RISC Zero

RISC Zero implements a zero-knowledge virtual machine built on the open RISC-V instruction set architecture (ISA). This design choice means developers can write programs in standard high-level languages like Rust and C++, which compile to RISC-V binaries. The zkVM then executes these binaries and generates a validity proof attesting that the program ran correctly and produced a specific output. By using a general-purpose ISA rather than a custom circuit language, RISC Zero eliminates the need for developers to learn domain-specific languages like Circom for many applications, dramatically lowering the barrier to entry for verifiable computation.

• Executes unmodified RISC-V ELF binaries
• Supports Rust, C++, and any language targeting RISC-V
• Generates a STARK proof of correct execution
• Separates program logic from cryptographic proving infrastructure

RISC Zero's core proving engine relies on ZK-STARKs (Zero-Knowledge Scalable Transparent Arguments of Knowledge). Unlike SNARK-based systems, STARKs require no trusted setup ceremony, eliminating the security risk of toxic cryptographic waste. STARKs rely on collision-resistant hash functions rather than bilinear pairings, giving them post-quantum security properties. The proving system encodes program execution traces as polynomial constraints, then uses the FRI (Fast Reed-Solomon Interactive Oracle Proof of Proximity) protocol to prove that these constraints are satisfied. STARKs scale efficiently with computation size, making them well-suited for complex workloads.

• No trusted setup required
• Post-quantum secure via hash-based cryptography
• Transparent: all randomness is publicly verifiable
• Proving time scales quasi-linearly with computation size

RISC Zero implements recursive proof composition, a technique where a zero-knowledge proof attests to the validity of one or more previous proofs. This allows the system to compress arbitrarily many proofs into a single constant-size proof. The recursive layer uses a SNARK-friendly circuit to verify STARK proofs, combining STARK's scalability and transparency with SNARK's small proof sizes. This recursion enables proof aggregation across many independent computations and supports continuations—splitting large programs into segments, proving each segment, and recursively combining them into one final proof. The result is a system that can handle unbounded computation while maintaining compact, fast-to-verify proofs.

• Compresses multiple proofs into one constant-size proof
• Enables proof aggregation across independent executions
• Supports continuations for unbounded computation
• Combines STARK scalability with SNARK succinctness

RISC Zero's continuations mechanism splits large program executions into multiple segments, each proved independently, then recursively combines the segment proofs into a single final proof. This breaks through the memory and cycle limitations of a single zkVM instance. Without continuations, a zkVM can only prove computations that fit within its fixed cycle budget. With continuations, the system can handle arbitrarily long computations—from complex machine learning inference to entire blockchain state transitions—by segmenting the execution trace and composing proofs. This is critical for real-world applications that require proving computations far larger than what fits in a single circuit.

• Splits large programs into provable segments
• Recursively combines segment proofs
• Removes cycle budget limitations
• Enables proving of arbitrarily complex workloads

RISC Zero enables zero-knowledge machine learning (zkML) by proving that a specific model inference was executed correctly on a given input without revealing the model weights or the input data. Because the zkVM runs standard RISC-V code, existing ML frameworks can be compiled and executed inside the proving environment. This allows scenarios where a model provider can prove they ran a specific model without disclosing proprietary weights, or a user can prove they possess certain biometric data matching a template without revealing the raw data. zkML on RISC Zero bridges the gap between AI transparency and data privacy.

• Proves correct model inference without revealing weights
• Preserves input data privacy
• Runs standard ML code compiled to RISC-V
• Enables verifiable AI in privacy-sensitive domains