zkML in 2026: Can Zero-Knowledge Proofs Scale to Real AI?

Zero-knowledge machine learning has spent most of its short life as a beautiful idea with a brutal footnote. The pitch is irresistible: produce a compact mathematical proof that an AI model ran exactly as promised, so anyone can check the result in milliseconds without rerunning the model, seeing its weights, or trusting the company that owns it. The footnote, repeated at every conference since 2023, was that the math was too slow to matter. Proving a single inference could cost tens of thousands of times more compute than simply running it, which turned zkML into a party trick for tiny models and a non-starter for anything resembling a modern language model.

In 2026, that footnote finally started to change. A production system generated a full zero-knowledge proof of a language model end to end, a class of research papers reframed how proofs get built, and the word impossible quietly turned into expensive. This is an analysis of how far zkML has actually traveled this year, what still blocks it, and why the market that funds the sector has largely stopped believing even as the engineering delivered.

What zkML Actually Proves, and What It Cannot

Strip away the acronyms and zkML answers one narrow question: did this exact model, given this exact input, really produce this exact output? A prover runs the model and, alongside the answer, emits a zero-knowledge proof. A verifier checks that proof, usually a few kilobytes, in a fraction of a second, and comes away mathematically convinced the computation was honest, without redoing the work, without seeing the weights, and without seeing the input if the operator wants it hidden. That last property is where the zero-knowledge part earns its name, and it is the subject of a growing academic literature; a 2025 survey of zero-knowledge proof based verifiable machine learning counts dozens of distinct schemes racing at the problem.

It helps to say what zkML is not. It is not decentralized compute. Renting a stranger’s GPU on a marketplace gets you cheap cycles, but nothing about the transaction proves the stranger ran your model faithfully rather than a cheaper shortcut. zkML is also only one of four families that try to make AI verifiable. The optimistic approach, opML, publishes a result and treats it as final unless a watcher disputes it inside a challenge window. The hardware approach leans on a trusted execution environment, or TEE, where a chip from Intel or NVIDIA attests that code ran untampered. The crypto-economic approach, familiar from restaking, bonds operators with stake that gets slashed if they cheat. zkML is the only one of the four that is cryptographically trustless, needing no honest watcher, no chip vendor, and no economic assumption about rational actors. It is also, by a wide margin, the slowest and most expensive to produce. That tradeoff is the entire story of the field.

There are limits worth stating plainly, because vendors rarely do. A proof shows that some committed set of weights was used, not that those were the correct or unbiased weights. It cannot make a fundamentally non-deterministic model deterministic for free. And when you already trust the operator, a proof buys you nothing except a very large compute bill. zkML earns its keep precisely in the settings where trust is absent, contested, or legally required, which is a smaller slice of the AI economy than the 2023 hype implied.

The Cost Problem That Defined a Decade

To understand why 2026 matters, you have to understand why the years before it were so hard. Neural networks are built from operations that proof systems hate. Matrix multiplications are manageable, but the non-linear functions that give a network its power, activation functions like ReLU and the softmax that turns raw scores into probabilities, are expensive to express in the arithmetic circuits that classic zero-knowledge systems require. Worse, modern models run on 32-bit floating-point numbers, and as a16z crypto researcher Elena Burger put it in her primer on the field, “zero-knowledge proofs today can’t represent 32-bit floating point operations in the necessary arithmetic circuit format without massive overheads.” The workaround is to quantize the model down to 8-bit integers, which shrinks the proving cost but sacrifices some of the accuracy that made the model worth verifying in the first place.

Stack those problems together and the overhead becomes staggering. Estimates for running a model inside a naive proof system have long been quoted in the range of a hundred thousand times native execution or more, which is why early demonstrations topped out at handwritten-digit classifiers. Modulus Labs framed the challenge memorably in its January 2023 report, The Cost of Intelligence, the first work to benchmark proof systems across a common suite of AI primitives, and it has anchored the conversation ever since.

The redeeming feature, and the reason anyone keeps trying, is asymmetry. Proving is brutal, but verifying is cheap and stays cheap no matter how complex the underlying computation. Burger notes that once a proof system faithfully represents a model, checking its outputs is quite cheap, with proof sizes measured in kilobytes. Vitalik Buterin made the same point the organizing principle of his 2024 essay on crypto and AI, describing a world split between computations that are cheap but unverifiable and computations that are expensive but verifiable, and arguing that zkML is worth its cost only where that verifiability genuinely changes what you can build. His survey of the promise and challenges of crypto plus AI remains the clearest map of where the trade pays off.

One more obstacle is subtler and rarely mentioned in pitch decks: determinism. Zero-knowledge proofs require the computation to be reproducible down to the last bit, but GPU inference is not, because floating-point results shift with parallel scheduling and hardware. Reconciling a non-deterministic execution environment with a proof system that demands bit-exact determinism is a real engineering tax, and it is one reason CPU-friendly, integer-quantized pipelines dominate production zkML rather than raw GPU stacks.

2026’s Breakthrough: A Full LLM, Proven End to End

The headline event of the year came from Lagrange Labs. With its DeepProve system, the team generated a zero-knowledge proof for the full inference of OpenAI’s GPT-2, which it billed as the first production-ready zkML system to prove a complete large language model forward pass, from token embeddings through to the final next-token selection. For a field whose skeptics had spent three years insisting that language models were categorically out of reach, that is a genuine goalpost move.

Lagrange founder and chief executive Ismael Hishon-Rezaizadeh framed the milestone in almost philosophical terms when the company open-sourced the library. “Today, DeepProve becomes a primitive. The black box is open,” he said in the release announcement, adding that “you cannot trust what you cannot verify” as AI becomes woven into everyday life. By the open-source release in June 2026, the company said DeepProve had generated more than 12 million cryptographic proofs and verified more than 3 million AI inferences end to end over the prior year, numbers that put it well past the demo stage.

Now the honest caveats, because the gap between the milestone and a usable product is wide. GPT-2 is a 2019 model whose largest version held about 1.5 billion parameters, orders of magnitude smaller than the frontier systems people actually use in 2026. Lagrange’s announcement was a statement of technical feasibility, not a performance report: it disclosed no proof generation time, no memory footprint, and no dollar cost for that GPT-2 proof, and it noted that support for Llama-class architectures was still coming in the months ahead. Proving a modern flagship model in real time remains far out of reach on cost grounds. What changed in 2026 is the nature of the question. For years the debate was whether an LLM could be proven at all. Now it is whether it can be proven economically, and that is a very different, and more tractable, kind of problem.

The Lookup Revolution Behind the Leap

The 2026 progress was not luck. It rode a deeper shift in how proofs get constructed, away from hand-built arithmetic circuits and toward lookup arguments and the sumcheck protocol. The intuition is simple: instead of forcing an awkward function like ReLU into a circuit of additions and multiplications, you precompute a table of its outputs and prove that your value appears in that table. Lookups turn the non-linear operations that used to dominate proving cost into cheap table checks, which is exactly the pattern machine learning workloads need.

The engine here is Jolt, the lookup-heavy zkVM built at a16z crypto around the Lasso lookup argument, which the team pitched as a way to make proving both faster and dramatically easier to extend. Their post on building Jolt lays out the sumcheck-first design. In February 2026, researchers at ICME Labs, the team behind NovaNet, adapted that engine specifically for machine learning and published Jolt Atlas, a framework that applies Jolt’s lookup-centric proving directly to ONNX tensor operations rather than emulating a CPU. The paper claims practical proving times across classification, embedding, automated reasoning, and small language models, uses a technique called BlindFold to add zero-knowledge, and, most striking for a field obsessed with hardware, targets proving that can run on-device without specialized accelerators through streaming for memory-constrained environments.

Lagrange’s DeepProve leans on the same mathematical family, combining sumcheck with a technique called logup GKR, and the research pipeline keeps filling in. A March 2026 paper introduced a layerwise approach to proving language models one transformer layer at a time, a divide-and-conquer strategy for keeping memory bounded as models grow. The through line across all of it is that the sumcheck-and-lookup toolkit, not any single company, is what quietly broke the LLM barrier this year.

The zkML Toolchain in 2026

The practical stack has consolidated around a handful of approaches, each with a different bet on how proofs should be built and who should pay for them. The table below maps the field as it stands in August 2026.

EZKL, from the team at zkonduit, remains the most widely used entry point. Its promise, in founder Jason Morton’s telling, was that you should not need to be a cryptographer to use it: export a model from PyTorch or TensorFlow to the ONNX format, point EZKL at it, and get a proof. The open-source library compiles those models into Halo2 circuits and runs from Python, JavaScript, or the command line, which is why it became the baseline that newer systems measure themselves against. Lagrange’s own benchmarks claim DeepProve generates proofs 54 to 158 times faster than EZKL, a comparison that only makes sense because EZKL is the reference implementation everyone knows.

The zkVM camp, RISC Zero and Succinct’s SP1, takes a more general path: prove arbitrary programs compiled to a RISC-V virtual machine, of which ML inference is just one workload. That generality costs some efficiency but plugs into proof marketplaces, where anyone can submit a job and provers compete to fulfill it. The bridge-security world already leans on the same primitives; our explainer on how cross-chain trust works in 2026 shows how zk proofs are displacing multisigs in the plumbing that moves assets between chains, and the proving infrastructure overlaps heavily with zkML.

What Actually Ships in Production

Set the LLM milestone aside for a moment, because it is not what pays the bills today. The zkML that is genuinely in production in 2026 is narrow, high-value, and low-throughput, the profile of a verification tax that only makes sense when the stakes justify it. The pattern is consistent: small models, well-defined tasks, and an outcome where being able to prove honesty is worth real money.

• On-chain fee and risk logic, such as OpenGradient using EZKL to prove a dynamic fee model for Uniswap-style pools, so users can verify the fee they paid came from the stated model rather than an operator’s thumb on the scale.
• Fraud detection and credit scoring, where a lender can prove a decision followed an approved model without exposing the model or the applicant’s data.
• Model provenance and honest benchmarking, the use case formalized in academic work on verifiable evaluations of machine learning models using zkSNARKs, which lets a lab prove a claimed accuracy number without revealing the model.
• Image classification and recommendation, the bread-and-butter small networks that fit comfortably inside today’s proving budgets.
• AI-agent attestation, where an autonomous agent proves which model produced the reasoning behind an action before it signs a transaction.

Notice what is absent from that list: real-time chat, frontier-scale generation, anything latency-sensitive. The production reality of zkML is closer to a notary than an oracle of everything. It is powerful precisely where a verifiable receipt is worth waiting seconds and paying a premium for, and irrelevant everywhere else, which for now is most of the AI economy.

The Pivot Problem: When zkML Firms Became Agent Firms

If the technology is advancing, why do so few companies still describe themselves as pure zkML shops? Because the business turned out to be brutal, and the money followed users rather than proofs. The clearest case is Giza. It began in 2023 as a zkML project, building Cairo-based proving primitives called Orion to run verifiable models on Starknet. Over the following two years it evolved into something quite different: an agent company. Its flagship product, ARMA, is an autonomous stablecoin yield agent deployed on Base that shuffles funds across lending markets like Aave, Morpho, Compound, and Moonwell to chase the best rate. Verifiability became a feature buried inside a DeFi product, not the product itself.

The logic is not hard to follow. An autonomous agent optimizing yield does something a user can immediately value, and it slots neatly into the wider machinery of on-chain credit; readers tracking that machinery will recognize it from our piece on the on-chain yield curve and fixed-rate DeFi lending. A proving library, by contrast, is a tool other builders might use someday. Modulus Labs, which wrote the field’s foundational cost report and raised a 6.3 million dollar seed round co-led by Variant and 1kx with backing from the Ethereum Foundation, Solana, Polygon, and others, similarly broadened its focus toward AI systems engineering rather than staying a pure zkML prover shop. The pattern says something uncomfortable about the sector: the cryptography got better faster than the market for it did, and the survivors are the ones who wrapped proofs inside something people already wanted to buy.

zkML Versus opML, TEEs, and Staking

zkML does not compete in a vacuum. For most builders the real decision is which of the four verifiable-compute families to use for a given job, and the answer usually is not zkML, because its guarantees are the strongest and its costs are the highest. The table below lays out the trade.

Each family has a natural home. TEEs win when you need near real-time inference and can accept trusting Intel or NVIDIA, which is why they carry the bulk of confidential AI volume today, though as HOGE Wire has documented, that hardware trust is not free of side-channel and attestation risk. opML wins when a long dispute window is acceptable and cost matters more than instant finality. Staking wins where economic security is good enough, the same logic underpinning the restaking economy. zkML wins in the narrow band where you need cryptographic certainty and no trusted third party at all, and where you can tolerate the cost and the wait. The likely future is not one winner but hybrids: a fast TEE or optimistic path for the common case, with zero-knowledge proofs reserved for the highest-stakes checks or periodic spot audits. That layered design is where most serious 2026 architectures are heading.

The Token Market Has Already Voted

Here is the divergence that should unsettle anyone bullish on the technology. The engineering advanced all year, and the tokens tied to proving infrastructure collapsed. As of August 2026, Succinct’s PROVE traded around 0.15 dollars for a market capitalization near 30 million dollars, roughly 91 percent below its all-time high set a year earlier. Lagrange’s LA, the token of the very company that just proved a full LLM, sat near 0.055 dollars and about 11 million dollars in market cap, some 97 percent below its June 2025 peak. Boundless’s ZKC hovered around 0.042 dollars and 12 million dollars. Giza’s GIZA, having pivoted to agents, changed hands near 0.0014 dollars, roughly 99.7 percent under its high.

Every credible token in the category is down between 90 and 99.7 percent from its peak while the underlying systems shipped real, verifiable progress. That is not a bug in the cryptography; it is a market telling you it cannot yet price the demand. Infrastructure tokens struggle to capture value when the service they meter has few paying customers, and proving is the definition of a service still searching for its market. The pattern rhymes with the broader lesson of the AI-crypto cycle, where framework quality and token performance came apart completely, as we chronicled when Eliza’s token was declared dead even as its framework lived on. Until proving generates fees that a market can actually point to, these tokens will keep trading on narrative rather than revenue.

Who Actually Pays for a Proof?

The token charts point at the one question that decides zkML’s future, and it is not a technical one. Who pays for the proof, and why? Verification is cheap, but producing the proof still costs orders of magnitude more compute than the inference it certifies. Someone has to want that certainty badly enough to fund the premium. Proof marketplaces such as Boundless, which rewards provers through a mechanism it calls Proof of Verifiable Work, and Succinct’s SP1 network are betting that a liquid market for proving will emerge, the way block space became a market. So far, the demand is thin.

The marketplaces are real, and so is their traffic, but traffic is not the same as revenue. DeepProve alone reported more than 12 million proofs generated over roughly a year, yet very little of that volume comes from customers paying market rates for verification they could not obtain any other way; much of it is testing, incentive programs, and infrastructure proving its own reliability. That is the honest state of the demand curve in 2026. The supply side works, the tooling is maturing, and the per-proof cost keeps falling, but the number of applications that genuinely require a cryptographic guarantee, rather than merely benefiting from one, stays small. A marketplace needs buyers who have no cheaper alternative, and for most inference the cheaper alternative, trusting the operator, still wins on price.

The most-cited bull case is the autonomous agent. As software agents gain wallets and start signing transactions, the argument goes, they will need to prove which model produced their reasoning before anyone lets them move money, and micropayment rails could let one agent pay another a few cents for a verified inference. It is a clean story, and it dovetails with the emergence of agent-native accounts and programmable smart wallets that can carry their own spending rules. The bear case is just as clean: most users and most agents will keep trusting the operator, because trust is free and proofs are not, and the volume needed to sustain a proving economy simply has not shown up. It is the same demand puzzle that haunts the restaking sector, where the supply of rentable security ran far ahead of anyone willing to pay for it, a tension we unpacked in our look at where the demand for rented security actually is. zkML has the identical shape: abundant, impressive supply of verifiable compute, and an unproven willingness to pay.

Regulation: Does Provable AI Have a Legal Home Yet?

One force could turn that willingness to pay from a hope into a mandate: regulation. If supervisors in finance or healthcare start demanding that automated decisions be provable and auditable, a cryptographic receipt for a model’s behavior stops being a luxury and becomes compliance. There are early signs the industry is positioning for exactly that. Lagrange met with the SEC’s Crypto Task Force in September 2025, one of a stream of firms making the case for how verifiable computation fits into securities oversight, per the agency’s own meeting memo.

For now, the tokens live in a gray zone. When the SEC and CFTC issued their joint interpretation on crypto asset classification in March 2026, they named 16 tokens as digital commodities, including Chainlink’s LINK, but the release said nothing about AI inference or verifiable-compute infrastructure as a category of its own. That leaves smaller proving tokens to be judged case by case under the usual test of whether buyers are relying on a team’s managerial efforts for profit. Anyone weighing how that plays out should read our field guide to how SEC crypto enforcement actually works in 2026, because the enforcement posture, not the classification chart, is what will decide these cases. Across the Atlantic the pressure runs the other way: the EU’s AI Act obligations for general-purpose models, in force since August 2025, push toward documentation and auditability, the kind of requirement a proof can satisfy cleanly, and the sort of rule regime that pairs with the broader crypto framework we track in our coverage of Europe’s live rulebook.

The Hardware Race to Make Proofs Cheaper

Software cleverness explains half of the 2026 leap; the other half is hardware. Proving is embarrassingly parallel, which makes it a natural fit for GPUs, and the field has chased that acceleration for years. Back in 2023, researchers Suppakit Waiwitlikhit and Daniel Kang showed how far it could go with TensorPlonk, which they described as a GPU for zkML delivering up to 1,000 times speedups on models like a recommendation system, at a time when proving that same model with EZKL could take roughly six hours for a single example. Open-source toolkits such as zkDL took CUDA-accelerated proofs of deep learning in the same direction.

That trajectory has continued into 2026. GPU-optimized provers are widely expected to shave another order of magnitude off proving times for common workloads, turning jobs that once took tens of seconds into a handful, while Jolt Atlas points the other way entirely, toward proofs light enough to run on a laptop or a phone without any accelerator at all. The two directions are not in conflict. Heavy, throughput-oriented proving will live in specialized data centers and marketplaces, and lightweight on-device proving will handle the small models that need to travel with a user or an agent. Neither path makes frontier-scale real-time inference cheap yet, but both keep bending the curve that made zkML impractical for so long, and the bend is what turns a research demo into a product.

The economics still bite. Even a thousandfold speedup on a small model leaves proving far more expensive than the raw inference, and the largest models remain untouched by any amount of parallelism available today. Hardware progress buys reach, not a free lunch: each gain pulls a slightly larger class of models into the practical zone, from digit classifiers to recommendation systems to, in 2026, a small language model, without ever making the marginal proof genuinely cheap. That steady widening, rather than a single breakthrough, is the realistic path by which zkML becomes ordinary infrastructure instead of a research curiosity.

The Honest Verdict: Where zkML Stands

zkML in 2026 is a technology that answered its hardest research question and now faces its hardest business one. The feasibility ceiling genuinely lifted this year. A full language model was proven end to end for the first time, lookup-based proving cracked the non-linear operations that used to dominate cost, and some of the newest systems can run on ordinary hardware without a rack of accelerators. Measured against the state of the art in 2023, when a proof of a small image classifier was a headline, the progress is real and fast.

What has not moved is the economics of real-time inference at frontier scale, which remains out of reach, and the demand question, which remains unanswered. The result is a field whose honest home is narrow and valuable rather than broad and cheap: proving that a model followed the rules in finance, healthcare, agent actions, and audits, where certainty is worth a premium and a few seconds of latency, and staying out of the way everywhere else. The likely near-term shape is hybrid architectures that use faster, weaker methods for the common path and reserve zero-knowledge proofs for the checks that truly matter, with hardware acceleration expected to shave proving times further as GPU-optimized provers mature. Hishon-Rezaizadeh’s line, that you cannot trust what you cannot verify, is the right north star. The open question for 2027 is whether enough of the market decides it needs to verify at all, and is willing to pay for the privilege. Until it does, zkML will keep being the most impressive technology in AI-crypto that the market cannot figure out how to price.

Frequently Asked Questions

What is zkML (zero-knowledge machine learning)?

zkML uses a zero-knowledge proof to show that a specific AI model produced a specific output for a specific input, without revealing the model’s weights or the input data. A verifier checks a small proof, usually a few kilobytes, in milliseconds instead of rerunning the model, which is what makes it cryptographically trustless rather than merely decentralized.

Can zkML prove a large language model in 2026?

For the first time, yes, at small scale. In 2026 Lagrange’s DeepProve-1 generated a full zero-knowledge proof of OpenAI’s GPT-2, a 2019 model whose largest version held about 1.5 billion parameters. Proving today’s frontier models in real time remains far out of reach on cost grounds, so the milestone is a feasibility marker rather than a production capability.

Why is zkML so expensive?

Turning a neural network into a form a proof system can handle is costly, especially non-linear functions like ReLU and softmax and 32-bit floating-point math, which forces developers toward lower-precision quantized models. Proving can carry overheads of many orders of magnitude over simply running the model, even though verifying the finished proof is cheap and fast.

What is the difference between zkML and opML?

zkML produces a cryptographic proof up front, so a result is trustless the moment the proof verifies, at high proving cost. opML, optimistic machine learning, publishes a result and treats it as valid unless someone challenges it within a dispute window, which is far cheaper but relies on at least one honest watcher and adds latency. zkML buys stronger guarantees; opML buys lower cost.

Are zkML tokens a good investment?

HOGE Wire does not give investment advice. It is worth noting the gap between technology and token price: as of August 2026, infrastructure tokens tied to proving, including Succinct’s PROVE, Lagrange’s LA, Boundless’s ZKC, and Giza’s GIZA, all traded roughly 90 percent or more below their all-time highs even as the underlying systems shipped real advances. That divergence reflects unresolved questions about paying demand, not a failure of the cryptography.

By Marcus Okafor, senior AI and crypto correspondent at HOGE Wire.