mechanisms in transformers, are cheap in floating-point hardware but expensive to arithmetize, which is why vision models became provable well before language models did.

zkML Frameworks and Tooling in 2026

The tooling layer has consolidated around a handful of serious frameworks, each making a different bet on proof systems and target workloads. These are the projects defining the state of the art:

• DeepProve: Lagrange's GKR-based library, fully open-sourced in June 2026, benchmarks 54 to 158 times faster at proof generation than EZKL and up to 671 times faster at verification.
• EZKL: The long-standing open-source workhorse built on Halo2, which ingests ONNX models and emits EVM-compatible verifiers, making it the default entry point for developers without cryptography backgrounds.
• zkPyTorch: A Polyhedra compiler released in March 2025 that plugs into the PyTorch stack directly, handling quantization automatically and proving the 138-million-parameter VGG-16 in roughly 2.2 seconds.
• JOLT Atlas: An a16z-originated, lookup-centric approach adapted for ML operations, prioritising simple circuit construction and posting strong speedups even before GPU acceleration is applied.
• ZKTorch: A research compiler using parallel proof accumulation, reported to prove GPT-2 roughly six times faster than earlier general-purpose ZKML systems on identical hardware.
• zkVerify: A verification-as-a-service layer supporting multiple proof systems, letting AI pipelines offload proof checking rather than deploying bespoke verifier contracts for every model.

The Benchmark That Changed Expectations

Lagrange's July 2025 milestone reframed what counted as realistic. The team completed a full inference of GPT-2, a 124-million-parameter transformer, making it the first production-ready crypto system to prove an entire language model end to end.

The system then moved from demo to deployment. Lagrange open-sourced DeepProve in June 2026, disclosing more than 12 million cryptographic proofs generated and over 3 million AI inferences verified end to end, alongside partnerships spanning IBM, NVIDIA, Qualcomm, Oracle, Intel, and AWS.

The frontier gap nonetheless remains enormous, and nobody credibly claims otherwise. GPT-2 is four orders of magnitude smaller than today's leading models, so proving a modern frontier system is not merely expensive but economically absurd, and Lagrange's stated next target is Llama and Gemma-class open models rather than anything at the top of the leaderboard.

What changed is the slope of the curve rather than the current ceiling. Parallelised proving across prover clusters, GPU-native algorithm redesigns, and reusable lookup tables are the levers most likely to deliver the next order-of-magnitude unlock, gradually dragging mid-sized open models into provable range.

zkML Use Cases in Crypto

zkML matters most where an AI output carries financial consequence and the parties cannot trust each other. These applications are live or approaching production today:

• Verifiable agents: Autonomous AI agents that trade or manage treasuries can prove each decision followed a disclosed model rather than a secretly swapped one, closing the principal-agent gap.
• Private credit scoring: A lending protocol can confirm a borrower's score clears a threshold without ever seeing balances, transaction history, or identity, since the proof attests the model ran correctly.
• Model provenance: API providers can prove which model actually served a request, preventing silent substitution of a cheaper model while an expensive one is being billed.
• Decentralized inference: Networks that pay nodes to run models use zkML to verify miners genuinely performed the claimed computation, replacing reputation with cryptographic settlement.
• Biometric identity: Systems such as World can let users prove a new biometric template derives from a valid enrolment without centralised re-verification or exposing the underlying scan.
• Content authenticity: Media pipelines can attach proofs showing an asset passed a disclosed detection model, giving regulators an auditable trail without exposing the proprietary classifier.
• Oracle integrity: ML-driven data feeds can prove aggregation logic executed as specified across sources, hardening the bridge between off-chain intelligence and on-chain settlement.

Emerging DeFi Applications

Decentralized finance is the natural first market because it already runs on adversarial assumptions and open-source verification. Risk engines, perpetuals exchanges, and lending markets increasingly want AI-driven parameters without asking users to trust a black box.

The pattern is proof-attached automation. An AI model optimises collateral ratios, liquidation thresholds, or dynamic fees, and the accompanying proof lets the protocol's contracts verify the parameters came from the audited model rather than an operator's discretionary override.

DAO governance is a second frontier, where ML-based voting weights or proposal simulations can be validated without exposing individual holdings. The unifying logic is that automation is only acceptable in trustless systems if the automation itself can be checked.

The zkML Market and Key Projects

Capital and infrastructure have consolidated around a few players building the verifiable AI stack. Understanding who does what clarifies where the sector's real activity sits:

• Lagrange Labs: Operates a proving network where operators stake to bid on proof generation, with a tier-one operator set and DeepProve as its flagship zkML library for AI inference.
• Inference Labs: Raised $6.3 million from investors including Delphi and Mechanism to build Proof of Inference, a protocol securing AI agents through cryptographic verification.
• Bittensor Subnet 2: The largest decentralized zkML proving cluster in operation, having produced over 160 million zero-knowledge proofs while incentivising circuit design and prover optimisation.
• Polyhedra: Delivers the zkPyTorch compiler and the Expander proving backend, pushing the usability frontier so ML engineers can generate proofs without cryptographic expertise.
• Giza: Focuses on deploying verifiable models on-chain and powering autonomous agents, targeting developer accessibility over raw proving throughput.
• EZKL: Maintains the most widely adopted open-source toolkit, audited by Trail of Bits, and functions as the baseline against which newer provers benchmark themselves.

The commercial picture is more mixed than either bulls or bears admit. Verifiable-AI token prices have suffered badly and several trade near all-time lows, yet DeepProve alone has verified over three million inferences and drawn in defence and enterprise partners including Anduril, Lockheed Martin, and IBM, so real usage is accumulating even as public markets discount the sector.

Regulation and the Compliance Case for zkML

Regulatory pressure is the strongest non-crypto argument for verifiable AI. The EU AI Act imposes documentation, traceability, and human-oversight duties on high-risk systems, and cryptographic proofs offer a way to evidence correctness without surrendering proprietary models to auditors.

The timeline shifted materially in 2026. EU lawmakers reached political agreement on 7 May 2026 to defer the heaviest high-risk obligations, pushing Annex III systems such as credit scoring and recruitment to December 2027 and product-embedded systems to August 2028, while transparency duties still land in 2026.

That deferral cuts both ways for zkML. It removes near-term compliance urgency that vendors were counting on, yet it also buys the technology time to mature before the deadlines arrive, since proving costs for genuinely high-risk models remain uncomfortably high today.

The deeper point is that regulation rewards evidence over assertion. Whether the enforcement date is 2026 or 2028, organisations will eventually need to demonstrate that a deployed model behaved as documented, and mathematical proof is a stronger artifact than a policy attestation.

zkML, Digital Identity, and the Age Verification Wave

The largest real-world deployment of zero-knowledge cryptography is not happening in crypto at all. It is happening in digital identity, driven by age verification mandates rolling out across Europe, the UK, and beyond.

This matters for zkML because it builds the credential rails, wallet infrastructure, and public familiarity that verifiable AI will eventually depend on, even though the two technologies solve different problems.

The Global ZK Identity Rollout

The European Commission launched a free, open-source age verification app on 15 April 2026, built on zero-knowledge proof cryptography so users can prove they clear an age threshold without revealing their date of birth or identity. Seven member states, including France, Italy, and Spain, committed to integrating it.

The infrastructure beneath it is larger still. The revised eIDAS Regulation requires every EU member state to offer a Digital Identity Wallet by the end of 2026 and explicitly encourages privacy-enhancing cryptography, while the UK's Online Safety Act and the Digital Services Act supply the enforcement pressure that makes adoption non-optional.

Private industry moved in parallel. Google integrated ZK age verification into Google Wallet with Bumble as a launch partner and open-sourced its ZKP libraries, while Microsoft Research published Vega, its own zero-knowledge system for digital identity credentials.

Where zkML Actually Fits

An important distinction is worth stating plainly, because it is frequently blurred. Proving you are over eighteen from a signed government credential involves no neural network, so it is zero-knowledge cryptography but it is not zkML. The two share mathematics, not machinery.

The genuine overlap lies in age estimation. Platforms facing verification mandates must choose between AI-based estimation, which preserves privacy but misjudges people, and document upload, which is accurate but turns every service into a honeypot for government ID data. Microsoft Research calls this the double bind.

zkML is what dissolves that trade-off. An age-estimation model can run locally on a user's device and emit a proof that the disclosed model executed honestly on a real face scan, so the platform learns only the boolean result while the image, the biometric template, and the model weights never leave the phone.

Chat Control and the Surveillance Debate

The same cryptography sits awkwardly inside Europe's contested Chat Control proposals, where mandatory scanning of private messages has been justified by child-protection goals. Client-side scanning and zkML both promise verification without wholesale data exposure, which makes the framing politically potent.

Critics of these frameworks argue that privacy-preserving verification normalises the demand itself, since a system that repeatedly asks users to prove attributes reshapes internet access regardless of how little data each individual proof leaks. Digital rights groups have pushed back on tying age checks to identity wallets for exactly this reason.

For zkML the lesson is uncomfortable but useful. Cryptographic verifiability is a genuinely powerful privacy tool, yet it is also an enabler of compliance regimes, and the technology's political meaning depends entirely on what institutions choose to demand proof of.

zkML vs Other Verifiable AI Approaches

zkML is not the only way to make AI outputs trustworthy, and it is often not the cheapest. Understanding the alternatives clarifies where cryptographic proof genuinely earns its cost:

• Trusted execution environments: TEEs run models inside secure hardware enclaves and attest to the result, offering far lower overhead but requiring trust in the chip vendor and remaining exposed to side-channel attacks.
• Optimistic verification: Systems assume computations are honest and rely on challengers to dispute them within a window, which is cheap but introduces delay and depends on watchful, economically motivated verifiers.
• Consensus re-execution: Multiple nodes rerun the same inference and compare outputs, a straightforward approach that multiplies compute cost and cannot preserve privacy of inputs or weights.
• Fully homomorphic encryption: FHE computes directly on encrypted data, delivering strong privacy but carrying performance overheads that currently exceed even zkML for most machine-learning workloads.
• Federated learning: Training happens locally and only updates are shared, protecting raw data without proving that any participant computed honestly, which leaves an integrity gap zkML can fill.

The likely outcome is composition rather than a single winner. Hybrid stacks pairing ZK proofs with encrypted computation are already being discussed for the most sensitive cloud workloads, and TEEs may handle throughput while zkML anchors the high-stakes decisions.

Risks and Limitations

zkML's guarantees are real, but so are its constraints, and honest assessment matters more than enthusiasm in a field this early. The key concerns are:

• Cost overhead: Even at roughly 10,000 times native inference, proving remains far too expensive for frontier language models, restricting zkML to smaller, well-defined models for the foreseeable future.
• Accuracy loss: Quantizing floating-point weights into finite-field integers typically costs 0.5% to 2% accuracy, an acceptable trade for many tasks but disqualifying for precision-critical applications.
• Prover centralization: Proof generation increasingly depends on GPU clusters and specialised hardware, concentrating capability among well-capitalised operators and undercutting the decentralization the technology is meant to serve.
• Implementation risk: A proof only attests that a circuit executed correctly, not that the circuit faithfully represents the intended model, so buggy compilation can produce confidently verified nonsense.
• Talent scarcity: The field demands people fluent in both cryptography and machine learning, a narrow intersection that slows enterprise adoption regardless of how good the underlying tooling becomes.
• Token-price disconnect: Verifiable-AI tokens trade near all-time lows despite growing proof volume, so infrastructure usage and token value have decoupled, and holders cannot assume adoption translates into price.
• Competing standards: Lighter-weight agent trust frameworks may satisfy many verification needs without cryptographic proof, capturing use cases zkML expected to own.
• Standards fragmentation: Competing proof systems and incompatible toolchains limit interoperability, and without convergence, adoption could splinter across ecosystems that cannot verify each other's work.

Final Thoughts

zkML has crossed from research curiosity into working infrastructure. A full GPT-2 inference has been proved, mid-sized vision models prove in seconds, and overhead has fallen by two orders of magnitude in roughly two years, a faster improvement curve than most cryptographic primitives ever managed.

The honest constraint is that the gap between what is provable and what is deployed remains wide. Frontier models are four orders of magnitude beyond economic reach, prover hardware is concentrating among well-capitalised operators, and the sector's tokens trade far below their funding-era expectations even as proof volume climbs.

The strategic case rests on where AI is heading rather than where it is. Autonomous agents are beginning to move real capital, regulators are demanding demonstrable model behaviour, and the zero-knowledge identity rails now being deployed across Europe are quietly normalising cryptographic proof as everyday infrastructure. For anyone tracking AI and crypto convergence, zkML is the layer where those trajectories meet.