zk-ML in 2026: Proving the AI You Paid For Actually Ran

Ask a cloud provider to run a large language model for you and you get back an answer. What you do not get is proof. You cannot see which model actually handled your prompt, whether it was the frontier system you paid for or a cheaper, smaller, more heavily quantized stand-in the provider routed in to save money under load. The text reads the same either way. The invoice does too.

That gap, between the answer a server returns and any evidence that the right computation produced it, is the problem zero-knowledge machine learning was built to close. zk-ML lets a prover show that a specific model, run on a specific input, produced a specific output, and lets anyone verify that claim in seconds without rerunning the model or ever seeing its weights. For most of its short life the idea was an elegant dead end: the math worked, but proving anything larger than a toy network cost so much that nobody could justify the bill.

2026 is the year that changed. In a paper posted this autumn, the team behind one of the leading provers described the first system to verify a full LLM inference, every generated token, end to end, with zero-knowledge proofs, running on servers the user has no reason to trust. The cryptography that was supposed to be years away showed up early. The business that was meant to follow it has not.

The receipt problem nobody can solve with a login

Cloud AI is a black box twice over. You cannot inspect the weights, which are the provider’s commercial secret, and you cannot confirm which model ran, because the only thing that crosses the wire is the output. A provider under heavy load has every incentive to quietly shift your request onto a smaller or more aggressively quantized model. Batch routing, spot capacity and tiered hardware make that trivial, and the customer has no instrument to detect it.

An October 2026 survey of the field put the problem plainly: cloud AI users cannot verify which model actually processed their requests. The academic framing is identical. The authors of the year’s headline result write that outsourcing inference “introduces the challenge of verifying that the returned output is the genuine result of the specified model.”

The stakes rise the moment software, rather than a person, acts on the answer. An autonomous agent that reads a model’s output and then signs a transaction, rebalances a portfolio or approves a payout is trusting a computation it cannot see. If the inference was wrong, swapped or tampered with, the money is already gone by the time anyone notices. A receipt that can be checked after the fact, cheaply, by anyone, is the missing primitive, and it is exactly what zero-knowledge proofs are supposed to provide.

What zk-ML actually is

Zero-knowledge machine learning points a decades-old branch of cryptography at a new target. A zero-knowledge proof lets one party convince another that a statement is true while revealing nothing beyond the fact of its truth. Aim that tool at an AI model and the statement becomes: this exact model, run on this input, produced this output. The prover does the heavy work once and emits a small proof; the verifier checks it in seconds, with no model, no weights and no second GPU.

The change is in where trust lives. Instead of trusting a server that says it ran some model, you verify a proof that is false unless that model actually ran. zk-ML can also hide things on purpose: the weights, so a provider proves its model behaved without open-sourcing it; the input, so a user proves a result without handing over private data; or both at once. That optional privacy is what separates it from every other way of making AI checkable.

One line is worth drawing early. Renting GPUs from a decentralized marketplace is not the same as proving they were used honestly. Networks that sell raw compute move the work off one company’s servers, but they do not, by themselves, produce evidence that the advertised model ran. Ethereum co-founder Vitalik Buterin made the underlying point in his widely cited essay on crypto and AI: “the greatest part of an AI computation is matrix multiplications, for which it is possible to make very efficient ZK-SNARKs,” with matrix multiplication adding less than four times the cost. The trouble was always everything else in the network.

How a proof of inference gets made

Turning a neural network into something a zero-knowledge system can prove is a pipeline, and each stage either leaks a little fidelity or costs a lot of compute.

• Train and export. The model is frozen and exported to a portable format, usually ONNX, so the prover can read its structure one operation at a time.
• Quantize. Weights and activations are converted from 32-bit floating point to integers, because zero-knowledge systems work over finite fields and cannot represent floats natively.
• Arithmetize. Every operation, each multiply and each activation function, is rewritten as arithmetic constraints the proof system can enforce.
• Prove. The prover runs the model and generates a cryptographic proof that all of those constraints held for this specific run. This is the expensive step.
• Verify. Anyone, including a smart contract, checks the proof. For the leading LLM prover this now takes between one and 3.7 seconds, no matter how long the model itself ran.

The asymmetry is the whole point. Proving is heavy and slow; verifying is light and fast. A chain of thousands of nodes, or a single phone, can confirm in seconds a computation that took a data center minutes to prove. The catch, for years, was that minutes was an optimistic word by several orders of magnitude.

The three walls that made this look impossible

Three technical walls kept zk-ML stuck on toy models for most of its life.

Non-linear operations. Matrix multiplication is cheap to prove, but the functions that sit between the matrix layers, the ReLUs, the softmaxes, the attention normalizations, are not. Buterin’s own estimate is that proving the non-linear parts of a model carries “around 200x” the overhead of simply running them, against less than four times for the matrix multiplications. A modern transformer is built out of exactly those awkward operations.

Floating point. Neural networks compute in 32-bit floats; proof circuits cannot. Elena Burger, a deal partner at a16z crypto, put it bluntly in the firm’s analysis of machine learning and zero-knowledge proofs: “zero-knowledge proofs today can’t represent 32-bit floating point operations in the necessary arithmetic circuit format without massive overheads.” The workaround, quantizing down to 8-bit integers, makes proving feasible but turns the proven model into what she calls a “crude approximation of the higher-quality initial model.” You can end up proving that a slightly different model ran.

Scale. Proof cost grows faster than model size, so the gap widens as models get bigger, not smaller. Buterin noted that a zero-knowledge proof of a single Ethereum block “can take hours,” and an AI model dwarfs a block. The field’s origin benchmark, Modulus Labs’ 2023 report The Cost of Intelligence, and later work on GPU-accelerated provers from researchers such as Daniel Kang, whose writing on scaling zkML became a reference point, found that proving even a modest recommendation model could run to roughly six hours for a single example. That is the number everyone has spent three years trying to kill.

2026: the wall cracks

The breakthrough was not a faster computer. It was a change in how the computation gets expressed. Instead of forcing every awkward non-linear function into arithmetic constraints, the newest systems lean on lookup arguments and a technique called sumcheck, which let a prover attest that a value came from a precomputed table rather than proving the function line by line. Wyatt Benno of ICME Labs, which adapted a16z’s Jolt proving system to machine-learning operations in a project called Jolt Atlas, described the shift in a sentence: lookups “eliminate the need for circuit representation entirely.” The operations that cost 200x suddenly cost close to nothing.

The system that turned that idea into a headline is DeepProve, built by Lagrange and open-sourced in June 2026 after generating more than 12 million proofs and verifying over 3 million inferences end to end. Lagrange reported proof generation up to 60 times faster and verification up to 671 times faster than the prior state of the art, with GPT-2 and Google’s Gemma 3 proven end to end and Llama-class models in active development. Founder and chief executive Ismael Hishon-Rezaizadeh framed the open-source release in deliberately uncommercial terms: “We didn’t build DeepProve to own verifiable AI. We built it so nobody had to. AI needs a verification layer, and that layer should be open. Today, DeepProve becomes a primitive. The black box is open.”

The engineering trick under the hood is worth naming, because it explains why the curve bent so fast. Rather than proving a giant model as one monolithic circuit, the newer provers break the work into pieces a verifier can spot-check with sumcheck, lean on lookup tables for the expensive non-linear steps, and split the proving itself across many machines so the job finishes in parallel. None of that makes the raw computation cheaper; it makes the proof of the computation tractable, which is a different and, until recently, unsolved problem. The result is a system where adding hardware buys more throughput, the same scaling property that made ordinary cloud inference practical in the first place.

The formal result landed this autumn. In a paper titled Verifiable End-to-End Large Language Model Inference, a team of Lagrange engineers and academic cryptographers described “the first system to enable efficient end-to-end verification of full LLM inference,” meaning every generated token of a prompt, on untrusted cloud servers. The reported numbers are concrete: proving GPT-2 at about 174 tokens per minute, 20 to 60 times faster than prior work, Gemma 3 at about 86 tokens per minute, scaling to 1,855 tokens per minute across distributed provers, with verification in one to 3.7 seconds. For the first time the claim is not a benchmark on a single classifier; it is a whole language model, proven token by token.

The honesty clause matters. GPT-2 dates to 2019; Gemma 3 is small; neither is the frontier system most people actually query. Proving is still enormously expensive: the October 2026 review of the field pegged small networks at six to 41 seconds per inference and estimated roughly three hours to prove a single inference of a 100-million-parameter model. zk-ML did not become cheap in 2026. It became possible, which after years of impossible is the harder jump to make.

zk-ML is not the only way to get a receipt

Cryptographic proof is the strongest form of verifiable AI, and the slowest. Three other approaches trade some of that rigor for speed or cost, and in 2026 all four are shipping in some form.

Optimistic machine learning, or opML, borrows the logic of optimistic rollups: publish the result, open a challenge window and let anyone submit a fraud proof if it is wrong. It is far cheaper than zk-ML but adds dispute-window latency and assumes at least one honest watcher is paying attention. The approach spread widely in 2026 even as its flagship token cratered, a story told in HOGE Wire’s look at opML’s collapse. Trusted execution environments, or TEEs, take the opposite tack: run the model inside a secure hardware enclave on an Intel or NVIDIA chip and let the chip attest that the code was not tampered with. TEEs are fast, adding roughly single-digit to mid-teens percentage overhead, but the trust rests on the chipmaker, and the hardware can break, as 2026’s wave of physical attacks on confidential-computing chips showed, the same hardware-trust question that runs through October’s wallet-security scares. Crypto-economic systems skip proofs entirely and bond the operator with slashable stake, making dishonesty expensive rather than impossible.

The privacy twist, and the move onto your phone

zk-ML is the only one of the four approaches that can prove a computation and hide its inputs at the same time. That makes it the natural fit for anything where the data is the sensitive part: a medical model that reads a scan, a credit model that reads a bank statement, an identity check that reads a face. Buterin’s essay is careful about the limits here: “If we want to keep the model and the inputs private, we can, though it gets a bit more complicated.”

The complication is real and easy to miss. The prover has to see the data in the clear in order to prove anything about it. So input privacy only works in two shapes: either the data owner runs the proof themselves, on their own device, or only the model is kept private while the input stays public. The first shape, client-side proving, is the quiet unlock of 2026. A research effort called Bionetta reported proving custom neural networks fast enough to run on a mobile phone, and claimed to be the only such scheme deployable on native Ethereum smart contracts without an overwhelming proof size. The widely used EZKL toolkit targets general models up to tens of millions of parameters with both client-side and on-chain verification.

Move the prover onto the user’s device and the trust model flips in the user’s favor. Your phone, not a server farm, becomes the place where the sensitive computation happens and the proof is signed, which is the same logic that makes a self-custody wallet safer than an exchange: the secret never leaves the device. The marquee use case is proof of personhood: show that your biometrics matched an enrolled template, and that a genuine model did the matching, without ever uploading the biometric itself.

Where zk-ML actually ships today

Strip away the roadmaps and a handful of live deployments remain, most of them small and several of them games.

In DeFi, the clearest production case is a verifiable dynamic-fee model for Uniswap, built by OpenGradient on EZKL, where an AI sets pool fees based on volatility and a proof guarantees the deployed model, rather than a tampered one, produced the number. OpenGradient describes its network as an AI coprocessor whose validators verify every proof before a result is committed on-chain. In gaming, Lagrange’s public demo Turing Roulette drew more than 500,000 participants and verified 3.7 million live inferences, and Modulus Labs’ earlier Leela vs the World, billed as the first on-chain AI game, proved every move of an AI chess opponent so the operator could not swap the model mid-match. The thread is provably fair, extended from dice rolls to neural networks.

The rest is oracles and agents. A price or risk oracle that runs a model can attach a proof so downstream contracts know the number was not fabricated, and an autonomous agent can prove it ran the model it claims before it acts on the result. These are real, but they are demos and narrow pilots, not volume. The proofs work. The queue of paying customers does not yet stretch around the block.

A newer frontier is provenance. The same European transparency rules that will require AI-generated images and text to be labeled create a natural home for proofs that attest where a piece of content came from and which model produced it, and zero-knowledge approaches to dataset and training provenance are already turning up in research. Proving what a model was trained on, rather than only what it produced, is the harder half of the problem and remains mostly unsolved, but it is the version regulators and rights holders keep asking for. If any single use case drags zk-ML from demo into obligation, a content-provenance mandate is the likeliest candidate.

The determinism catch underneath all of it

A problem lurks below every one of these approaches: you cannot verify what you cannot reproduce, and GPU inference is not reproducible by default. Researchers at Thinking Machines Lab showed that running the same prompt through a large model a thousand times at temperature zero, a setting that should be deterministic, produced 80 different outputs, because server batch sizes vary with load and change the order in which floating-point operations are summed. The culprit is not randomness; it is the hardware’s own scheduling.

That quietly shapes everything above it. zk-ML needs a fixed, integer trace to prove against, which is part of why quantization and fixed-point arithmetic are baked in rather than bolted on. opML’s fraud proof only works if an honest challenger can re-run the computation and get a bit-identical answer. Crypto-economic slashing needs a single canonical result to call someone wrong against. The 2026 fixes, batch-invariant kernels and deterministic inference engines that make every honest run produce the same bytes, collapse verification into a plain equality check. They also, for now, tend to require identical GPU models on every machine, which pulls against the decentralized hardware markets that were supposed to run all of this.

The tech-token paradox

Here is the uncomfortable part for anyone holding a token. The technology shipped, and the tokens did not follow. Every major proving-network token trades far below its all-time high, in several cases by more than 95 percent, despite live, credible and steadily improving infrastructure.

Figures are from CoinGecko as of October 31, 2026, and the footnotes make the gap worse, not better. Lagrange’s circulating supply has swollen past 357 million tokens, so even a flat price means steady dilution. EIGEN, the largest of the group, slid further in late October as the market absorbed the fallout from a multibillion-dollar exchange breach that soaked up all the attention and all the on-chain predators, the subject of HOGE Wire’s account of the Binance hack feeding frenzy.

The deeper reason is structural. Markets do not know how to price an infrastructure primitive that might not need a token at all. DeepProve is open-source software; EZKL markets itself as usable with no cryptocurrency knowledge whatsoever. One of the field’s pioneers, Giza, abandoned pure zkML for an agent-finance product after deciding the proving business was too hard to monetize, and its token now trades near zero. The dislocation is familiar from elsewhere in the AI-crypto corner, where a wound-down fund’s token still changes hands on narrative alone. When the product can be free and the moat is engineering talent, it is not obvious what the token is for.

There is a bull case buried in the gloom. If proving becomes a metered network service, with provers staking, competing and getting slashed for bad work, a token can capture real fees the way a chain captures gas. That is the bet behind the staked prover networks and proof marketplaces now live, and it is why the sector keeps shipping through a brutal market. The open question is whether paid demand arrives before the runway, denominated in token price, runs out.

So who actually pays for a proof?

Demand has to clear a real cost, and today it clears in only a few narrow lanes.

The first is compliance. The European Union’s AI Act began applying its general-purpose AI rules in August 2025, with broad applicability, transparency duties and Commission enforcement arriving in August 2026 and penalties reaching 15 million euros or three percent of global turnover; the Act’s heavier high-risk obligations were pushed out to 2027 and 2028. None of that mandates cryptographic proof, but it creates an auditability pull: a documented, checkable record that a given model produced a given output is exactly what an auditor wants on file. Lagrange, citing McKinsey research, says 71 percent of enterprise executives will not scale AI systems without proof of correctness.

The second lane is money moving on a model’s say-so: agents that sign transactions, DeFi systems that set parameters, oracles that feed prices. When a wrong or swapped inference costs funds directly, a proof is cheap insurance. The third, newest and least proven lane is plain consumer trust, the model-substitution receipt that opened this piece. It is the largest potential market and the one with the least evidence so far that anyone will actually pay for it.

None of these lanes is yet a mass market. The honest read on 2026 is that most proofs generated this year were produced to show that proving works, not because a customer demanded them, and a large share of real volume is subsidized by the proving networks themselves. That is the normal shape of an infrastructure build-out, where supply arrives before the demand that will justify it, but it is also exactly what a token priced for imminent adoption cannot survive indefinitely.

What the SEC says, and what Brussels wants

For US readers the regulatory picture is a study in silence. When the SEC and CFTC issued their joint interpretation in March 2026, sorting major digital assets into commodities and securities, they named the usual large tokens, Bitcoin, Ether, Solana and XRP, as digital commodities and said nothing about AI-infrastructure or verifiable-compute tokens at all. That leaves PROVE, LA, ZKC and their peers in a case-by-case gray zone, judged against the old investment-contract test rather than any dedicated framework, a posture consistent with the broader drift described in HOGE Wire’s coverage of SEC crypto enforcement in 2026.

Europe is the mirror image. Brussels is loud about audits and quiet about tokens, and that is the better news for the sector. The AI Act does not regulate a proving token; it regulates whether you can show your AI did what you say it did. If verifiable AI has a regulatory tailwind anywhere in 2026, it is a compliance tailwind out of Europe, not a securities blessing out of Washington.

What still has to happen

The gap between 2026 and a world where proofs are routine is a list, not a mystery.

• Bigger models. The proven frontier is GPT-2 and Gemma 3. Llama-class and genuinely large models remain in development, and nobody has proven a frontier chatbot end to end.
• Lower cost. Roughly three hours to prove a 100-million-parameter inference is not real-time, and most useful models are far larger than that. Overhead fell by orders of magnitude in 2026 and still has orders of magnitude to go.
• Cross-hardware determinism. Today’s reproducibility guarantees tend to assume identical GPUs, which quietly recentralizes the decentralized compute the sector is trying to sell.
• A business model. If the software is open and the proofs can become commodity cheap, the token thesis needs an answer better than speculation.

The shape of the 2027 argument is already visible. The proof problem, the one that looked like a decade of research, is largely solved in principle; a full language model can now be verified by anyone in a few seconds. The deployment problem and the demand problem are what is left, and those are harder to solve with cryptography. For the first time, though, the bottleneck in verifiable AI is not the math. That is new, and it is the real story of the year.

Frequently Asked Questions

What is zk-ML in simple terms?

zk-ML, short for zero-knowledge machine learning, is a way to prove that a specific AI model ran on a specific input and produced a specific output, without rerunning the model or revealing its weights. The prover generates a small cryptographic proof, and anyone, including a smart contract, can check it in seconds. It turns trusting that a server ran the right model into verifying a proof that is false unless it did.

Can zk-ML prove a large language model like GPT-5?

Not yet at that scale. In 2026 the first systems proved full LLM inference end to end for smaller models such as GPT-2 and Gemma 3, with Llama-class models in development. Frontier chatbots remain out of reach because proving cost still runs to hours for models far smaller than them. The milestone is that whole language models can now be proven at all, not that the biggest ones can.

Does zk-ML keep my data private?

It can, but with a catch: whoever generates the proof has to see the data in the clear. Real input privacy therefore requires client-side proving, where you run the proof on your own device, or a setup where only the model is hidden and the input is public. Research in 2026 pushed proving onto mobile phones, which is what makes private, on-device uses such as proof of personhood practical.

How is zk-ML different from opML and TEEs?

All three make AI checkable, with different trust trade-offs. zk-ML proves correctness with cryptography, so you trust only math, but it is the slowest. opML publishes a result and relies on a challenge window plus at least one honest watcher, which is cheaper but adds latency. TEEs run the model in a secure hardware enclave and trust the chipmaker, which is fastest but exposed if the hardware is broken. zk-ML is the only one of the three that can also keep the input private.

Why are zk-ML tokens down so much if the technology works?

Because the technology and the tokens are only loosely connected. Leading proving tokens trade 88 to 98 percent below their highs even as the systems ship and improve, partly because the core software is open-source and may not need a token, partly from dilution as supply unlocks, and partly because speculative markets priced these assets for a future that has not arrived on schedule. Working infrastructure has not translated into token demand.

Marcus Okafor covers the intersection of artificial intelligence and crypto for HOGE Wire.