zk-ML in 2026: A Perfect Proof of an Imperfect Model

The proof is perfect. The model is not.

For three years, the honest knock on zero-knowledge machine learning was simple: it could prove a toy and choke on anything real. In 2026 that knock stopped landing. Lagrange says its DeepProve system has generated more than 12 million cryptographic proofs in production and verified over 3 million AI inferences end to end, and it open-sourced the whole thing in June, according to the company’s announcement. A new generation of provers can certify a full language-model forward pass instead of a hand-shrunk classifier. The cryptography caught up.

Which raises the question that actually matters now that the cryptography works: when a zk-ML system hands you a proof, what exactly has it proven? The uncomfortable answer is that it has proven a model, just not the one running in production. To fit a neural network into an arithmetic circuit, the weights get quantized to integers, the activations get rescaled to fixed point, and the smooth 32-bit floating-point math your GPU actually runs gets replaced by something a prime field can represent. The proof that comes out is mathematically airtight. It certifies that a specific computation, on a specific circuit, produced a specific output, with no trusted hardware and no honest-majority assumption. What it does not certify is that the circuit it proved behaves like the model you deployed.

Elena Burger, a deal partner at a16z crypto, named the problem in her write-up on machine learning and zero-knowledge proofs. The model being verified, she wrote, “might be a crude approximation of the higher-quality initial model,” because zero-knowledge proofs today cannot represent 32-bit floating point operations in the necessary arithmetic circuit format without massive overheads. That one sentence is the whole story of zk-ML in 2026. The proofs are real. The gap between the proven model and the deployed model is also real, and closing it is the thing the next two years of this field will be spent on.

This piece is about that gap: where it comes from, how much 2026 shrank it, where it still bites, and why an auditor in Brussels or a lawyer at the SEC might eventually care which version of your model you actually proved.

What zk-ML actually proves

Strip away the acronyms and zero-knowledge machine learning does one thing: it produces a result together with a cheap-to-check cryptographic proof that the result was computed correctly, so a verifier never has to re-run the model. Trust moves from “trust the server that ran the AI” to “check the math.” The proof can also hide inputs, the model weights, or both, which is where the zero-knowledge part earns its name.

It helps to see zk-ML next to its rivals, because they fail differently, and the fidelity gap belongs to zk-ML alone. A trusted execution environment, or TEE, runs your real float model inside a sealed chip and attests that it did; the guarantee is only as good as the chipmaker, and research dubbed TEE.Fail showed attestation keys can be pulled off the memory bus with a rig costing under a thousand dollars. Optimistic machine learning (opML) publishes a result and lets a watcher re-execute and dispute it during a challenge window; it runs the real model but trades latency for its honesty guarantee. Crypto-economic designs, such as the staking-and-slashing model behind EigenCloud, bond the operator’s capital against a wrong answer; the guarantee is economic, not mathematical.

Here is the catch this article turns on. TEE and opML both execute the real model, the same float32 weights you serve to users. zk-ML does not. It is the only approach in the set that has to change the model before it can prove anything about it. That is the price of a guarantee that needs no trusted hardware and no honest watcher: the computation has to be expressed in a form a proof system can digest, and neural networks are not born in that form.

Why the model has to change: floats, fields, and quantization

A proof system works over a finite field, a fixed set of integers with wraparound arithmetic. Your model does not. A trained network is a pile of 32-bit floating-point numbers, and floating point is a format built for a very different machine: it carries a sign, a mantissa, and an exponent, and it rounds in ways that have no clean equivalent in modular integer math. Emulating a single float multiply inside a circuit can cost thousands of constraints. Do that across billions of parameters and the proof becomes impossible to generate in any useful time.

Vitalik Buterin laid out the cost structure in his essay on crypto and AI. Matrix multiplications, the bulk of any model, are relatively cheap to prove, under 4x overhead in his framing. The non-linear operations, the ReLUs and softmaxes that give a network its expressive power, run at around 200x overhead, and proving a ZK-SNARK of a large computation, he noted, can take hours. The circuit does not struggle with the arithmetic that looks like arithmetic. It struggles with everything that looks like a decision.

The standard escape is quantization. Instead of 32-bit floats, you represent weights and activations as small integers, usually 8-bit, and encode the fractional parts as fixed-point values with a chosen scaling factor. EZKL, the most widely used circuit compiler in the field, takes an ONNX model and does exactly this, focusing on networks quantized to int8 and uint8 because, as its documentation and community benchmarks explain, floating point is too expensive to emulate in the prime field. The tool even exposes the tradeoff as a dial: one mode tuned for accuracy with a larger scaling factor, another tuned for resource use on constrained hardware. Turn the dial toward cheaper proofs and you quantize harder; quantize harder and the proven model drifts further from the float original.

Quantization is not a crypto invention. The whole AI industry quantizes models to run them on phones and edge chips, and for many networks an 8-bit version loses only a sliver of accuracy. The difference is what the number is for. In mainstream AI, you quantize the model you are going to ship, so the quantized model is the product. In zk-ML, you often quantize a model purely so it can be proven, while the service your users hit keeps running the full-precision original. That is the moment the proof and the product part ways.

The fidelity gap, defined

Call it the fidelity gap: the distance between the model a zk-ML system proves and the model it is supposed to stand in for. A recent academic survey of verifiable machine learning frames it as a three-way tension between model accuracy, prover time, and the soundness of the numeric model you end up with, and calls making those tradeoffs explicit an open problem. That is the honest version of the pitch.

The subtlety is that soundness and fidelity are not the same thing, and it is easy to conflate them. A zk-ML proof is sound: if it verifies, the quantized circuit really did run on the given input and really did produce the claimed output. No one is faking the computation. But soundness is a statement about the circuit, not about your model. The proof says nothing about whether the quantized circuit would have agreed with your float32 network on that input, or on the next one, or on the adversarial one. You can have a flawless proof of a computation that diverges from your production model exactly where it matters.

For a long stretch the gap was made worse by how circuits handled non-linear functions. A ReLU or a softmax has no cheap polynomial form, so early systems approximated them with low-degree polynomials that were themselves lossy. You were then stacking two approximations, quantization plus a polynomial stand-in for the activation, and proving the result with perfect rigor. The rigor was never the problem. The thing being rigorously proven was already a sketch of the model.

2026 narrowed it: lookups retired the crude approximation

The biggest technical shift of the past year is that the field stopped approximating non-linear functions and started looking them up. Instead of expressing a ReLU as a polynomial, a lookup argument proves that each input-output pair appears in a precomputed table of correct values. The activation is handled exactly, not sketched, and the circuit cost of the hardest operations collapses.

Wyatt Benno of ICME Labs, which adapted a16z’s Jolt virtual machine into a zk-ML prover called Jolt Atlas, put the shift bluntly: traditional circuit approaches are expensive for functions like ReLU and softmax, but lookups eliminate the need for circuit representation entirely. On a multi-class classification benchmark, his team clocked their lookup-based prover at roughly 0.7 seconds for preprocessing, proving, and verification combined, against 4 to 5 seconds for EZKL, a six-to-seven-fold speedup on the same task. Jolt Atlas swaps the general-purpose RISC-V instruction set for ONNX tensor operations and leans on lookups and sumcheck rather than hand-built circuits.

This matters for fidelity, not just speed. Lookups kill one of the two approximations outright. The non-linear layers no longer need a lossy polynomial stand-in; they are computed exactly over the quantized values. That is a genuine narrowing of the gap. What lookups do not touch is the other approximation: the numbers going into the table are still quantized integers, not the floats your model trained on. The sketch got sharper. It is still a sketch.

DeepProve and the end of the toy-model era

If lookups fixed the activations, Lagrange’s DeepProve is what dragged zk-ML off toy models and onto real architectures. The system leans on sumcheck and a lookup-based GKR protocol rather than hand-built circuits, and the company reports proof generation roughly 60 times faster and verification hundreds of times faster than the prior generation of tools. More to the point, it proves things that look like production AI: Lagrange says DeepProve has handled full inference for models including GPT-2 and Google’s Gemma-3, with Llama-class models in active development.

Ismael Hishon-Rezaizadeh, Lagrange’s chief executive, framed the June open-sourcing as a turning point for the category. “We didn’t build DeepProve to own verifiable AI,” he said. “We built it so nobody had to. AI needs a verification layer, and that layer should be open. Today, DeepProve becomes a primitive. The black box is open.” The rhetoric is the point: the field now talks about proving real models as a solved-enough engineering problem rather than a research dream.

Notice what all of this shares. Every one of these systems still operates over a quantized representation of the network. DeepProve ingests models in ONNX, safetensors, and GGUF formats, and GGUF is itself a quantized container. The breakthrough was never that zk-ML learned to prove floats. It was that the proven integer model got close enough to the float model, and fast enough to generate, that people stopped caring about the difference. The gap did not disappear. It became tolerable.

But quantization didn’t go away

The clearest way to see how much is left to do is to look at the numbers Polyhedra publishes for zkPyTorch, its PyTorch-to-circuit compiler. A VGG-16 image classifier with about 15 million parameters proves in roughly 2.2 seconds per image on CIFAR-10. A Llama-3 model with 8 billion parameters proves at around 150 seconds per token on a single CPU core. Per token. A one-paragraph answer is hundreds of tokens, which turns a chatbot reply into hours of proving on that setup. Polyhedra, like everyone else, gets there through what it calls ZKP-friendly quantization.

Two things are true at once. Small and mid-sized models, the classifiers and vision networks that do most of the quiet work in production systems, are genuinely practical to prove, and the quantized version of a well-behaved classifier is often indistinguishable from the float one in output. Large language models are provable in the laboratory and still brutal in the wild, and they are the models most likely to be quantized aggressively precisely because they are so expensive. The fidelity gap is smallest exactly where zk-ML already works, and widest exactly where the hype wants it to go.

When a perfect proof certifies the wrong model

Why does a narrow gap matter if the quantized model is usually close? Because usually is not a threshold a cryptographic system should be proud of, and the failures cluster exactly where decisions are made.

Start with borderline outputs. Quantization nudges every number a little. For most inputs the nudge is invisible, but a model that decides whether a loan clears, whether a transaction is fraud, or whether a piece of content is allowed is a model whose whole job is to draw a line, and a nudge near the line flips the answer. A proof can certify, with total rigor, that the quantized model approved the loan, while the float model you actually run would have denied it. Both statements can be true. The proof does not tell you they disagree.

Then there is binding. A zk-ML proof is bound to a circuit, which is to say to a specific set of quantized weights. Nothing in the proof forces that circuit to be the model serving your users unless you take a separate step: publish a commitment, a hash, of the exact weights you proved, and show that the thing in production matches it. Skip that step and you have built a system where an operator can prove a clean, compliant, quantized model for the auditors while routing real traffic to a different, unproven model. The proof is honest about the circuit and silent about the swap.

This is where it helps to separate proving from auditing, two words the industry uses loosely. A cryptographic proof answers “was this computation performed correctly?” A security audit, the kind firms like CertiK have spent 2026 repositioning as a trust layer, answers a different question: is the thing itself sound, is it the right model, does it do what its owner claims? zk-ML is spectacular at the first question and says nothing about the second. A proof that the wrong model ran correctly is still a proof of the wrong model. The same distinction is why human code auditors are not made redundant by a prover: they certify intent and whether the artifact is even the right one, while the prover only certifies that some artifact executed as written.

The regulator’s question: which model did you prove?

For most of zk-ML’s life this was a connoisseur’s objection. In 2026 it became a compliance question, because the demand story for verifiable AI is increasingly a regulatory one. Lagrange, citing McKinsey research, likes to point out that 71 percent of enterprise executives say they will not scale AI systems without proof of correctness, and Stanford’s 2026 AI Index found the most capable models are now among the least transparent, with its Foundation Model Transparency Index sliding and dozens of notable 2025 models shipping with no training code at all. The appetite for something that can vouch for a model is real and growing.

Europe turned that appetite into law. The EU AI Act’s general-purpose model obligations and the Commission’s enforcement powers became applicable on 2 August 2026, with transparency duties and fines that can reach tens of millions of euros or a percentage of global turnover, according to the Commission’s own regulatory framework. The highest-risk obligations were phased further out, to 2027 and 2028, but the direction is set: providers will have to document and stand behind the models they put on the market. The instant a proof becomes evidence in that process, the auditor’s first question is the one zk-ML has quietly dodged. Which model did you prove, the one quantized for the circuit, or the one your customers are using?

The United States is pulling the other way, which matters for anyone pricing the tokens underneath these systems. The SEC and CFTC spent 2026 clarifying that major assets like Bitcoin and Ether are digital commodities, but their joint work said nothing about AI-infrastructure tokens, leaving provers and compute markets in the same case-by-case gray zone that the agencies’ broader shift from enforcement to rulemaking has left much of the sector in. For a running tally of what Washington actually does next, our regulatory countdown tracks the calendar. The short version: the demand pull for verifiable AI is coming from Brussels, while the SEC is silent on whether the thing selling the picks and shovels is even a security.

The honest fixes

The gap is an engineering problem now, not a theoretical wall, and the fixes are known. They fall into three buckets.

The cleanest fix is to stop running two models. If the quantized network is the one you deploy, there is no gap, because there is only one model and it is the one you proved. This is exactly how on-device zk-ML already works. Client-side provers such as Bionetta, which runs custom networks on a phone and proves them locally, assume the model on the device is the model being proven. When the proven artifact is the product, fidelity is a non-issue by construction. The catch is that this only suits models small enough to quantize without regret, which for now rules out frontier language models.

The second fix is binding. Commit to the exact quantized weights, publish the hash, and make the production system prove it is serving that artifact and no other. This does not close the quantization gap, the proven model is still an approximation, but it closes the swap gap, the far more dangerous hole where an operator proves one model and runs another. Binding turns a proof about some circuit into a proof about this deployed circuit. It is cheap, it is underused, and any serious compliance deployment should insist on it.

The third fix is to pay for precision. EZKL’s accuracy mode, higher fixed-point scaling, and lookups for exact non-linear operations all shrink the numeric distance between the quantized circuit and the float model, at the cost of larger circuits and slower proofs. This is the tradeoff the academic survey called an open problem, and the honest framing for a buyer is that fidelity has a price in proving time, and you should know what you are paying for it rather than accepting whatever the default scale factor hands you.

The tech works. The tokens don’t believe it.

Here is the strangest part of the 2026 picture. The technology shipped, the proofs got real, the gap narrowed, and the tokens attached to all of it are still trading like a failed experiment. Every major asset tied to the verifiable-compute stack sits far below its all-time high, most of them by more than 90 percent, even as the underlying systems hit production volumes they could only dream about a year ago.

All figures from CoinGecko, 17 October 2026; prices move, so treat them as a snapshot. The pattern is the interesting thing. A field can be a technical success and a token graveyard at the same time, which raises the awkward question of whether verifiable compute needs a token at all, or whether proving is a service that gets paid for in dollars and stablecoins like any other cloud primitive. The projects trying hardest to build a real on-chain economy around AI work, like the subnet model explored in Bittensor’s push for a closed-loop internal economy, are wrestling with the same question from the opposite end. Shipping the tech was necessary. It has not been sufficient.

The clearest casualty is Giza, which launched in 2023 as a pure zk-ML platform and has since pivoted toward building autonomous DeFi agents, its original proving ambitions folded into a product with a nearer path to revenue. Its token trades for a fraction of a cent at a market cap in the low hundreds of thousands of dollars, the market’s blunt verdict that proving other people’s models was a harder business than proving it could be done at all. The teams still in the proving race have mostly concluded the same thing, which is why so many of them now sell proofs as a service priced in stablecoins rather than betting the company on token demand.

Where a quantized proof is already enough

None of this means zk-ML is a dead end. It means the fidelity gap is a filter for which problems it solves today, and the problems it solves are the ones where the quantized model is the model, or where being exactly right matters less than being verifiably un-tampered.

Provably fair gaming is the obvious fit. An on-chain game that uses an AI opponent wants a guarantee that the operator did not swap the model mid-match, and it is perfectly happy for that model to be the quantized one, because the quantized one is what everybody agreed to play against. The same logic covers randomness, matchmaking, and any mechanic where the point is that nobody tampered, not that a 32-bit float ran.

DeFi is the second fit, and it is already live. OpenGradient uses EZKL to run a model that sets dynamic fees for a Uniswap pool, with a proof that the fee the pool charged came from the agreed model and not from someone’s thumb on the scale, as the EZKL team describes. The model is small, the quantization is fine, and the value of the proof is that money changed hands according to a rule nobody could quietly rewrite. These are also the places where the line between a clean on-chain model and a manipulated one has real legal weight, the territory our look at trading bots on trial mapped out. In all of these cases the proven model and the deployed model are the same object, so the gap this article is about simply does not open.

On-device biometrics and small classifiers round out the list. A phone proving it ran the agreed face-matching network, a fraud model proving it scored a transaction with the committed weights, a content filter proving it applied the published policy: all small enough to quantize without regret, all cases where the artifact and the proof point at the same thing. The fidelity gap is a frontier-model problem. Most of the useful work is not at the frontier.

What to watch into 2027

Three things will tell you whether the gap is closing or just being papered over. The first is Llama-class proofs. DeepProve proving GPT-2 and Gemma-3 is the toy era ending; DeepProve proving a current open-weight model at a cost someone would actually pay is the real era starting. Watch whether the Llama milestone ships with honest proving-time and fidelity numbers, not just a feasibility headline.

The second is binding becoming boilerplate. If weight commitments and deployed-artifact checks become a default part of every serious zk-ML deployment rather than an afterthought, the swap gap closes even while the quantization gap stays open, and that is most of the practical risk gone. If they do not, expect the first embarrassing story about an operator who proved one model and served another.

The third is whether anyone pays. The EU AI Act’s heavier obligations land in 2027 and 2028, and if compliance teams decide a cryptographic proof is evidence worth buying, the demand that every token in that table above is failing to price finally shows up. If they decide a signed attestation or a trusted auditor’s stamp is good enough, zk-ML stays a beautiful solution looking for a problem large enough to pay its proving bill.

The thing to hold onto is the distinction the whole field spent 2026 blurring. A zk-ML proof is a perfect statement about a computation, and in 2026 that computation finally got close enough to a real model to be worth making. Close enough is not the same as the same. The proofs are real. The gap is real. Knowing which one you are buying is the only way to know what the proof is worth.

Frequently Asked Questions

What is zk-ML (zero-knowledge machine learning)?

zk-ML uses zero-knowledge proofs to show that an AI model was run correctly, producing a cheap-to-check proof so a verifier never has to re-run the model. It can also hide the model weights or the input data. Unlike a trusted execution environment or an optimistic scheme, it relies on cryptography alone, with no trusted hardware and no honest-watcher assumption.

Does a zk-ML proof verify the exact model you are running?

Not necessarily. To fit a neural network into an arithmetic circuit, zk-ML quantizes the weights to integers and uses fixed-point math, so the proof certifies a quantized approximation rather than the original float32 model. The proof is sound about that circuit, but it does not guarantee the circuit behaves identically to the full-precision model in production. Publishing a commitment to the exact proven weights is the way to bind the proof to a specific deployed model.

Why does zk-ML have to quantize AI models?

Proof systems work over finite fields of integers, and 32-bit floating-point arithmetic is extremely expensive to emulate there. Tools like EZKL convert models to int8 or uint8 with a tunable fixed-point scale because floating point would blow up the circuit size. Vitalik Buterin estimated that non-linear operations such as ReLU and softmax run at roughly 200x overhead in a circuit, which is why quantization is the standard entry ticket.

Can zk-ML prove large language models like Llama in 2026?

In the laboratory, yes, but slowly. Lagrange’s DeepProve has proven full inference for models including GPT-2 and Gemma-3, with Llama-class models in active development, and lookups in systems like Jolt Atlas have cut the cost of non-linear layers. But published figures still show an 8-billion-parameter model proving at around 150 seconds per token on a single CPU core, so a full chatbot answer can take hours. Small and mid-sized models are practical today; frontier models are not yet economical.

Is zk-ML better than TEEs or opML for verifiable AI?

It depends on what you are optimizing. zk-ML needs no trusted hardware and no honest watcher, but it is the only approach that changes the model into a quantized circuit before proving it. TEEs and opML both run your real float model, but a TEE asks you to trust the chipmaker and opML adds a dispute-window delay. For small models and trust-minimized settings, zk-ML wins; for low-latency work on large models, TEEs or optimistic schemes often fit better, and 2026 saw a wave of hybrids that mix them.

Marcus Okafor is a senior editor at HOGE Wire covering the intersection of crypto and artificial intelligence.