Witness

A witness is the secret data known only to the prover that satisfies a given constraint system. It is the assignment of values to all intermediate variables (the 'wire values') in an arithmetic circuit that makes the circuit evaluate correctly. In a zkML context, the witness typically includes the private model weights, the input data, and all intermediate activation values generated during a forward pass. The prover's fundamental task is to generate a proof that they possess a valid witness without disclosing it.

When proving a machine learning inference, the witness encodes the entire execution trace. This includes:

• Private Inputs: The user's sensitive data (e.g., a medical image).
• Model Weights: The proprietary parameters of the neural network.
• Intermediate State: The output of every matrix multiplication and activation function. The prover demonstrates that applying the committed model to the committed input yields a specific public output, all while keeping the witness hidden.

Witness generation is the process of executing the computation to produce the full assignment of wire values. This step is performed by the prover and is typically the most computationally intensive phase of proof generation. The prover runs the actual machine learning model on the input data to calculate every intermediate tensor. These values are then arranged into a vector that satisfies the Rank-1 Constraint System (R1CS) or Plonkish constraint system representing the model's computation.

In zero-knowledge terminology, the computation's inputs are split into two categories:

• Instance (Public Input): Data known to both the prover and verifier, such as the circuit definition and the claimed output of the inference.
• Witness (Private Input): Data known only to the prover, such as the model weights and the input data. The proof asserts that for the given public instance, there exists a secret witness that satisfies all constraints.

Modern proving systems like Plonk and Halo2 use lookup arguments to optimize non-arithmetic operations. The witness is extended to include entries proving that specific wire values exist within a pre-computed lookup table. For example, an activation function like ReLU can be proven by showing the input-output pair exists in a table of valid ReLU transitions, with the witness containing the necessary sorted and multiplicity data to satisfy the lookup constraint.

A proof system is knowledge-sound if a valid proof implies the prover actually 'knows' a valid witness. Formally, for any prover that generates a convincing proof, there exists an extractor algorithm that can recover the witness by interacting with the prover's internal state. This property guarantees that a valid proof is not a cryptographic fluke but a certificate of genuine computation. In zkSNARKs, this is often proven via knowledge of exponent assumptions.

A set of mathematical equations encoding the valid execution of a computation. The witness is the specific assignment of values that satisfies every constraint in this system. In zkML, the constraint system defines the valid transformations of model weights, and the witness is the actual set of weights and inputs that produce a correct inference. Common formats include Rank-1 Constraint Systems (R1CS) and Plonkish arithmetization.

A directed acyclic graph representing a computation as addition and multiplication gates over a finite field. The circuit defines the structure of a valid computation, while the witness provides the concrete values flowing through each wire. In zkML, a model's forward pass is compiled into an arithmetic circuit, and the witness consists of:

• Private model weights
• Input data
• Intermediate activations
• Final output values

A cryptographic protocol where a prover convinces a verifier of a statement's truth without revealing any information beyond validity. The witness is the secret knowledge the prover possesses that satisfies the statement. In zkML inference, the prover uses the witness (private model weights and input) to generate a proof that the output was computed correctly, without exposing the underlying model architecture or data.

A Zero-Knowledge Succinct Non-Interactive Argument of Knowledge producing constant-size proofs with fast verification. The 'Argument of Knowledge' property cryptographically guarantees that a valid proof could only be generated by a prover who actually knows a satisfying witness. This knowledge soundness ensures that zkML proofs cannot be forged without access to the genuine model weights and inputs.

A standard format for representing arithmetic circuit satisfiability as a set of quadratic constraints of the form (A·w) ∘ (B·w) = C·w, where w is the witness vector. The witness includes:

• Public inputs and outputs (instance)
• Private intermediate values (witness proper)
• The constant 1 for handling addition with constants R1CS is the foundational constraint format for Groth16 and other early zkSNARK constructions.

A cryptographic primitive enabling a proof that attests to correct execution across multiple computational steps while maintaining a verifiable lineage. In recursive zkML pipelines, each step's witness captures the state transition, and PCD composes these into a single proof. This allows verification that a complex multi-stage model pipeline executed correctly without revealing the intermediate witness values at each stage.