The zk-ML Toolchain in 2026: Which Proving System Ships

For most of its short life, zero-knowledge machine learning was a party trick. A researcher would prove that a tiny neural network had correctly labeled a handwritten digit, the room would applaud, and everyone would quietly agree that anything larger would take longer than the heat death of the universe. In 2026 that framing collapsed. A full language model inference now fits inside a cryptographic proof, the software that produces those proofs has turned into documented, installable tooling, and a small number of live applications pay for verification rather than describing it in a whitepaper.

This is a builder’s map of that shift. It is not a rerun of the question the field asked last year, which was whether zk-ML could ever scale, and it is not the business question of who ultimately foots the bill for a proof. It is the engineering question sitting underneath both: in 2026, which proving systems actually exist, how do they differ, and what have they shipped into production? The answer is messier, and more interesting, than a single winner. The proofs work now. The market has not caught up, the tooling still forces hard trade-offs, and the gap between what is technically possible and what is economically sensible is where the whole sector lives.

What a zk-ML Proof Actually Certifies

Zero-knowledge machine learning, usually shortened to zk-ML, produces a short cryptographic proof that a specific model, run on a specific input, produced a specific output. The verifier checks that proof in milliseconds and never has to rerun the model. Crucially, the proof can hide the model weights, the input, or both, while still guaranteeing the computation was done correctly. The trust assumption shifts from trusting the server that says it ran the model to checking the math yourself.

That distinction is what separates verifiable compute from the much larger market of decentralized compute. Renting a graphics card from a marketplace gets you cheaper inference, but it proves nothing about whether the operator actually ran the model you asked for, or swapped in a smaller, cheaper one and pocketed the difference. A zk-ML proof closes that hole. Vitalik Buterin, in his widely cited essay on the intersection of crypto and AI, sorts the design space into four roles for AI (player, interface, rules of the game, and objective) and singles out verifiable inference as the near-term, tractable piece, while warning that putting an AI in charge of the rules of the game is something to “tread very carefully” around (vitalik.eth.limo). zk-ML lives squarely in the tractable corner: it does not make the model smarter or fairer, it only makes the claim about what the model did checkable by anyone.

The Three Walls That Made zk-ML Look Impossible

To understand why 2026 matters, you have to understand what made zk-ML look hopeless for years. Three technical walls stood in the way.

The first is non-linear operations. Matrix multiplication, the bulk of what a neural network does, is relatively cheap to prove; Buterin has estimated the overhead of proving a matmul at less than four times the raw computation. The trouble is everything in between the matmuls: the ReLU activations, the softmax layers, the argmax that picks the next token. Those non-linear steps do not map cleanly onto the arithmetic a proof system understands, and Buterin puts the overhead for proving them at roughly two hundred times. A model is mostly matmul by operation count, but the non-linear glue is where the proving cost concentrates.

The second wall is floating point. Neural networks train and run in 32-bit floating point, and proof systems work over finite fields of integers. Elena Burger, a deal partner at a16z crypto, put the problem plainly: zero-knowledge proofs “can’t represent 32-bit floating point operations in the necessary arithmetic circuit format without massive overheads” (a16zcrypto.com). The workaround is to quantize the model down to 8-bit integers, but Burger notes that the quantized version is a “crude approximation of the higher-quality initial model.” You either prove a worse model, or you pay the overhead to prove the real one.

The third wall is raw scale. Proving cost grows with the size of the computation, and large models are enormous. The early benchmarks were brutal. Modulus Labs, whose 2023 report “The Cost of Intelligence” was the first serious attempt to measure ZK proving systems on AI workloads, found overheads that made anything beyond toy models impractical. Around the same time, Daniel Kang and collaborators, introducing a system they called TensorPlonk, a graphics processor for zk-ML, noted that proving a single inference of a modestly sized recommendation model with the tooling of the day could take about six hours (medium.com). Six hours for one prediction is not a product.

How the Wall Cracked: Lookups, Sumcheck, and the Retreat From Circuits

The breakthrough of the last two years did not come from faster hardware alone. It came from changing how the proof represents the computation. The older approach arithmetized every operation, including the awkward non-linear ones, into a giant circuit. The newer approach leans on lookup arguments and the sumcheck protocol, which let a prover certify that a value came from a precomputed table (a lookup) rather than re-deriving it from arithmetic gates. For an activation function like ReLU, that is the difference between building a bespoke circuit and simply checking a table.

The sumcheck protocol, and the GKR construction it powers, matter because they let a prover convince a verifier about the result of a layered computation without the verifier re-executing it, and their cost scales far more gently than building explicit constraints for every multiplication and comparison. Combine that with lookup arguments, which turn expensive functions into cheap table reads, and the two techniques together attack exactly the non-linear operations that used to dominate the bill. This is why the 2026 speedups arrived as a step change rather than a steady grind.

Wyatt Benno of ICME Labs, one of the teams behind this shift, framed it bluntly: lookups “eliminate the need for circuit representation entirely.” In ICME’s own benchmarking, a lookup-based prover finished a small zk-ML task in roughly 0.7 seconds against 4 to 5 seconds for the circuit-based baseline (blog.icme.io). That is not a marginal tuning gain; it is a different cost curve.

The most visible proof that the wall had cracked came from Lagrange. Its DeepProve system generated a zero-knowledge proof of a full inference of OpenAI’s GPT-2, which the company describes as the first production-grade zk-ML proof of a complete language model, with Google’s Gemma 3 following and Llama-class models in active development. Lagrange’s own benchmarks put DeepProve’s LLM proof generation at up to sixty times faster than the prior state of the art, with verification hundreds of times faster, while preserving model accuracy (lagrange.dev). When the company open-sourced the system, chief executive Ismael Hishon-Rezaizadeh framed it as a category shift: “We didn’t build DeepProve to own verifiable AI. We built it so nobody had to. AI needs a verification layer, and that layer should be open. Today, DeepProve becomes a primitive. The black box is open” (lagrange.dev).

The zk-ML Toolchain in 2026

A year ago, the zk-ML stack mostly meant one library. Today a builder choosing how to prove a model faces a genuine field of options, each with a different sweet spot. The table below sketches the main contenders as of late August 2026.

EZKL, built by the team at zkonduit, is the reference point. It compiles a model exported to the ONNX format into a Halo2 circuit and needs no cryptography expertise from the user (github.com/zkonduit). Almost every performance claim in the sector is stated as a multiple of EZKL, which tells you how central it became. DeepProve is the speed leader for large models, and unusually for the space it now ships open source with native support for ONNX, safetensors, and GGUF, so a model trained in PyTorch or exported from Hugging Face can pass through unchanged (github.com/Lagrange-Labs). Jolt Atlas takes a16z’s Jolt zkVM and retargets it from general RISC-V instructions to ONNX tensor operations, betting that lookups plus streaming make proving feasible on the device that ran the model rather than in a distant data center (github.com/ICME-Lab).

Two shifts turned this into a toolchain rather than a research pile. The first is that leading systems are now open source and speak the formats teams already use, so adopting one no longer means hiring a cryptographer. The second is the rise of proof marketplaces, which let an application buy proving as a service instead of running its own prover fleet, spreading a heavy fixed cost across many users. Together they push verification from a bespoke research project toward something closer to a cloud utility, which is the precondition for any of it reaching ordinary developers.

Circuits Versus zkVMs: The Architectural Fork

Underneath the product names sits a real architectural choice, and it is worth understanding because it shapes every trade-off downstream. One camp builds a custom circuit for the exact model you want to prove. This is the EZKL lineage. A hand-tuned circuit can be very efficient for that one model, but it is brittle: change the architecture and you rebuild, and complex control flow is painful to express.

The other camp runs the model inside a general-purpose zero-knowledge virtual machine, a zkVM, that can prove the execution of arbitrary programs. RISC Zero and Succinct’s SP1 are the leading examples, both built around the RISC-V instruction set (github.com/succinctlabs). A zkVM is flexible (any program compiles to it) and developer-friendly (you write ordinary code), but proving every low-level instruction is heavier than a purpose-built circuit. Jolt Atlas is the interesting hybrid: a zkVM whose instruction set is tensor operations rather than RISC-V, so it keeps the flexibility of the VM model while cutting the overhead that made general zkVMs slow for machine learning. The 2026 direction is clear, and it runs away from hand-built circuits toward VM-like systems whose non-linear costs are absorbed by lookups.

For a working team the choice is rarely ideological; it is about how often the model changes. If you ship one stable model and need every last drop of efficiency, a hand-tuned circuit still wins. If you iterate constantly, or want to prove a whole pipeline rather than a single forward pass, the VM approach saves you from rebuilding the cryptography every sprint. That is why the momentum sits with the zkVM camp: the models people deploy change faster than anyone wants to re-optimize a circuit for each new version.

What zk-ML Has Actually Proven in the Wild

Benchmarks are one thing; production is another. The list of live zk-ML deployments is still short, but it is no longer empty.

The cleanest example is a dynamic-fee model for the decentralized exchange Uniswap. OpenGradient built the model and used EZKL to generate proofs that the fee a pool charges was set by the agreed model rather than by whoever runs the keeper, so liquidity providers do not have to trust an off-chain operator’s honesty (blog.ezkl.xyz). It is a small, concrete case of a proof standing in for trust where real money moves, exactly the setting where the cost of a proof can be justified. The same logic points at the risk models that govern lending markets, an area where 2026 has already shown what happens when opaque, discretionary parameters go wrong; see our reporting on how DeFi lending broke in 2026.

On the volume side, Lagrange says DeepProve has generated more than twelve million cryptographic proofs since its first full-LLM proof in August 2025, and it ran a public demo, Turing Roulette, in which hundreds of thousands of participants generated millions of live verified inferences (lagrange.dev). Proof marketplaces are the other piece of live infrastructure. Boundless, built on RISC Zero, launched its mainnet on Base in September 2025, letting any application outsource proving to a competitive network of provers. Its chief executive, Shiv Shankar, framed the pitch as access: “For the first time, developers on any chain can access abundant zero-knowledge compute to build complex applications that scale across ecosystems without sacrificing decentralization” (coindesk.com). The honest caveat is that most of these are pilots or infrastructure waiting for demand, not high-volume businesses.

zk-ML Is Not the Only Way to Trust a Model

Cryptographic proofs are the most rigorous way to verify an inference, but they are not the only way, and for many jobs they are overkill. Three other approaches compete for the same problem, each trading away a different corner of what one recent paper called the verifiability trilemma of integrity, latency, and cost.

Trusted execution environments, or TEEs, run the model inside a hardware enclave that attests to what it executed. They are fast, adding only single-digit percentage overhead, which is why Phala Network reports serving billions of confidential model tokens per day. The catch is that you are trusting the chip vendor and betting no one finds a side-channel, a bet that has not always held. Optimistic machine learning, pioneered by Ora Protocol, publishes a result and lets anyone challenge it during a dispute window, cheap to compute but slow to finalize. The crypto-economic route swaps cryptography for money at stake, the model that restaking platforms such as EigenCloud have pushed into AI, where the guarantee is that corrupting a result costs more than it pays. Each is a real answer; zk-ML is the one that removes the trusted party entirely, at the price of the most overhead.

Verifiable Compute Is Not Decentralized Compute

It is easy to lump zk-ML in with the broader AI-crypto sector, but they solve different problems and it is worth keeping them apart. Networks like Bittensor and Akash coordinate a decentralized supply of machine learning work, incentivizing operators to contribute models or graphics cards. Bittensor, the largest AI-crypto project by market value, distributes rewards through an on-chain scoring mechanism; our explainer on Yuma Consensus walks through how it decides who gets paid. But those incentives do not, by themselves, prove that any individual result was computed honestly. zk-ML is the missing verification layer: not a market for compute, but a way to make the output of that compute checkable. In practice the two are complementary, and several decentralized-inference designs now bolt a verification method onto a compute market rather than choosing one over the other.

The Use Cases That Clear the Cost Bar

A proof is worth generating only when the cost of being wrong is higher than the cost of the proof. That rules out most consumer chatbot traffic and points at a few specific settings.

• DeFi with real money on the line. Verifiable dynamic fees, oracle prices derived from models, and on-chain risk parameters are all places where a manipulated inference is directly a theft, so a proof pays for itself.
• Autonomous agents. As AI agents get wallets and start signing transactions, whether an agent actually ran the model it claims becomes a security question. The rise of account abstraction is putting spendable balances behind these agents, and a prompt-injection attack that hijacks one is now a direct financial exploit rather than a curiosity.
• Verifiable oracles and prediction markets. Anywhere a model output settles a payout, a proof removes the operator’s ability to lie about what the model said.
• Compliance and audit. Proving that a deployed model matches an approved, tested version, without exposing the weights, is a natural fit for regulated industries that cannot publish their models but must attest to them.

The Tech-Versus-Token Divergence

Here is the uncomfortable part. The technology shipped, and the tokens did not follow. Every liquid token attached to a verifiable-compute project trades far below its peak, in most cases 90 percent or more below, even as the underlying systems reached production. The figures below are from CoinGecko on 28 August 2026.

The divergence is not evidence the tech failed. It is evidence that shipping a proving system and building a business that sells proofs are different achievements, and that the market is pricing the second one, not the first. The demand question, in other words, is still open, and it is the reason a number of teams that started as pure zk-ML shops (Giza is the clearest case) have pivoted toward selling AI agents or yield products rather than raw verification. When the whole sector’s tokens are down more than 90 percent while the code hits milestones, the market is repeating the same line every quarter: nice proof, who is paying for it?

The Regulatory Pull: Brussels Pushes, Washington Waits

If demand has a catalyst, it is regulation, and here the two sides of the Atlantic are moving in opposite directions. In the European Union, the AI Act reached general applicability on 2 August 2026, with the Commission’s enforcement powers over general-purpose AI models and its transparency rules now live; the heaviest high-risk obligations phase in later, into 2027 and 2028 (digital-strategy.ec.europa.eu). Penalties run up to 35 million euros or 7 percent of global turnover for the worst violations. A regime that demands documentation, evaluation, and provable conformance is, in effect, a demand generator for verifiable inference. Lagrange, citing McKinsey research, says 71 percent of enterprise executives will not scale AI systems without proof of correctness, and Stanford’s AI Index recorded 362 AI-related incidents in 2025, up more than half from the year before (hai.stanford.edu). Whether or not those exact figures hold, the direction of travel is a market that increasingly wants receipts.

In the United States, the posture is quieter. The joint interpretation issued by the SEC and the CFTC in March 2026 named sixteen digital assets as commodities, including tokens like Chainlink’s LINK, but it said nothing about verifiable-compute infrastructure tokens, which leaves projects like Lagrange or Boundless in a case-by-case gray zone under the usual securities analysis. The SEC’s broader pivot from litigation toward rulemaking, which we covered in the agency’s shift from lawsuits to rules, has produced proposed token safe harbors but no specific guidance for AI-crypto infrastructure. For now, American demand for zk-ML is a market story, not a compliance mandate, the reverse of Europe.

What zk-ML Still Cannot Do

The 2026 optimism should not paper over the real limits, because vendors have every incentive to. Four constraints still bind.

First, the floating-point tax has not vanished. Proving a model still tends to mean quantizing it, and a quantized model is a slightly different, usually slightly worse, model than the one you trained. For many tasks the gap is negligible; for some it is not, and you end up proving the wrong thing precisely.

Second, zk-ML only works on models you can actually inspect. A cryptographic proof needs the weights to build the statement being proven, so the largest closed frontier models, the GPT-5-class systems behind an API, cannot be proven this way by an outside party. You can prove an open-weight model end to end; you cannot prove a lab’s latest closed model by pointing a prover at a web endpoint.

Third, GPT-2 is not GPT-5. Proving a full inference of a small language model is a genuine milestone, but the cost still climbs steeply with model size, and the frontier models people actually use are orders of magnitude larger. The wall cracked; it did not disappear.

Fourth, there is a determinism problem. Standard GPU inference is not bit-for-bit reproducible because of floating-point rounding and parallel execution order, yet a proof needs a single deterministic computation to certify. Bridging that gap adds engineering overhead that rarely shows up in the headline benchmarks.

Where zk-ML Goes Next

The clearest trend for the rest of 2026 is convergence. Rather than one approach winning outright, the interesting systems combine them: a fast hardware enclave for latency, a fraud-proof or stochastic zero-knowledge spot-check for integrity, and a proof marketplace to spread the cost. On-device proving, the bet behind Jolt Atlas, would let the same phone or laptop that ran a model also prove it, which changes the economics for consumer applications. And the agent economy, where autonomous programs hold funds and act without a human in the loop, is the use case most likely to make verification non-optional rather than nice to have.

The story of zk-ML in 2026 is that the bottleneck moved. For years the binding constraint was the mathematics: you simply could not prove a real model in a reasonable time. That constraint has loosened dramatically, and lookups, sumcheck, and systems like DeepProve and Jolt Atlas are the reason. What remains is not a physics problem but an economics one. The proofs work. The question the whole sector is now living inside is whether enough applications need them badly enough to pay, and that answer, unlike the cryptography, is not yet settled.

Frequently Asked Questions

What is zk-ML in simple terms?

zk-ML, or zero-knowledge machine learning, is a way to prove that an AI model produced a particular output for a particular input without rerunning the model and, if needed, without revealing the model or the data. A verifier checks a short cryptographic proof in milliseconds instead of trusting whoever ran the model.

Can zk-ML prove a large language model in 2026?

Partly. Lagrange’s DeepProve generated a proof of a full GPT-2 inference, and Google’s Gemma 3 has been proven end to end, with Llama-class models in active development. But frontier models the size of GPT-5 remain far too large and, when closed, cannot be proven by an outside party at all. The wall cracked for smaller models; it has not disappeared for the largest.

How is zk-ML different from a TEE or opML?

All three verify AI computation, but they trust different things. zk-ML trusts only mathematics and reveals nothing, at the cost of the highest overhead. A trusted execution environment (TEE) trusts the chip vendor and is far faster. Optimistic machine learning (opML) trusts that at least one honest party will challenge a bad result during a dispute window, which is cheap but slow to finalize.

Which zk-ML framework should a developer use?

It depends on the model. EZKL is the well-documented baseline for small and mid-sized models. DeepProve is the fastest option for language-model-scale work and now ships open source. Jolt Atlas targets on-device and memory-constrained proving, while general zkVMs like Succinct’s SP1 and RISC Zero’s Boundless suit teams that want to prove arbitrary programs rather than just a model.

Why are zk-ML tokens down so much if the technology works?

Because shipping a proving system and running a business that sells proofs are different things. As of late August 2026, tokens such as LA, PROVE, ZKC, and PHA all trade more than 90 percent below their all-time highs even though their systems reached production. The market is pricing demand, which is still unproven, rather than the engineering, which has largely been solved.

Marcus Okafor covers AI and crypto infrastructure for HOGE Wire.