zk-ML on Your Phone: Proving You’re Human in 2026

For most of its short life, zero-knowledge machine learning has been a server’s problem. The pitch ran like this: you send a prompt to a cloud, the cloud runs a model, and it hands back an answer plus a cryptographic proof that it ran the model it claimed to run. You check the proof in a second or two and you never have to trust the operator. Almost every zk-ML story of the past two years, including the ones on this site, has been some version of that, proving that the cloud did its job.

In 2026 the prover quietly changed address. A small cluster of projects moved zk-ML off the server and onto the phone in your pocket. The model runs on your device, on your data, and your device produces the proof. Nothing about you leaves the handset except a short string of bytes that a smart contract can check. It reads like a footnote. It is actually the first version of zk-ML with a customer who is ready to pay, and the customer wants to answer one blunt question: are you a real, unique human?

The quiet inversion, from the server to the phone

Verifiable AI has always had two possible directions, and the industry has spent its money on only one of them. In the server-side version, a powerful operator proves something to a weak client: a data center with eight-figure hardware runs a large model and convinces your laptop that it behaved. In the client-side version, the arrow flips. A user with a cheap phone proves something to a network: that a model ran correctly on inputs the network is never allowed to see.

The distinction matters because it changes what the hard part is. Server-side, the obstacle is cost. Proving a frontier model is enormously expensive, which is why the headline work has been a race to make proofs cheaper. Client-side, the model is small enough that cost is manageable, and the prize becomes something else entirely: privacy. Because the party generating a zk-ML proof always has to see the raw inputs in the clear, the only way to keep your data genuinely private is to be the prover yourself. Client-side proving is the one configuration where zk-ML stops being an audit tool and becomes a privacy tool.

What a zk-ML proof actually is, in thirty seconds

A neural network, stripped down, is a very long sequence of multiplications with some non-linear steps in between. zk-ML takes that computation and compiles it into an arithmetic circuit, or runs it inside a zero-knowledge virtual machine, and produces a succinct proof that the computation was carried out correctly on some input to produce some output. The clever part is selective hiding: you can prove the whole thing while keeping the model weights secret, or the input secret, or both. The proof itself is small and cheap to verify. Making it is the expensive step.

The costs are lopsided in a way that shapes everything else. In his widely cited essay on the overlap of crypto and AI, Ethereum co-founder Vitalik Buterin noted that the matrix multiplications that make up the bulk of a model add less than four times the overhead inside a proof, while the non-linear steps run around two hundred times heavier, and proving a full Ethereum block can take hours. The same essay contains the sentence that is really the whole client-side thesis: «If we want to keep the model and the inputs private, we can, though it gets a bit more complicated.» Everything new in 2026 is a working answer to that one clause.

Why client-side is the harder, more interesting half

There is an uncomfortable fact at the center of zk-ML that the marketing tends to skate over: the prover always reads the data. A cloud that proves it ran your model honestly still saw your prompt. Server-side zk-ML therefore buys you honesty, not confidentiality. If what you actually want is for the operator never to learn your input, the only real defense is to not send the input at all.

Client-side proving is that defense made practical. If the data owner is also the prover, the raw input, your face, your location, a medical scan, a document, never leaves the device. What gets published is a proof plus whatever public output you agreed to reveal, which is usually a single bit: yes or no, over eighteen or not, unique or seen before. That is the arrangement privacy regulators have been asking for since before anyone had working tools to deliver it, and it is why the first genuine demand for zk-ML is surfacing here rather than in the data center.

Bionetta, a neural network that proves itself on a budget phone

The idea stops being abstract with Bionetta, a client-side zk-ML framework from the identity project Rarimo, first published in October 2025 and revised that December. In the paper, the authors benchmark Bionetta against the server-side tools everyone else has been building, EZKL, Lagrange’s DeepProve, and the original zkml, and make a specific claim: for custom-crafted networks the proving time drops far enough that, in their words, they can be proven even on mobile devices, enabling numerous client-side proving applications. The scheme pushes extra work into one-time setup, but the payoff, they argue, is that it is «to the best of our knowledge, the only one that is deployable on the native EVM smart contracts without overwhelming proof size and verification overheads.» In plain terms, a proof your phone makes can be checked by an ordinary Ethereum contract.

The mechanics are deliberately modest. Bionetta uses Groth16 and UltraGroth zero-knowledge proofs, generates them entirely on the user’s handset, and verifies them through autogenerated smart contracts, per the project’s documentation. That documentation is also refreshingly honest about the limits. This is for small, bespoke networks, not off-the-shelf giants; a standard MobileNet, the docs note, would «blow up the constraint count» and become impractical on consumer hardware. A proof completes in «under two minutes» on a smartphone, and the implementation is still private while the framework is in active development. Nobody should mistake this for a shipped product. It is a working demonstration that the shape of the thing is real.

The trade Bionetta makes is worth understanding, because it is the reason this works on a phone at all. Most zk-ML tools optimize for proving arbitrary, off-the-shelf models, which is flexible and slow. Bionetta instead co-designs the network and the circuit so the heavy one-time costs, circuit compilation and a trusted setup, are paid once by the developer, leaving the per-use proof small enough for a handset and cheap enough for a contract to check. It is a narrowing, not a breakthrough: you give up generality to buy the one thing a consumer device needs, a fast proof and a tiny on-chain footprint.

What it is built to do is the tell. The documented applications are biometric identity checks that never expose the raw scan, liveness checks that confirm a camera is pointed at a living person, private face registries where you prove you belong to a group without revealing which member you are, and the pleasingly strange option of using a physical object, a book or a figurine, as a secret key. Every one of those is a privacy problem, and every one of them is the kind of thing a phone should do locally rather than ship to a server.

Two halves of the same idea, pulling in opposite directions

It helps to lay the two configurations side by side, because they are routinely lumped together as «zk-ML» when they answer almost opposite questions.

Read down the two columns and the point jumps out. These are not competitors fighting over one market. One proves that a stranger’s computer behaved; the other proves that yours did, without showing your hand. The server-side column has had all the funding and all the token launches. The client-side column has the clearer customer.

The demand that finally showed up: proof of personhood

zk-ML’s chronic weakness has never been the technology. It has been demand. The proofs got faster and cheaper every quarter while almost nobody outside a handful of DeFi experiments actually paid for one. Client-side proving breaks that pattern because it collides with a problem the whole internet suddenly has: it can no longer tell humans from software.

AI-generated accounts, deepfakes, and autonomous agents are now a routine share of online traffic. Stanford’s 2026 AI Index counted 362 AI-related incidents in 2025, up more than half on the prior year, against organizational adoption nearing ninety percent. The machines did not arrive on a schedule; they are already in the comment sections, the sign-up flows, and the airdrop queues, a shift this publication watched play out in real time when bots and models moved the 2026 prediction markets. Every airdrop, every one-person-one-vote scheme, every game that distributes rewards, every dating app and forum now needs a way to separate a human from a script, and ideally a unique human from a thousand copies of the same one. That need has a name, proof of personhood, and unlike most zk-ML use cases, people are already spending money on it.

The economics are what make this different from past zk-ML demand, which was mostly theoretical. Sybil farming is an industry now: one operator spins up thousands of plausible identities to drain an airdrop, swing a token vote, or harvest game rewards, and the margins are good enough to fund full-time teams. Anything that raises the cost of the ten-thousandth fake account without taxing the first real one has immediate, measurable value, which is exactly the shape of a personhood proof. For once the buyer is obvious and the budget is real, and that is a sentence nobody could write about proving a cloud’s matrix multiplication.

World proved the demand, and drew the backlash

The loudest answer to the humanness problem is also the most controversial. World, the Sam Altman-backed project formerly called Worldcoin, says more than eighteen million people across over 160 countries have verified themselves as a unique human at one of its iris-scanning Orbs, and in April 2026 it signed deals with Tinder, Zoom, and Docusign to screen out bots and deepfakes. The project frames this as proof of human for the internet, and the appetite from platforms is clearly real.

The method is where it runs into trouble. A proprietary hardware Orb photographs your iris, and uniqueness is checked against World’s system. Several jurisdictions have restricted or banned the practice on privacy grounds, and European data authorities have gone after the collection of iris data directly. In the United States, the strictest biometric statute, Illinois’s Biometric Information Privacy Act, treats a scan of your eye as something you cannot un-share and attaches real damages to mishandling it. World collects a biometric in order to produce a yes. The obvious question, and the one client-side zk-ML is built to ask, is whether you can get the same yes without the Orb, the database, or the eye.

There is a second confusion worth clearing up, because it shapes the regulation. Proving you are a unique human is not the same as proving who you are, and the two keep getting welded together in pitches to banks and platforms, a conflation worth reading apart on its own terms in our look at how proof of human is not KYC. A personhood proof answers «are you one of us, and only once?» It does not, and should not, hand over a name. Client-side zk-ML is the cleanest way to keep those two things separate, because the only output it has to emit is the bit the counterparty needs.

How client-side proving rewrites the biometric bargain

Here is the swap that matters. Instead of sending your face to a company that checks it against a central store, your phone runs a face-recognition network locally and proves, in zero knowledge, that the network accepted you, that you passed a liveness check, that you match the credential you already hold. The image never leaves the device. The network’s weights can be fully public. The only thing published is a proof and a single yes. The company gets its answer; it never gets your face, so it can never leak, sell, or be subpoenaed for what it does not hold.

In practice the flow has four steps. You enroll once, binding a credential or a biometric template to a secret that stays on your device. When a service asks whether you are human, your phone runs the model on the live input and generates a proof that the check passed, without exposing the input or the template. The phone publishes the proof and a nullifier, a one-time marker derived from your secret, so the same person cannot quietly claim the same reward twice. A smart contract verifies the proof, records the nullifier, and releases whatever was gated behind it. The company never sees your face; the chain never sees your secret; the only thing anyone learns is that one unique human passed.

The underlying plumbing is further along than the quiet reputation suggests. A separate client-side proof-of-personhood design called Sybil Wedge reported generating its core proof in 477 milliseconds on a budget Android handset, a Samsung Galaxy A12, using nullifiers and Merkle trees rather than any central biometric database. That is not a neural-network proof, it is a rate-limiting construction, so it is a cousin of zk-ML rather than the thing itself. But it establishes the point that matters: the on-device zero-knowledge substrate is now fast enough on cheap hardware to be a background feature, not a laboratory stunt. If a five-year-old entry-level phone can turn out a personhood proof in under half a second, the question stops being whether this can run on consumer devices and becomes which apps bother to use it.

For a crypto and gaming audience the applications line up immediately. One account per human with no identity document uploaded. Airdrops that a Sybil farm cannot drain. Age-gating a game without storing a driver’s license on a server that will eventually be breached. Rewards and tournaments where a single person cannot register as a hundred. These are the same frictions wallets keep hitting at the interface layer, the ones we picked apart in the 42-character problem, approached from the identity side rather than the key-management side. The wallet asks how a human holds a secret. Personhood proofs ask how a service knows a human is on the other end.

A perfect proof of an imperfect model

Now the honest caveat, because client-side proving sharpens a weakness that is easy to gloss over. A zk-ML proof certifies that a specific model ran correctly on a specific input. It says nothing about whether that model is any good, or fair, or the model you would have chosen. On a phone the problem is pointed, because the only networks small enough to prove locally are small and quantized by design.

Elena Burger, a deal partner at a16z crypto, put the mechanics plainly: zero-knowledge proofs today cannot represent 32-bit floating point operations in the arithmetic circuit format proofs require «without massive overheads», which forces models down to low-precision integers. The result, in her phrase, is often «a crude approximation of the higher-quality initial model.» A proof that a tiny eight-bit face network accepted you is mathematically airtight and no more trustworthy than that tiny network. Soundness is not fidelity. The proof answers «did this exact network run», never «is this network accurate or fair.» For separating humans from bots that is usually enough, and the stakes are bounded. For anything heavier, a loan decision, a medical flag, a content judgment, it is a gap the proof cannot close, and anyone selling client-side zk-ML as a guarantee of correctness is selling the wrong thing.

The bigger prize is still on the server, and still slow

None of this retires the server-side problem, which remains the larger prize by a wide margin. Proving that a cloud ran a frontier model honestly is what would let you trust an AI you cannot see, and in 2026 that stopped being hypothetical. A 2026 research paper describes Lagrange’s DeepProve as the first system to enable efficient end-to-end verification of full LLM inference on untrusted cloud servers using zero-knowledge proofs. That is a real milestone, and it is worth sitting with the numbers before getting excited.

DeepProve reports proving GPT-2 at roughly 174 tokens per minute and Gemma-3 at about 86, with verification landing in a few seconds. Those are genuine language models and genuinely small ones; a frontier model is still many hours of proving away. Polyhedra’s zkPyTorch tells the same story from the other end, a fifteen-million-parameter vision network proves in about two seconds per image while an eight-billion-parameter Llama runs around 150 seconds per token, which is the whole gap in one line: images are practical, large language models are not. The server-side camp has responded by chasing enterprise and defense budgets rather than a token market, with DeepProve open-sourced and pushed toward partners spanning IBM, NVIDIA, Oracle, and AWS and sovereign-cloud deployments. Ismael Hishon-Rezaizadeh, Lagrange’s chief executive, cast the open-sourcing as a shared foundation rather than a land grab: «The black box is open.»

The reason the server-side race draws the funding is that its prize is larger than identity. If a cloud could cheaply prove it ran the exact model it advertised, you could trust an autonomous agent to move money, sign an agreement, or settle a market without trusting the company behind it. That is a far bigger market than bot-screening, and it is why the proving tokens were once priced for a future measured in the trillions. The catch is timing: the identity use case is small but arriving now, while the agent-trust use case is enormous and still gated behind proof costs measured in hours per model.

The division of labor is now clean. Client-side zk-ML is small, private, and shipping toward consumer identity. Server-side zk-ML is large, slow, and selling to institutions. Both are real work. Neither of them, it turns out, is the token.

The tokens the market forgot

The gap between what these systems can do and what their tokens are worth has not narrowed over 2026; it has widened. Every major proving token trades far below its all-time high, and the deepest is the one attached to the frontier zk-ML milestone. Prices below are as of 7 November 2026, per CoinGecko.

Two things stand out. The only token with momentum, Phala, is up more than forty percent on the month, and it is not a zk-ML token at all; it sells trusted-hardware confidential compute, which keeps shipping real inference volume while the pure-proof tokens drift sideways. And the most interesting client-side work, Bionetta and Rarimo, Sybil Wedge, is happening largely without a hot token attached. That is the quiet signal in this corner of the market: the research closest to an actual user is the research least tied to a coin.

Does client-side zk-ML even need a chain?

It is a fair challenge. A zero-knowledge proof is self-verifying; anyone holding the verification key can check it, with no blockchain involved. So what is the chain actually for? Three jobs, mostly. First, a neutral public place to publish the verification key and the model commitment, so there is one agreed answer to «which model counts» and an operator cannot swap in a different network after the fact. Second, a registry of nullifiers, so a given human cannot silently reuse the same personhood proof twice. Third, settlement, for when a yes unlocks a reward, a vote, or a payment.

Bionetta leans on exactly that split: proofs a phone makes, checked by autogenerated EVM contracts. The chain is the referee and the ledger, not the prover. Which is precisely why the token question and the technology question come apart. You can believe client-side proving is the most useful thing in verifiable AI and still think most of these coins are priced for demand that has not arrived, because the demand, when it shows up, may route through a contract that never needed its own token to function.

Washington is quiet, Brussels is loud

Regulation is the demand lever nobody in crypto controls, and right now it is pulling unevenly across the two sides of the Atlantic. In the United States, the SEC and CFTC spent 2026 sorting which digital assets are commodities and which are securities, and said effectively nothing about AI verification or the infrastructure tokens behind it. That leaves LA, PROVE, and ZKC in the same gray zone as the rest of the sector, and it is why America’s finished rulebooks, stablecoins finally got one this year, do not yet reach this question at all.

Europe is the mirror image. The EU AI Act became broadly applicable on 2 August 2026, with transparency obligations and fines reaching 15 million euros or 3 percent of global turnover. It does not mandate zero-knowledge proofs anywhere. What it does is manufacture the exact pressure, prove what your model did and how, that verification tools are designed to answer, which is why the demand case for zk-ML reads stronger in Brussels than in Washington.

On biometrics specifically, the asymmetry flips in client-side proving’s favor on both continents. US state law, led by Illinois’s Biometric Information Privacy Act, and European data authorities both punish the collection and storage of biometric data. That is the strongest argument for on-device proving there is: the cheapest way to comply with a law about storing faces is to never store the face. The surveillance argument crypto has been having about on-chain data, the one we traced in who watches the chain, is about to run headlong into the far older argument about surveillance of the body, and client-side zk-ML happens to be a technical answer that sidesteps the worst of both.

The honest read, and what has to happen next

Client-side zk-ML is the freshest idea in a field that has otherwise been talking to itself for two years, and it is also the least proven in production. Bionetta’s code is not public yet. The provable models are tiny. The biggest real demonstration of personhood demand, World, got there with an iris Orb, not a phone, which means the demand has been validated by a method the privacy camp rejects. For the on-device version to matter rather than merely intrigue, a short list of things has to happen: the frameworks have to ship and survive an audit, the provable model sizes have to grow past toy classifiers into something that can carry a real liveness or face-match model, and at least one consumer app with actual users has to choose «prove it on your device» over «send us your face.»

The reason to watch it anyway is simple. This is the first configuration where zk-ML’s value is legible to an ordinary person. Nobody outside crypto has ever cared whether a cloud proved its matrix multiplication. A great many people care whether an app can confirm they are human without keeping a copy of their face. The tokens are priced as though that revenue never arrives. If verifiable AI ever earns the money those tokens still imply, the likeliest place it starts is not a data center. It is the phone already in your hand, quietly proving you are exactly one person, and declining to say anything else.

Frequently Asked Questions

What is client-side zk-ML?

Client-side zk-ML runs a machine-learning model on your own device and generates a zero-knowledge proof there, so your raw data never leaves the phone. Only the proof and a public output, usually a single yes or no, are shared, which lets a service verify the result without ever seeing your input.

What is Bionetta?

Bionetta is a client-side zero-knowledge machine-learning framework from the identity project Rarimo, published in late 2025. It proves small, custom neural networks directly on a smartphone using Groth16 and UltraGroth proofs, and the project reports that those proofs can be verified by ordinary Ethereum smart contracts.

How is this different from World (Worldcoin)?

World verifies a unique human by scanning the iris with a proprietary Orb and checking uniqueness against its own system, which several jurisdictions have restricted on privacy grounds. Client-side zk-ML aims for the same result, proof that you are a unique human, by running the check on your own phone so the biometric never leaves the device and no central database is needed.

Can zk-ML prove a large language model on a phone?

No. On-device proving today only works for small, quantized networks such as face embeddings or classifiers. Proving a large language model is still a server-side task, and even small models like GPT-2 and Gemma-3 prove at only tens to low hundreds of tokens per minute, with frontier models still hours away.

Does proof of personhood with zk-ML need a blockchain or a token?

Not strictly. A zero-knowledge proof can be verified by anyone holding the verification key, with no chain required. A blockchain is useful for publishing the model commitment, tracking nullifiers so a proof cannot be reused, and settling any reward or vote, but many of the most advanced client-side efforts run without a dedicated token.

Marcus Okafor is a senior editor at HOGE Wire, covering the intersection of artificial intelligence and crypto.