Zero-Knowledge Proof (ZKP)

If the statement is true and both the prover and verifier follow the protocol honestly, the verifier will always be convinced.

• Mechanism: An honest prover possessing a valid witness can construct a proof that passes the verifier's polynomial-time check with probability 1.
• Practical implication: A correctly computed zkML inference on a valid model will never be rejected by the verifier. There are no false negatives.
• Contrast: A system lacking completeness would randomly reject valid proofs, making it useless for production verification pipelines.

If the statement is false, no cheating prover can convince the verifier otherwise, except with negligible probability.

• Mechanism: The protocol's mathematical structure binds the prover to a specific computation. Any deviation from the honest arithmetic circuit evaluation is detected through randomized challenges.
• Knowledge soundness: A stronger variant requiring that a prover who passes verification must actually know the witness, not just stumble upon a valid proof.
• Practical implication: A malicious actor cannot forge a proof claiming a model produced a specific output when it did not. This is the bedrock of verifiable inference.

The verifier learns absolutely nothing beyond the single bit of information: 'the statement is true.' No private data is leaked.

• Mechanism: A simulator exists that can generate transcripts indistinguishable from real protocol interactions without access to the witness. This proves the transcript carries zero information.
• Practical implication: In a zkML setting, the verifier confirms the model executed correctly but learns nothing about the proprietary model weights, the user's input data, or intermediate activations.
• Perfect vs. Computational: Perfect zero-knowledge offers information-theoretic privacy, while computational zero-knowledge relies on cryptographic hardness assumptions.

The proof size is small and verification time is fast—ideally logarithmic or constant relative to the computation size.

• Mechanism: Protocols like Groth16 and zkSTARKs use polynomial commitment schemes and interactive oracle proofs to compress the verification workload.
• Practical metrics: A proof for a million-gate circuit can be verified in milliseconds on consumer hardware, with proof sizes measured in hundreds of bytes.
• Critical distinction: Not all ZKPs are succinct. Older systems like Sigma protocols produce proofs linear in the witness size. Succinctness is what makes ZKPs viable for blockchain rollups and on-chain zkML verification.

The proof is a single message from prover to verifier, requiring no back-and-forth communication.

• Mechanism: The Fiat-Shamir heuristic transforms interactive protocols into non-interactive ones by replacing the verifier's random challenges with the output of a cryptographic hash function applied to the transcript so far.
• Practical implication: A proof can be generated offline, stored, and verified asynchronously by anyone at any time. This is essential for decentralized systems where the verifier may not be online during proof generation.
• Common implementations: zkSNARKs and zkSTARKs are inherently non-interactive, while older interactive proofs require this transformation.

The protocol proves not just that a statement is true, but that the prover actually possesses the secret witness that makes it true.

• Mechanism: An extractor algorithm exists that, given oracle access to a successful prover, can efficiently recover the witness. This prevents proofs generated by random luck.
• Practical implication: In zkML, this guarantees the prover actually ran the model with specific weights and inputs—they didn't just find a proof artifact that happens to verify.
• Naming convention: The 'K' in zkSNARK stands for 'Knowledge,' distinguishing these stronger protocols from basic zero-knowledge proofs.

A user submits input data to a remote model and receives an inference result along with a zero-knowledge proof attesting that the output was computed correctly by the claimed model architecture. The model provider never sees the user's raw input, and the user never learns the model's proprietary weights. This is achieved by compiling the forward pass of a neural network into an arithmetic circuit and generating a proof of valid execution. Early implementations use Halo2 or Plonk to prove inference on quantized models, with verification times under 10 seconds for small networks.

A model developer can prove that a specific training procedure was followed—using a defined dataset, hyperparameters, and number of epochs—without revealing the training data itself. This is critical for regulatory audits where a third party must verify that a model was not trained on prohibited data. The training loop is expressed as a constraint system, and a recursive proof composition technique chains together proofs for each gradient update step, culminating in a single proof of end-to-end training integrity.

In cross-silo federated learning, hospitals or banks collaboratively train a model without sharing raw data. ZKPs add a layer of cryptographic accountability: each participant generates a proof that their local model update was computed honestly on their private data according to the agreed-upon algorithm. This prevents data poisoning attacks where a malicious participant submits a corrupted update. The secure aggregation server verifies each proof before incorporating the update, ensuring global model integrity without inspecting individual contributions.

A model developer can sell inference access without exposing their intellectual property. The buyer receives a zkSNARK proof alongside each inference result, cryptographically guaranteeing that the output came from the advertised model. This enables a trustless marketplace where model quality is verifiable without revealing weights. The developer publishes a verification key derived from the model circuit, and any buyer can independently verify proofs on-chain or off-chain, eliminating the need for a trusted intermediary.

Financial institutions and healthcare providers must demonstrate compliance with regulations like GDPR or HIPAA without exposing sensitive records. ZKPs enable selective disclosure of compliance: an auditor receives a proof that a model was trained on data meeting specific criteria (e.g., all subjects consented) without seeing the underlying records. This is implemented using lookup arguments that efficiently prove data attributes fall within allowed ranges or whitelists, creating a tamper-proof, privacy-preserving audit trail.

Decentralized networks of node operators perform inference on behalf of users, with ZKPs ensuring correctness. A user submits an encrypted input, a node computes the output and generates a validity proof, and the proof is verified by the network before the result is accepted. This architecture prevents lazy or malicious nodes from returning arbitrary results to save compute costs. Systems like Nova enable efficient incremental verification, allowing nodes to batch-prove multiple inference requests with sub-linear verification overhead.

A Zero-Knowledge Succinct Non-Interactive Argument of Knowledge that produces constant-size proofs and enables fast verification. Key characteristics:

• Proof Size: Constant, typically a few hundred bytes regardless of computation complexity
• Verification: Extremely fast, often taking only milliseconds
• Setup: Requires a trusted setup ceremony to generate a Common Reference String (CRS)
• Foundation: Relies on elliptic curve pairings for cryptographic security
• Use Case: Ideal for blockchain rollups and scenarios where on-chain verification costs must be minimized

A Zero-Knowledge Scalable Transparent Argument of Knowledge that eliminates the trusted setup requirement. Distinctive features:

• Transparent Setup: Uses publicly verifiable randomness instead of a multi-party ceremony
• Post-Quantum Security: Relies on collision-resistant hash functions, not elliptic curves vulnerable to Shor's algorithm
• Scalability: Prover time scales quasi-linearly with computation size, making it efficient for large circuits
• Proof Size: Larger than SNARKs (typically 10-100 KB), but acceptable for off-chain verification
• Use Case: Preferred in high-security environments where trusted setup risk is unacceptable

A cryptographic primitive allowing a prover to commit to a polynomial and later open it at specific points. Essential properties:

• Binding: The prover cannot change the polynomial after committing
• Hiding: The commitment reveals no information about the polynomial
• Succinctness: The proof size is independent of the polynomial's degree
• Schemes: Includes KZG (pairing-based, requires trusted setup), IPA (inner product arguments, transparent), and FRI (Fast Reed-Solomon IOPP, used in STARKs)
• Role in ZKPs: Serves as the core engine for proving circuit satisfiability efficiently

A technique where a ZKP verifier algorithm is itself expressed as an arithmetic circuit, enabling the creation of a single proof that attests to the validity of multiple prior proofs. Key concepts:

• Incrementally Verifiable Computation (IVC): Maintains a running proof that updates after each computation step
• Proof Carrying Data (PCD): Extends IVC to distributed computations across multiple parties
• Folding Schemes: Used in systems like Nova to defer expensive operations and achieve fast prover times
• Benefit: Enables constant-size proofs for unbounded computations, critical for blockchain scalability
• Application: Powers zkRollups that batch thousands of transactions into a single proof

A directed acyclic graph representing a computation as a series of addition and multiplication gates over a finite field. This is the foundational representation for all ZKP systems:

• Gates: Only two operations—addition and multiplication—over a prime field
• Wires: Connect gates, carrying intermediate values through the computation
• Constraints: Each gate enforces a specific relationship between its input and output wires
• Compilation: High-level programs must be compiled into arithmetic circuits before proof generation
• Optimization: Minimizing the number of multiplication gates is critical, as they dominate prover costs
• Example: A matrix multiplication in zkML is decomposed into thousands of individual field multiplications

The application of zero-knowledge proofs to machine learning, enabling a prover to cryptographically attest to the correctness of a model's inference or training without revealing the model weights or input data. Core challenges:

• Circuit Representation: Neural network operations (ReLU, softmax, convolutions) must be expressed as arithmetic circuits
• Quantization: Floating-point operations are approximated using fixed-point arithmetic over finite fields
• Prover Efficiency: Generating proofs for large models remains computationally intensive
• Verification: The verifier only checks the proof, gaining zero knowledge of the proprietary model
• Use Cases: Private inference as a service, verifiable model provenance, and confidential federated learning aggregation