zk-ML in 2026: The Proofs Arrived, the Business Blinked
In 2026 zk-ML proved a full language model, cut its biggest cost, and reached the phone. Yet every proving token sits near its lows, and Boundless just paused its proving protocol.
On November 4, the Boundless Foundation told its community that it would pause the zero-knowledge proving protocol it had launched barely fourteen months earlier. New proof requests stop on November 5, reward claims close the same day, and the block explorer goes dark on November 30, according to TokenPost. In its place, Boundless is relaunching its ZKC token as what it calls an AI Access Coin: stake the token, receive credits that buy model inference on a new platform due to open on January 2, 2027, per the project’s own announcement.
Fourteen months earlier, when Boundless put its proving marketplace live on Base, chief executive Shiv Shankar framed it as a milestone for the whole field. For the first time, he told CoinDesk, “developers on any chain can access abundant zero-knowledge compute.” The distance between that promise and this month’s pause is a fair summary of where zk-ML, the practice of proving that a machine-learning model ran correctly, actually stands at the end of 2026.
By any technical measure, it was a breakthrough year. The problem that had defined zk-ML since its inception, that you could not cheaply prove a large neural network had done what it claimed, stopped being a wall. A full language model was proven end to end. A long-standing circuit bottleneck was retired. Proving moved from data-center racks onto ordinary phones. And yet every token tied to the idea trades 90 to 98 percent below its peak, the only coin in the sector that rallied this autumn is a confidential-computing play that asks you to trust a chip instead of mathematics, and the most visible proving market in crypto just blinked. This is the reckoning: what got solved, where it ships, who is building it, why nobody is paying yet, and what the next year has to deliver.
What zk-ML Promised, and Why It Was Hard
zk-ML pairs zero-knowledge proofs with machine-learning inference. A prover runs a model and produces a short proof that the computation was carried out correctly; a verifier checks that proof in seconds or less, without rerunning the model, and if the scheme is designed for it, without ever seeing the model’s weights or the input data. Trust moves from the server that ran the AI to a piece of mathematics anyone can check. In an age where the most capable models are closed black boxes sitting behind an API, that is a powerful pitch: a receipt that the answer you got came from the model you were promised, computed honestly, with nothing swapped or skipped.
The obstacle was always cost. Neural networks are built from two kinds of math. The matrix multiplications that make up the bulk of the work were never the hard part. In his essay on crypto and AI, Ethereum co-founder Vitalik Buterin put the proving overhead for matrix multiplication at “less than 4x.” The trouble was the non-linear pieces, the ReLU and softmax functions between layers, which he estimated at “around 200x,” and for a model the size of a language model that meant proving times he described as taking “hours.” A proof that costs hours and real money to certify a reply that cost a fraction of a cent to generate is a science project, not a product. For most of the field’s life, that was the honest state of play.
The Milestone: Proving a Whole Language Model
In 2026 the science project produced a result. A team at Lagrange, working with academic cryptographers, published a paper titled “Verifiable End-to-End Large Language Model Inference,” describing what they call “the first system to enable efficient end-to-end verification of full LLM inference” on untrusted cloud servers using zero-knowledge proofs. The numbers are modest but real: proving ran at roughly 174 tokens per minute for OpenAI’s GPT-2 and about 86 tokens per minute for Google’s Gemma 3, with verification taking one to 3.7 seconds, and distributed provers pushing throughput to around 1,855 tokens per minute. The paper reports that as 20 to 60 times faster than prior work.
Put plainly: you can now hand an untrusted server a prompt, get back an answer, and get a cryptographic proof that the answer came from the model it claimed, computed correctly, for every generated token. DeepProve, the system behind the paper, had been open-sourced earlier in the year. By the company’s own count it had since generated more than 12 million proofs across 3 million inferences, running 60 times faster at proof generation and hundreds of times faster at verification than the previous best tools, with GPT-2 and Gemma 3 proven end to end and Llama-class models in development. When Lagrange put the code in the open, founder Ismael Hishon-Rezaizadeh described the moment bluntly on the company’s blog: “The black box is open.”
The caveat matters as much as the headline. GPT-2 and Gemma 3 are small by 2026 standards, and frontier-scale models still take hours to prove. The wall did not vanish. It moved, from “impossible in principle” to “expensive at scale,” which is the kind of problem engineers know how to chip away at. That change in category is the real story of the year.
How the Circuit Wall Came Down
The deeper shift was not a single proof but a change in method. For years, zk-ML meant arithmetizing a model: translating every operation into a giant arithmetic circuit that a proof system could digest. Non-linear functions were the costly part, because they had to be approximated with polynomials, and those approximations blew up the size of the circuit. The 2026 answer was to stop drawing those circuits at all, and lean on lookup arguments and the sum-check protocol instead, which turn an expensive operation into a cheap table lookup the prover commits to once.
Wyatt Benno, of ICME Labs, which adapted a16z’s Jolt proving system to machine-learning tensor operations in a project called Jolt Atlas, put it directly in a technical writeup: “lookups eliminate the need for circuit representation entirely.” His benchmark had the lookup-based approach proving a small model in about 0.7 seconds, against four to five seconds for the previous standard tool. The 200x non-linear tax that Buterin had flagged was precisely the thing lookups attacked. Combine cheaper non-linear math with the end-to-end language-model result, and 2026 becomes the year the two hardest technical arguments against zk-ML stopped being true.
Four Ways to Make a Machine Prove Itself
zk-ML is one of four ways crypto proposes to make an AI computation trustworthy, and understanding why its tokens are struggling means seeing what it competes with. Each approach answers the same question, can I trust this output, with a different kind of guarantee and a different price.
| Approach | What it proves | Overhead | Trust assumption |
|---|---|---|---|
| Zero-knowledge (zk-ML) | A short cryptographic proof that the exact computation ran, optionally hiding the model or the data | Historically up to ~200x on non-linear ops; large models still take hours | Mathematics only, trustless. Catch: it usually proves a quantized approximation |
| Trusted execution (TEE) | Hardware attestation that code ran unmodified inside a secure enclave | Under 10 percent on modern GPUs | The chip vendor, plus no physical tampering |
| Optimistic (opML) | Publishes the result, opens a challenge window, settles disputes with a fraud proof | Near zero on the happy path | At least one honest watcher, plus dispute-window delay |
| Crypto-economic | Re-execution by staked operators who are slashed for cheating | Roughly the cost of re-running | Cost to corrupt exceeds the profit; economic, not cryptographic |
Only the first line is trustless in the cryptographer’s sense. The other three trade some assumption, a chip, a watcher, a bond, for speed. That trade is the whole story of the market, and in 2026 the market kept choosing speed.
zk-ML Is Not the Only Way to Keep a Model Private
zk-ML is often confused with the other privacy-preserving methods, and the differences decide where it fits. Fully homomorphic encryption, or FHE, lets a server compute directly on encrypted data, so the input stays hidden even from the machine doing the work; its weakness is that it conceals the input without proving the right model processed it, and it remains orders of magnitude too slow for large models. Secure multi-party computation, or MPC, splits a computation across several parties so none sees the whole input, but it is communication-heavy and assumes the parties do not all collude. A TEE hides data from everyone except the chip, which is fast but returns to the trust-the-vendor problem. zk-ML is the only one of the group that hands you a portable, publicly checkable proof that a specific computation actually happened.
The catch is that a zk-ML prover has to see the data in the clear to prove anything about it. Input privacy therefore only holds when the party that owns the data is also the one generating the proof, which is exactly why client-side proving matters: run the model on your own device, publish the proof, and reveal nothing else. When the secret is the model rather than the data, zk-ML works the other way, letting a company prove that its private weights produced a given output without publishing those weights. In practice the cutting edge is hybrids, pairing zero-knowledge proofs with a TEE or with encryption so a system can hide the input and prove the computation at once. Buterin made the point in the same essay that keeping both the model and the inputs private is possible, “though it gets a bit more complicated,” and much of 2026’s research went into exactly that complication.
Where the Proofs Actually Shipped in 2026
Proofs that work are not the same as proofs people use, but zk-ML did find footholds, mostly where the model is small and the stakes are high enough to justify the overhead.
- On-chain gaming and provable fairness. When an AI opponent or a loot-drop model runs on a server, a proof stops the operator from swapping in a different model mid-game. Early demos, from Modulus Labs’ on-chain AI chess to Lagrange’s Turing Roulette with millions of verified inferences, made the point that a game can be provably fair about its AI, not just its dice.
- DeFi oracles and dynamic pricing. OpenGradient paired with the toolkit EZKL to run a verifiable dynamic-fee model for Uniswap V3, where an AI sets pool fees from volatility and a proof guarantees the model was not tampered with, as EZKL documented. For readers new to how those fees and pools fit together, our explainer on AMM design in 2026 covers the mechanics.
- Autonomous agents. An agent that signs a transaction can attach a proof that its decision came from the model it was supposed to run, not a cheaper or compromised one. As agents start to move money, that receipt is the difference between a tool and a liability.
- Prediction-market resolution. Settling a market on a model’s judgment only works if nobody can rig which model judged. That is the premise behind a wave of AI-settled markets, and our scorecard on how the 2026 midterm markets performed shows how much money now rides on automated resolution.
- Private and on-device inference. The newest frontier moved the prover off the server and onto the user’s phone, which flips zk-ML from an audit tool into a privacy tool. We covered that shift, and its standout use case of proving you are a unique human without handing over your face, in zk-ML on your phone.
A caveat worth keeping is the honest size limit. Polyhedra’s zkPyTorch could prove a mid-size vision network in a couple of seconds per image, while an eight-billion-parameter language model took more than two minutes per token on a single core, by the project’s own figures. Images and small classifiers are practical today. Frontier text generation, on a phone or anywhere else, is not.
The Proving Market That Formed
Generating a proof is the expensive half, so 2026’s business answer was to turn proof generation into a market and let competition drive the price down. Three shapes emerged. Open marketplaces, where any application outsources proving to competing provers, the model Boundless built on the RISC Zero stack, rewarding provers through a mechanism it calls Proof of Verifiable Work that pays out by the volume, speed, and complexity of the work. Staked prover networks, where operators post a bond and are paid to generate proofs, the model behind Succinct’s SP1 and its PROVE token, and Lagrange’s DeepProve and its LA token. And DePIN subnets, where a decentralized network of GPU owners competes for emissions, the model behind Inference Labs’ Omron, a Bittensor subnet that bills itself as the largest decentralized zk-ML proving cluster, settling under a scheme it calls Proof of Inference.
The analogy everyone reached for was Bitcoin mining: pay a network of machines to do useful cryptographic work, and let difficulty and competition sort out who gets paid. The comparison carries a warning, too, because mining’s history is a history of centralization around whoever has the cheapest hardware and power. Our look at how Bitcoin’s hashrate rebounded while difficulty ate the reward is the cautionary tale here: useful-work markets tend to consolidate around industrial operators, and a proving market dominated by a handful of GPU farms is not the decentralization the pitch deck promised.
The Pause Heard Across the Sector
Which brings the story back to Boundless. The project that most loudly sold the open-marketplace model is the one that just stepped back from it. From November 5 it stops taking proof requests; ZKC emissions wind down toward a fixed supply by the end of the quarter; and the token’s job changes from paying provers to buying AI inference credits, with an initial pool of roughly 1,000 dollars in credits distributed every two days to stakers, per the project’s announcement. The proving protocol is paused, not deleted, and the team frames the move as following demand toward inference. But a universal proving marketplace relaunching as a prepaid-inference loyalty program is a demand signal of its own.
It is not the only such signal. Three of the most-watched verifiable-compute teams spent 2026 moving away from selling proofs and toward selling something people already buy.
| Project | 2025 pitch | 2026 move | Token status |
|---|---|---|---|
| Boundless (ZKC) | Universal ZK proving marketplace on Base | Pauses proving on Nov 5; ZKC becomes an AI Access Coin for inference credits | ~98% below high, near a record low |
| Giza (GIZA) | Pure zk-ML inference for on-chain models | Pivoted to AgentFi; flagship is ARMA, an autonomous stablecoin-yield agent on Base | A fraction of a cent, low-six-figure cap |
| Gensyn (token unlaunched) | Verifiable decentralized AI training | Paused its RL Swarm training effort; shipped Delphi, an AI-settled prediction-market platform | No token live at the time of the pivot |
Gensyn had built one of the field’s most ambitious systems, a protocol for verifying AI training across untrusted machines. In 2026 it paused that effort and shipped a prediction-market product instead. Co-founder Ben Fielding told The Block that Delphi would “open up an entirely new category of niche, creator-owned markets that those platforms would never build.” Giza, which started as pure zk-ML at a 2023 conference, now points its engineering at ARMA, a yield-optimizing agent, a pivot reported as it moved from proofs to agents. The pattern is hard to miss, and the Boundless pause only sharpens it.
The Market Backed the Chip, Not the Math
If investors had a thesis in 2026, it was speed over trustlessness, and the clearest evidence is a single token. Phala Network’s PHA, which underwrites confidential computing, the trusted-execution approach where a hardware enclave attests that code ran untouched, was the one name in the sector that climbed this autumn, up more than 40 percent over the trailing month even as the pure proving tokens sank, per CoinGecko. Phala’s case is production, not theory: by its own reporting, its confidential-AI cloud processes more than a billion model tokens a day, with dual attestation from Intel and NVIDIA, figures the project tracks on its site.
The appeal is obvious. TEEs add under 10 percent overhead and scale to real language models today, where zk-ML still chokes on them. The cost is the trust assumption: you are trusting the chipmaker, and the chip can be broken. A hardware attack disclosed in late 2025 and nicknamed TEE.Fail showed that a sub-1,000-dollar memory interposer could extract the signing keys that make TEE attestations trustworthy from Intel, AMD, and NVIDIA parts, as BleepingComputer detailed. For a decentralized GPU network, where the operator holding the hardware is exactly the party you are trying not to trust, that is not a footnote. Still, the market’s verdict for 2026 was blunt: it paid for the thing that works now and trusted the silicon.
One Table Tells the Whole Story
The gap between what the technology achieved and what its tokens are worth is the defining fact of zk-ML in 2026. All figures below are from CoinGecko on November 10, and all of them round to the same conclusion.
| Token | Role | Price (USD) | Market cap | Below all-time high |
|---|---|---|---|---|
| LA (Lagrange) | DeepProve prover network | ~$0.051 | ~$19M | ~97% |
| PROVE (Succinct) | SP1 prover network | ~$0.17 | ~$33M | ~90% |
| ZKC (Boundless) | Proving marketplace (pausing) | ~$0.027 | ~$7.8M | ~98.5%, near a record low |
| PHA (Phala) | Confidential computing (TEE) | ~$0.035 | ~$30M | ~97.5%, but up ~41% in 30 days |
| EIGEN (EigenCloud) | Crypto-economic verification | ~$0.16 | ~$164M | ~97% |
Every one of them is down at least 90 percent from its high. The project that published the year’s defining proof trades near a 19-million-dollar market cap. The marketplace that promised abundant proving for every chain is worth under 8 million dollars and is winding its protocol down. A sector can ship the research and still be priced for failure, and that is the uncomfortable lesson of 2026.
Why the Buyers Have Not Arrived
The missing ingredient is demand that clears the cost, and it has stayed stubbornly prospective. The bull case has always had three lanes. Regulation that forces proof of how an AI decided. Autonomous agents that must prove their actions before other agents or contracts will trust them. And DeFi, where money on the line justifies paying to verify a model. All three are real. None has yet turned into volume.
Lagrange likes to cite McKinsey research that 71 percent of enterprise executives say they will not scale AI without proof of correctness, a figure it put at the center of its DeepProve launch. That may well be true, and it is still not the same as those executives buying zero-knowledge proofs rather than a signed audit log or a hardware attestation. The harder question, the one the Boundless pivot sharpens, is whether verifiable compute needs a token at all. A proof is valuable. A proving-market coin is a separate bet, that the cheapest way to buy that proof is through one particular network’s staking economy, and the price action of 2026 says the market doubts the bet even as it warms to the proof.
Brussels Declares, Washington Stays Quiet
The regulatory split that could change the demand picture widened in 2026. In Europe, the AI Act reached general applicability on August 2, with the Commission and its AI Office gaining enforcement powers and penalties running up to 15 million euros or 3 percent of global turnover for the rules that govern general-purpose models, per the Commission’s framework. That sounds like a tailwind for proof. The catch is in the text: the law requires providers to declare the provenance and training content of their models; it does not require them to prove that any of it is true. A declaration is a document. zk-ML sells proof. The mandate stops exactly where the product begins.
In the United States, the posture is quieter still. The SEC and its sister agency the CFTC spent 2026 sorting which tokens are commodities and which are securities, naming the usual majors like Bitcoin, Ethereum, Solana, and XRP in a joint interpretation, and saying nothing about AI-infrastructure tokens at all; the SEC’s Crypto Task Force has not taken up verifiable compute. That silence leaves builders in a gray zone, neither blessed nor banned. It is a sharp contrast with how fast Washington moved on other crypto questions. The stablecoin rulebook, as we detailed when America finished its stablecoin rules, went from draft to settled law while verifiable AI stayed off the agenda entirely. Proof of reserves, as it happens, is one of the few places the two worlds already touch: a stablecoin issuer proving its backing is the same primitive as a model proving its output.
The Caveats the Breakthroughs Do Not Erase
It would be a mistake to read 2026 as a clean victory lap. Three honest limits survived the breakthroughs, and each one blunts a different part of the pitch.
First, fidelity. A zk-ML proof almost always certifies a quantized, integer version of a model, not the 32-bit floating-point model that is actually deployed. Elena Burger, a deal partner at a16z crypto, has been the plainest voice on this gap. Zero-knowledge proofs, she wrote, “today can’t represent 32-bit floating point operations in the necessary arithmetic circuit format without massive overheads,” which forces a lower-precision stand-in that “might be a crude approximation of the higher-quality initial model.” A mathematically perfect proof of the wrong model is still a proof of the wrong model.
Second, reproducibility. Any scheme that checks an AI’s work by re-running it, which covers both the optimistic and the crypto-economic approaches, assumes the same input produces the same output. On GPUs it does not. A study from Thinking Machines Lab showed that running an identical prompt a thousand times at temperature zero produced 80 different outputs, because server batch sizes shift and change the order in which floating-point operations are summed, as the lab documented. Making inference bit-for-bit reproducible is now its own research effort, and the fixes recentralize toward identical hardware, which cuts against the decentralization story.
Third, and largest, training. Everything above proves inference, a single forward pass. Proving that a model was trained correctly, over millions of steps on a particular dataset, remains aspirational. 2026 made the point vividly. Prime Intellect, a standard-bearer for decentralized training, trained its 106-billion-parameter INTELLECT-3 model on a centralized cluster of 512 H200 GPUs, a choice it made despite its decentralized mission. And Stanford’s AI Index found that 80 of 95 notable 2025 models shipped with no training code at all, with transparency declining even as capability rose. The law wants provenance, the labs are disclosing less, and the technology that could prove it is years from the scale required.
What 2027 Needs
zk-ML enters 2027 in an unusual position: technically closer to its promise than ever, financially priced as if it had failed. For that gap to close, one of three things has to land. A named enterprise buyer that actually pays for proofs rather than runs pilots. A regulatory mandate that requires proving provenance, not merely declaring it. Or a consumer use case, most likely proof of personhood on the phone, where the proof is the product and no token or data center stands between the user and the value.
What 2026 settled is that the engineering is no longer the bottleneck. A full language model can be proven. Non-linear math is cheap. Proofs fit on a handset. The bottleneck is a buyer, and the most telling event of the year was not a benchmark but a retreat: the sector’s flagship proving market deciding that selling inference credits was a better business than selling proofs. The proofs arrived. Whether anyone wants to pay for them is the question 2027 inherits.
Frequently Asked Questions
What is zk-ML (zero-knowledge machine learning)?
zk-ML uses zero-knowledge proofs to show that a machine-learning model produced a specific output from a specific input, computed correctly, without re-running the model and, if desired, without revealing the model’s weights or the input data. It turns the problem of trusting the server that ran the AI into the simpler task of verifying a short cryptographic proof, which a verifier can check in seconds or less.
Did zk-ML prove a full large language model in 2026?
Yes. A Lagrange-led team published a system called DeepProve that generated end-to-end zero-knowledge proofs for full language-model inference, reporting roughly 174 tokens per minute for GPT-2 and about 86 for Gemma 3, with verification in one to 3.7 seconds. Those are small models by 2026 standards, and frontier-scale models still take hours, but the long-standing claim that zk-ML could not handle language models stopped being true.
Why are zk-ML tokens like ZKC, LA, and PROVE down so much?
The technology advanced faster than the demand for it. Every major proving token trades 90 to 98 percent below its all-time high because buyers who pay to verify AI at scale have not materialized, and the sector competes with cheaper trusted-execution hardware. In November 2026 the Boundless project even paused its proving protocol and repurposed its ZKC token toward AI inference credits, underscoring how uncertain the proof-selling business model still is.
What is the difference between zk-ML and a TEE?
zk-ML proves a computation with mathematics, so you trust only the proof, but it is slow and usually certifies a lower-precision version of the model. A trusted execution environment, or TEE, uses a secure hardware enclave that attests the code ran untouched; it adds under 10 percent overhead and scales to large models today, but you have to trust the chip vendor, and researchers have shown those hardware guarantees can be physically broken. In 2026 the market leaned toward TEEs for speed.
Does verifiable AI actually need a crypto token?
Not necessarily, and that is the open question. A proof of correct inference is valuable on its own; a token is useful only if the cheapest way to buy proving capacity is through a particular network’s staking economy. Enterprises may prefer a signed audit log or a hardware attestation, and much of 2026’s token weakness reflects investors doubting that verifiable compute needs its own coin.
Marcus Okafor covers the intersection of artificial intelligence and crypto for HOGE Wire.