zkML

A zkML proof cryptographically guarantees that a specific model architecture was executed exactly as claimed on a given input. The verifier can confirm the output was generated by running the correct sequence of tensor operations—matrix multiplications, convolutions, and non-linear activations—without re-executing the model. This property is enforced by encoding the model's forward pass as an arithmetic circuit and generating a succinct proof that the circuit was satisfied.

The prover can demonstrate correct inference while keeping the model's learned parameters—its weights and biases—completely hidden. The proof reveals nothing about the proprietary model beyond what can be inferred from the input-output pair itself. This is achieved through the zero-knowledge property of the underlying proving system:

• The witness (model weights) remains encrypted in the prover's local environment
• The proof is simulatable, meaning a verifier could generate an indistinguishable transcript without access to the real weights
• No gradient leakage or weight extraction is possible from the proof alone

zkML allows a user to submit private data for inference and receive a verified result without the model host ever seeing the raw input. The input is treated as a private witness within the zero-knowledge circuit. This enables scenarios where:

• A patient submits genomic data for a diagnostic model without revealing their DNA sequence
• A financial institution runs credit scoring on encrypted customer records
• An enterprise queries a proprietary model with trade secrets that remain hidden from the model owner

The generated proof is constant-size (often just a few hundred bytes) and can be verified in milliseconds, regardless of the model's complexity. Whether the model has 1 million or 100 billion parameters, the verification cost remains fixed. This is the defining property of zkSNARKs and zkSTARKs:

• Proof size: typically 128–288 bytes for Groth16, ~100 KB for STARKs
• Verification time: O(1) relative to computation size
• Enables on-chain verification of ML inference on resource-constrained environments like Ethereum smart contracts

zkML proofs are generated and verified without any back-and-forth communication between the prover and verifier. The prover produces a single, self-contained proof string that any verifier can check independently. This is achieved through the Fiat-Shamir heuristic, which replaces interactive verifier challenges with the output of a cryptographic hash function. The result is a proof that can be:

• Stored and verified asynchronously
• Broadcast on a blockchain for public verification
• Embedded in an API response for stateless validation

Neural networks rely on floating-point operations, but ZKP systems operate over finite fields using modular arithmetic. zkML bridges this gap by converting models into fixed-point or quantized integer representations that can be expressed as arithmetic circuits. Common approaches include:

• Post-training quantization to int8 or int4 precision
• Replacing softmax and ReLU with polynomial approximations or lookup arguments
• Using lookup tables to efficiently handle non-arithmetic operations like division and comparison
• Frameworks like EZKL and Zator automate this quantization-to-circuit pipeline

The foundational computational representation for all ZKP systems. A directed acyclic graph where nodes are addition and multiplication gates over a finite field. In zkML, a neural network's forward pass—including matrix multiplications and activation functions—must be compiled into an arithmetic circuit before a proof can be generated. The efficiency of this compilation directly impacts prover time.

A Zero-Knowledge Succinct Non-Interactive Argument of Knowledge that produces constant-size proofs and enables fast verification. Key properties for zkML:

• Succinctness: Proof size is small (often < 1 KB) regardless of model complexity
• Non-interactive: A single message from prover to verifier
• Trade-off: Requires a circuit-specific or universal trusted setup ceremony, introducing a security assumption

A Zero-Knowledge Scalable Transparent Argument of Knowledge that relies on collision-resistant hash functions instead of a trusted setup. Advantages for zkML:

• Post-quantum security: Resistant to attacks from quantum computers
• Transparent setup: No toxic waste to manage
• Trade-off: Proofs are larger (often 100s of KB) than zkSNARKs, increasing on-chain verification costs

The secret auxiliary input known only to the prover that satisfies the circuit's constraints. In zkML, the witness typically includes:

• Private model weights: The proprietary parameters of a trained neural network
• Private input data: The user's sensitive data being classified or processed
• Intermediate activations: The hidden layer outputs during inference The witness is never revealed to the verifier, preserving confidentiality.

A technique where a ZKP verifier algorithm is itself expressed as an arithmetic circuit, enabling a single proof to attest to the validity of multiple prior proofs. In zkML, this enables:

• Incremental training verification: Proving each epoch of training was correct
• Proof aggregation: Combining proofs from multiple model inferences into one compact proof
• Constant verification cost: Regardless of how many steps were composed

A sub-protocol that efficiently proves a value exists within a public table, enabling optimized verification of non-arithmetic operations in a circuit. Critical for zkML because:

• Activation functions: ReLU, sigmoid, and GELU are non-linear and expensive as pure gates
• Quantization mapping: Proving correct integer-to-float conversions
• Performance: Reduces circuit size by up to 10x for complex ML operations compared to naive arithmetic gate implementations