zk-ML’s Real Pitch: Proving AI Without Exposing the Data

Zero-knowledge machine learning built its reputation on a narrow promise: prove that an AI model produced a given output honestly, without making the verifier redo the computation. That framing, verify the model ran correctly, has dominated the conversation since Vitalik Buterin’s 2024 essay on crypto and AI put zkML on the map as one of several ways to make AI trustworthy on-chain. Two years and several benchmark cycles later, the more interesting story in 2026 is not that framing at all. It is the second, quieter promise buried in the same acronym: proving something about private data, or a private model, without ever showing either one to the verifier.

That distinction, integrity versus confidentiality, now separates the zk-ML projects that are actually shipping from the ones still chasing frontier-model benchmarks nobody can afford to run. A biometric identity network processes real enrolled users today on exactly this cryptography. A DeFi credit protocol is proving loan eligibility without exposing bank statements. A proof-of-computation network just redirected a large share of its GPU fleet toward AI inference altogether. This piece looks at where zk-ML’s privacy pitch is actually being tested in production, what the proving stacks cost in practice, and why a wave of teams are now pairing zero-knowledge proofs with fully homomorphic encryption rather than treating either as sufficient alone.

Two Different Promises Under One Acronym

Zero-knowledge machine learning, zk-ML or zkML depending on the source, wraps a neural network’s execution in a cryptographic proof. A prover runs the model and generates a succinct certificate; a verifier checks that certificate in a fraction of the time it would take to rerun the model, then accepts or rejects it. That basic mechanic supports two very different jobs.

The first job is integrity: proving a specific model produced a specific output on a specific input, so nobody can fake the result or quietly swap in a cheaper, weaker model behind an API. This is the framing most explainers lead with, including HOGE Wire’s own primer on how zero-knowledge proofs verify AI and its companion piece on the broader verifiable compute landscape spanning TEEs and crypto-economic security alongside zero-knowledge proofs.

The second job is confidentiality: proving a property of an input, an output, or a model without revealing any of the three. A lender can learn that a borrower’s credit model returned a score above a threshold without ever seeing the borrower’s transaction history. A biometric network can confirm a person is unique without storing or transmitting their iris scan. A trading desk can prove its model ran inside stated risk limits without publishing the model’s weights to competitors. Conflating these two jobs, treating every zkML pitch as interchangeable, is why so much coverage of the space reduces to a single vague claim: it makes AI trustworthy. Trustworthy how, and to whom, is the more useful question, and it has two different answers.

How a Neural Network Becomes a Circuit

The mechanical path is the same regardless of which job a system is built for. A trained model, typically exported from PyTorch or TensorFlow into the ONNX interchange format, gets compiled into an arithmetic circuit: a network of addition and multiplication gates over a finite field. Matrix multiplications and convolutions translate fairly directly into that structure. Non-linear operations, ReLU activations, softmax, layer normalization, do not; they need auxiliary techniques such as lookup arguments or range checks to represent cheaply inside a circuit built for arithmetic rather than comparisons.

Once the circuit exists, a proving system, Halo2, Plonky2, a zk-STARK, or a folding-scheme-based prover, generates a succinct non-interactive argument that a specific set of inputs, run through that exact circuit, produces a specific output. EZKL, built by Zkonduit under founder and CEO Jason Morton, is the most widely used general-purpose tool for this pipeline: it takes an ONNX model and produces both the circuit and the proof, targeting the Halo2 proving system with Plonkish arithmetization underneath.

The overhead is the entire story. Every non-linear layer multiplies proving cost well beyond the model’s native inference time; Buterin’s own widely cited estimate put the penalty for non-linear layers at roughly 200 times the cost of running the model directly. That number, more than any marketing claim, explains why zkML adoption has clustered around small, narrow models rather than frontier LLMs, and why the projects covered below spend so much engineering effort narrowing that gap rather than chasing bigger models outright.

The Quantization Problem

Machine learning models are built on floating-point arithmetic. Zero-knowledge circuits are built on finite fields, which behave like integers with wraparound. Squeezing one into the other is not a formality, and the field has taken to calling the resulting mess quantization hell: every weight, activation, and intermediate value has to be rounded into fixed-point representation before a circuit can touch it, and that rounding is lossy by construction.

Different toolkits pick different tradeoffs. Wider bit widths preserve more precision but blow up proving time and memory. Lookup tables speed up specific non-linear operations but lock a circuit into one quantization scheme, so switching model architectures means rebuilding the lookup infrastructure. EZKL applies fixed-point conversion during its ONNX-to-circuit compilation step, a design documented at length in ICME Labs’ guide to the current zkML stack, which frames the tradeoff bluntly: converting from floating point to fixed point always costs some accuracy, and the only real question is how much a given application can tolerate.

Newer entrants are trying to loosen that constraint rather than accept it. Jolt Atlas, built on folding-scheme lookup arguments, aims to support flexible quantization without materializing full lookup tables for every operation, with backers claiming a path toward native floating-point support that most of the field still treats as impractical. Whether that holds up outside benchmark conditions is unresolved. What is not in question is that quantization strategy, not proving-system choice alone, increasingly determines whether a given model can be proven at all, and how closely its verified output tracks what the full-precision, un-proven model would have produced.

Proof of Personhood: World ID’s Iris Codes

The largest live deployment of zkML-adjacent cryptography sits inside a product most people do not think of as a machine learning system at all. World, the network built around Tools for Humanity’s Orb hardware, uses a neural network to convert an iris scan into a compact numeric iris code, then uses that code, rather than the image itself, to check whether a person has already registered as unique. The image never leaves the device.

World’s own engineering team has documented a specific zkML application inside that pipeline: when the iris-recognition model improves, as it periodically does, every enrolled user would otherwise need to revisit an Orb for re-enrollment under the new model. Instead, a device can generate a local zero-knowledge proof that a new iris code was correctly derived from the old one under the updated model, letting the network upgrade its recognition accuracy without forcing a global re-scan. World has published parts of this research openly on GitHub, including a reference implementation combining neural inference with zero-knowledge proofs.

This is confidentiality-flavored zkML at genuine population scale, millions of enrolled users, not a benchmark model classifying digits in a research paper. It is also a useful corrective to the assumption that zkML’s future runs mainly through DeFi and trading bots. The most-used deployment of this technology today protects a biometric credential, not a token price feed.

Verifiable Underwriting: Proving Creditworthiness Without Opening the Books

DeFi lending has a structural privacy problem that predates AI entirely: undercollateralized credit requires assessing a borrower’s actual financial standing, and doing that on a public blockchain means giving up either the privacy or the trustlessness. Qiro Finance’s integration with EZKL, built around a network of professional underwriting nodes that score borrower creditworthiness, tackles that tradeoff directly: a credit model built in Python and exported to ONNX runs off-chain against a borrower’s real financial data, EZKL generates a zero-knowledge proof that the model executed correctly and produced a specific score, and a lending smart contract verifies that proof on-chain without ever touching the bank statements, income records, or transaction history that fed the model.

The pitch is precise: any lending contract can verify that a borrower meets a creditworthiness threshold without accessing the sensitive data behind that determination. At the time the integration was published, Qiro’s private credit marketplace was live across the Sepolia, Plume Devnet, and Polygon Amoy test networks, with a broader rating platform still in development, so this remains an early-stage deployment rather than a mainnet product handling meaningful volume. It is nonetheless one of the clearest examples of zkML solving a problem that has nothing to do with proving an AI agent behaved honestly, and everything to do with keeping financial data private while still letting a smart contract act on a conclusion drawn from it.

Giza’s Pivot: From Generic Tooling to Provable DeFi Agents

Giza entered the zkML conversation as infrastructure: an ONNX-to-Cairo transpiler and runtime meant to let any model deploy verifiably on Starknet, the kind of general-purpose tooling that got it grouped alongside EZKL and Modulus Labs in most zkML explainers. The GIZA token’s trading history reflects how hard that generic-infrastructure bet turned out to be: it now trades for a small fraction of a cent, down more than 99 percent from its 2025 high.

The product has since narrowed. Giza’s current platform positions itself around autonomous DeFi agents that manage yield strategies non-custodially, including a savings product on Base that the company says continuously monitors lending protocols and reallocates capital to wherever it earns the most, often into the liquid-staked assets that HOGE Wire has described as DeFi’s default reserve collateral. Giza’s own marketing leans hard on the same integrity-and-confidentiality distinction this piece opened with: it describes its agents’ actions as provable, auditable, and explainable, verifiability applied to an autonomous agent’s decision-making rather than to a generic model inference. Unlike general-purpose agent frameworks such as the one behind the Eliza framework, which focus on giving an agent memory and tool access rather than cryptographically provable execution, Giza’s newer positioning bakes the proof requirement into the product itself.

That pivot, from selling a proving toolkit to selling a provable product, is worth watching as a template. Several zkML-adjacent teams have found that generic verifiable-inference infrastructure is a difficult standalone business; wrapping the same cryptography around a specific financial product with an obvious buyer, in Giza’s case a yield-seeking DeFi user rather than a hypothetical developer building on Cairo, is a narrower but more legible pitch. Whether it is a more durable one is a question the token price has not answered kindly so far.

DeepProve and the Race to Prove a Full LLM

Most of zkML’s benchmark progress has come from narrowing the gap between proving a toy model and proving something resembling a production system. Lagrange Labs’ DeepProve, a proving stack purpose-built for machine learning workloads rather than general computation, is the clearest data point for how fast that gap has closed. Lagrange’s own published benchmarks, comparing DeepProve against baseline EZKL-style proving on equivalent models, claim proof generation up to 1,000 times faster, verification up to 671 times faster, and one-time setup up to 1,150 times faster, achieved through a combination of sum-check protocols for linear computations and lookup arguments for the non-linear layers that make everything expensive.

The more significant milestone came several months later. In August 2025, Lagrange announced DeepProve-1, which the company describes as the first production-ready zkML system to generate a complete cryptographic proof of a full large language model inference, running the proof against OpenAI’s GPT-2. Getting there required adding support for transformer-specific operations the original release did not handle: multi-head attention, layer normalization, softmax, and an autoregressive inference engine that verifies a model token by token rather than in a single forward pass. Lagrange said its network had generated more than 13 million proofs by the time of that announcement, with support for LLaMA, Gemma, Falcon, and Mistral architectures listed as near-term roadmap rather than a shipped capability.

GPT-2 is not a frontier model by 2026 standards, and proving a GPT-2 forward pass is a long way from proving a modern frontier LLM’s inference economically. But it is the first time any zkML system has proven a full transformer-based language model end to end rather than a small classifier or a truncated slice of a larger network, and it reframes the honest answer to whether zkML can prove an LLM from no to yes, at small scale, slowly, and at a cost nobody would pay for a production chatbot yet.

What Proving Actually Costs in 2026

Benchmark claims from any single vendor are worth reading skeptically, since methodology, hardware, and baseline choice all shift the numbers. The table below pulls together the most-cited public reference points across the major proving stacks, each sourced to the team’s own disclosure rather than a third-party recreation, so treat the comparisons as directional rather than strictly apples-to-apples.

The pattern across all four rows is the same: image classifiers and small models are provably solved today, in the sense that proving cost is low enough to be practical, while anything approaching a modern LLM remains either unproven, proven only in narrow research demonstrations, or priced far beyond what any real application would pay per inference. That last point traces back to Modulus Labs’ original 2023 benchmarking paper, titled The Cost of Intelligence and produced by Daniel Shorr’s team out of Stanford, which remains the reference point the rest of the field measures itself against precisely because so little has displaced its core finding: non-linear layers, not model size alone, drive the cost curve, and proving cost scales worse than inference cost as models grow.

The Next Hybrid Wave: zk-ML Meets Fully Homomorphic Encryption

Zero-knowledge proofs solve a narrower problem than most coverage implies. A ZK proof can hide inputs and outputs from a verifier, but the prover itself still has to see everything in plaintext to generate the proof in the first place. For applications where even the party running the computation should not see the sensitive data, a hospital outsourcing diagnostic inference to a cloud GPU it does not fully trust, for instance, zero-knowledge alone is not enough.

Fully homomorphic encryption fills that gap by allowing computation directly on encrypted data, producing an encrypted result that only the data owner can decrypt, without the computing party ever seeing plaintext at any point. FHE has historically been too slow for anything beyond research demonstrations, but 2026 has been the year that changed materially. Zama, which became the first FHE-focused unicorn in mid-2025 and launched its mainnet on Ethereum in late December of that year, reported GPU benchmarks reaching roughly 1,000 confidential transactions per second, up from around 0.2 transactions per second at its first public demonstration back in 2022. Rand Hindi, Zama’s chief executive, described the significance of the underlying technology to The Next Web: “this is particularly revolutionary because it enables data privacy and security to coexist with utility, allowing for the analysis of confidential information without exposing the underlying data.”

Fhenix and Inco are pursuing similar ground with different architectures, Fhenix through a dedicated Layer 2 with off-chain FHE coprocessors live on Base and Arbitrum, Inco through a modular confidentiality layer other chains can plug into. None of these projects market themselves primarily as zkML infrastructure, but the overlap is not incidental: a model that needs to keep both its weights and its input data confidential from the machine running it, not just from the eventual verifier, increasingly gets described as a zk-plus-FHE hybrid rather than a pure zkML system. Expect that boundary to blur further through the rest of 2026 as proving costs on both sides continue to fall.

What the Cryptography Community Is Actually Saying

The loudest voice connecting AI and verification remains Ethereum co-founder Vitalik Buterin, though his most-discussed 2026 remarks on the subject were about formal verification of code rather than zkML specifically, a distinction worth preserving rather than blurring. In a blog post covered by CoinDesk in May 2026, Buterin argued that AI’s tendency to produce large volumes of code at the cost of accuracy could be offset by pairing it with machine-checkable formal verification. “By default, AI will enable large amounts of very sloppy code … but there is an optimistic future for cybersecurity here,” he wrote. The underlying logic, that proof systems compensate for a trust deficit AI itself introduces, applies just as directly to zkML’s pitch for model outputs as it does to source code.

On the proving-infrastructure side, Boundless chief executive Shiv Shankar has been explicit that the zero-knowledge compute his network sells is not staying siloed to blockchain settlement. In July 2026, Boundless redirected a meaningful share of its roughly 4,000-GPU network, originally built to settle ZK proofs between Ethereum, Base, and Bitcoin, toward AI inference workloads, a move reported by The Block. “Four years ago, we set out to solve one hard compute problem,” Shankar said of the shift. “In the process, we built something bigger: a network for coordinating distributed GPU capacity. AI now needs the same foundation at a much larger scale.” Boundless says early benchmarks show inference costs undercutting major cloud providers by as much as half for asynchronous workloads, with its ZKC token retaining a staking role in the expanded network.

The field’s more academic corner is anchored by Justin Thaler, a research partner at a16z crypto and associate professor of computer science at Georgetown University, whose survey Proofs, Arguments, and Zero-Knowledge has become close to the standard reference text new entrants cite when explaining the sum-check protocols and polynomial commitment schemes that DeepProve and most modern zkML systems build on. His work is a reminder that the primitives underneath zkML’s 2026 product pitches were largely established in the theoretical cryptography literature well before any of these companies existed; the last three years have mostly been an engineering race to make that theory cheap enough to run.

Tokens and Funding: A Sector Still Searching for a Business Model

Every major zkML-adjacent token has spent 2026 well below its all-time high, a pattern that tracks the broader ai-crypto correction more than anything specific to zero-knowledge machine learning. The snapshot below reflects direct CoinGecko pricing as of July 31, 2026; all of these tokens are thinly traded relative to major-cap crypto assets and can move sharply in either direction within days.

The common thread is a wide gap between fully diluted valuation and circulating market cap across nearly every token in the category, low-float launches that leave heavy future unlock pressure baked into the price. Zama is the partial exception: its token only reached the market in earnest in 2026, is still trading close to its all-time high, and represents a company with an outside institutional funding history, a unicorn valuation reported at over a billion dollars as of its 2025 raise, rather than a project that launched a token first and built revenue after. Institutional desks that have put Coinbase, Binance, Kraken, and OKX through HOGE Wire’s own execution testing tend to treat market caps this small as venture-style bets rather than core allocations, regardless of which exchanges eventually list them. That gap between well-funded infrastructure bets and speculative token launches is likely to widen rather than close as the sector matures; proving infrastructure is expensive to build whether or not a token trades well.

Where the Economics Still Don’t Work

Set aside the benchmark wins for a moment and the honest accounting is less flattering. Proving cost, even after Lagrange’s claimed order-of-magnitude improvements over baseline EZKL performance, still runs meaningfully above the cost of simply running the underlying model and trusting the result. That premium only makes economic sense when the value of the proof itself, regulatory comfort, a betting market’s settlement integrity, or a compliance requirement that trust alone cannot satisfy, clearly exceeds the extra compute spend. For the overwhelming majority of AI inference happening today, an image classifier tagging a product photo, a chatbot answering a support ticket, that bar is not met and is not close to being met.

Hardware concentration compounds the problem. Proof generation for anything beyond small models increasingly requires specialized GPU infrastructure, and the proof marketplaces built to supply that capacity, Boundless chief among them, are themselves concentrating around a small number of large operators even as they market decentralization. A prover network with a few dozen entities capable of generating proofs at competitive cost is a meaningfully different trust model from the thousands of independent validators securing a base-layer blockchain, even if the cryptographic guarantee on any individual proof is identical either way.

Quantization loss, covered above, remains the quieter risk. A verified proof only confirms that a specific circuit executed correctly, not that the circuit’s fixed-point approximation of the original floating-point model preserved every meaningful behavior of that original model. A model that passes a fairness or safety check in its full-precision form could, in principle, behave differently once quantized for provability, and the proof itself has nothing to say about that gap. Nobody serious in the field claims otherwise, but that caveat is easy to lose in a pitch deck that leads with the word verified.

The SEC’s Lens: What Verifiable Means for Compliance

None of zk-ML’s core cryptography falls under securities law in any direct sense; a proving circuit is not an investment contract. But the layer above it, AI-driven trading, robo-advisory, and asset management products, sits squarely inside a regulatory framework the SEC has been actively rebuilding through 2026. The agency’s Division of Examinations named artificial intelligence controls a fiscal year 2026 priority in its examination priorities released in November 2025, directing exam staff to review how registrants govern, disclose, and control the operational risk that AI use introduces. Enforcement sits with the Cyber and Emerging Technologies Unit, formed within the Division of Enforcement in February 2025 to cover AI-driven market manipulation, algorithmic trading failures, and misleading AI-related disclosures in filings and investor communications, alongside its original crypto-asset mandate.

Chair Paul Atkins has been consistent that the agency’s posture toward AI leans away from prescriptive, technology-specific rules and toward its existing materiality-based disclosure framework: a firm claiming its AI model does something specific still has to make that claim true and substantiated, whether or not a bespoke AI rule exists to say so, and a disclosure checklist is not a substitute for that underlying obligation. That framing is where zk-ML’s compliance pitch actually lands. A verifiable proof that a trading model executed within stated parameters, or that a robo-advisory model’s decision matched its disclosed methodology, is a genuinely useful substantiation tool for exactly the kind of AI disclosure claims the Cyber and Emerging Technologies Unit is now positioned to scrutinize. It does not create a new safe harbor and it does not replace a firm’s disclosure obligations, but as those obligations get enforced more actively, cryptographic proof of what an AI system actually did becomes a more valuable thing for a registered firm to be able to produce on demand.

What to Watch in the Second Half of 2026

A handful of concrete developments will determine whether 2026’s progress compounds or stalls.

• Lagrange’s roadmap for extending DeepProve to LLaMA, Gemma, Falcon, and Mistral, the clearest test of whether the GPT-2 milestone generalizes or was a one-off tuned to an older architecture.
• Whether Boundless’s pivot toward AI inference on its existing GPU network signals a real convergence between proof-market infrastructure and AI-compute infrastructure, or pulls back toward one workload once margins get tested.
• Whether any FHE network, Zama, Fhenix, or Inco, gets a zk-ML-specific hybrid product past the demo stage into real model inferences rather than confidential token transfers, still the dominant FHE use case today.
• Whether the SEC’s Cyber and Emerging Technologies Unit brings an enforcement action naming an AI verification or disclosure claim specifically, which would signal how seriously compliance teams need to treat verifiable-AI infrastructure.

None of these are certainties. The same underlying question, whether a quantitative claim can be checked rather than simply trusted, echoes far beyond zk-ML itself; readers who have followed HOGE Wire’s halving-cycle positioning playbooks will recognize the same tension between a model’s back-tested claims and any outsider’s ability to verify them independently. What is certain is that the sector will produce another round of benchmark press releases regardless of how any of the above resolves.

Frequently Asked Questions

What is zk-ML and how is it different from regular AI verification?

zk-ML (zero-knowledge machine learning) wraps a model’s execution in a cryptographic proof that a verifier can check quickly without rerunning the model itself. Regular AI verification typically means trusting an API provider’s word, or re-running the same computation yourself to check it; zk-ML replaces both with a mathematical certificate that is far cheaper to check than to fake, and it can additionally hide the model’s input, output, or weights from whoever checks the proof, something plain API trust cannot offer at all.

Can zk-ML prove a large language model’s output today?

Only in narrow, research-stage form. Lagrange’s DeepProve-1 proved a complete inference of OpenAI’s GPT-2 in August 2025, the first time any zkML system generated a full proof for a transformer-based language model, but GPT-2 is small by 2026 standards and the roadmap toward larger, more modern architectures like LLaMA or Mistral is still in progress rather than shipped. Frontier-scale LLMs remain out of reach for practical, affordable proving.

How does zk-ML actually protect privacy?

A zero-knowledge proof lets a prover demonstrate that a computation happened correctly and satisfies certain conditions, without revealing the underlying input, output, or model weights to whoever checks the proof. World’s iris-verification network and Qiro Finance’s EZKL-based credit scoring both use this property to let a verifier confirm a specific conclusion, unique personhood or loan eligibility, without ever seeing the biometric scan or financial records behind it.

Why is zk-ML so expensive compared to just running the model?

Non-linear operations inside neural networks, like ReLU activations and softmax, do not map cleanly onto the arithmetic circuits zero-knowledge proofs are built from, and require costly auxiliary techniques to represent. Vitalik Buterin has estimated the resulting overhead at roughly 200 times the cost of running a model directly, though newer proving stacks such as Lagrange’s DeepProve claim to have cut that gap by an order of magnitude or more for the specific workloads they target.

Is zk-ML the same as fully homomorphic encryption?

No. Zero-knowledge proofs let a prover, who sees the data in plaintext, convince a verifier that a computation was done correctly, optionally without revealing the data to the verifier. Fully homomorphic encryption goes further, letting a third party compute on data while it stays encrypted the entire time, so even the machine performing the computation never sees plaintext. In 2026 a growing number of projects are combining the two rather than treating them as substitutes.

Marcus Okafor covers AI and crypto infrastructure for HOGE Wire.