Where zk-ML Actually Ships in 2026: Six Jobs for AI Proofs

Somewhere on Ethereum, a chess engine has been playing the entire internet, and the interesting part is that it cannot cheat. In Modulus Labs’ Leela vs the World, a crowd of players pooled bets against Leela Chess Zero, and every move the machine made arrived with a cryptographic proof that the advertised neural network, not some cheaper substitute, actually chose it. The operator could not quietly swap in a weaker model to win the pot. The math would have caught it.

That trick has a name: zero-knowledge machine learning, or zk-ML. For most of its short life it was a laboratory curiosity, impressive in a demo and hopeless in production. Proving that one small model produced one output could take hours and cost more than the inference itself. Then 2026 arrived, and the numbers moved. Lookup-based proving systems and machine-learning-specific provers cut the cost by orders of magnitude, and Lagrange’s DeepProve became the first system to prove a full language model end to end. The wall that had kept zk-ML in the lab finally cracked.

So the question changed. It is no longer whether you can prove that an AI ran honestly; you can. The question is when that proof is worth paying for. This is a tour of the six places where the answer in 2026 is already yes, from provably fair games to the compliance paperwork regulators are starting to demand, along with the honest limits and the strange gap between technology that works and tokens that have lost almost everything.

What a zk-ML proof actually certifies

Strip away the cryptography and a zk-ML proof makes a narrow, precise promise. It certifies that a specific model, meaning a specific set of weights, ran on the input that was claimed and produced the output being shown. A verifier checks a small proof in milliseconds rather than re-running the model, and in many designs it can do so on-chain inside a smart contract. That is the whole product: a receipt that the computation happened as advertised.

It is just as important to be clear about what the proof does not say. It does not certify that the model is good, fair, unbiased, or that its answer is true. It proves computational integrity, not wisdom. A provably executed model can still be provably wrong. Vitalik Buterin made this point sharply in his essay on crypto and AI, warning that using an AI as the rules of a mechanism, the thing that decides who wins and who pays, is the highest-risk pattern of the lot, precisely because a proof of correct execution says nothing about whether the model itself was the right judge.

zk-ML comes in two flavors, and the distinction decides most use cases. The first proves correctness in public: anyone could re-run the computation, you are simply saving them the trouble and handing them a guarantee. The second proves something while hiding it: you can convince a verifier that a model produced a result without revealing the model’s weights or the user’s input. That second flavor, privacy and proof at the same time, is the thing no competing approach can match, and it is why zk-ML keeps surviving despite being the most expensive option on the menu.

Why the applications finally arrived in 2026

To understand why products are shipping now, look at where the cost used to sit. Buterin’s essay put the overhead of proving the non-linear parts of a neural network, the activation functions like ReLU and softmax, at roughly 200 times the raw computation, while the matrix multiplications added less than four times. Researcher Daniel Kang, whose TensorPlonk work chased GPU-grade speedups for zk-ML, has described proving a single example from a Twitter-scale recommendation model taking around six hours in early tooling. At those numbers, verifiable AI was a science project.

The floating-point problem made it worse. As a16z crypto’s Elena Burger put it in the firm’s overview of the field, zero-knowledge proofs today cannot represent 32-bit floating point operations in the arithmetic circuit format proofs require without massive overheads, which forces developers to quantize models down to 8-bit integers and accept what she calls a cruder approximation of the original. Accuracy traded for provability was the deal every builder had to sign.

Two shifts changed the arithmetic. The first was the move from circuits to lookups and sumcheck. Jolt Atlas, built by ICME Labs and NovaNet on top of a16z’s Jolt design, replaced the expensive circuit encoding of non-linear operations with lookup tables, adapted for the tensor operations machine learning actually uses. ICME’s Wyatt Benno summed up the change without hedging: lookups, he wrote, eliminate the need for circuit representation entirely, and his team’s benchmarks put a small zk-ML inference near 0.7 seconds against 4 to 5 seconds on the older EZKL circuit path.

The second shift was Lagrange’s DeepProve, open-sourced in June 2026. By the company’s account it had generated more than 12 million proofs and verified more than 3 million inferences end to end, ran on the order of 671 times faster on verification than the EZKL baseline, and, most importantly, proved a full GPT-2 and Gemma-3 language model rather than a toy classifier, with Llama-class models still in development. It reads the model formats that real systems ship in, ONNX, safetensors and GGUF, instead of demanding a bespoke rewrite. Founder Ismael Hishon-Rezaizadeh framed the open-sourcing as a deliberate hand-off: “We didn’t build DeepProve to own verifiable AI,” he said in the release. “We built it so nobody had to. Today, DeepProve becomes a primitive. The black box is open.”

None of this makes frontier models cheap to prove. A 400-billion-parameter system is still out of reach, and honest builders say so. What it means is that the cost curve bent far enough that specific, valuable jobs now pencil out. Those jobs are the rest of this article.

zk-ML is one of four ways to trust a computation

zk-ML rarely competes alone, so before the use cases it helps to see the whole menu. Four families of verifiable compute try to answer the same question, did the server actually run what it claimed, with very different trade-offs. The right one depends entirely on how much money is at stake, how fast the answer has to come back, and whether anything needs to stay secret.

Read the table as a set of situational bets rather than a ranking. When the value at stake is small and latency matters, a secure enclave or a stake bond is plenty, which is why so much of the market runs on those two. When the money on the line dwarfs the cost of a proof, or when an input simply cannot be revealed, zk-ML earns its premium. Every use case below is at heart an argument about which column wins.

Job one: provably fair AI inside on-chain games

Online games have always had a trust problem. The house runs the code, so how do you know the shuffle was honest, the loot drop was not rigged, or the enemy AI did not quietly read your hand. Crypto answered part of that years ago with provably fair randomness, letting players verify that a dice roll was not tampered with after the fact. zk-ML extends the same guarantee from the luck to the intelligence.

The clearest examples come from Modulus Labs, the team led by Daniel Shorr that treated on-chain AI gaming as a research frontier. Leela vs the World billed itself as the first on-chain AI game: the crowd played against Leela Chess Zero and every move carried a proof that the real policy network chose it, so the operator could not switch to a weaker engine to protect the prize pool. The same instinct produced RockyBot, a trading-bot game whose decision is verified before any capital moves. The models were small, but the principle was general: the operator’s honesty became something you check, not something you hope for.

The 2026 version of the demo is Lagrange’s Turing Roulette, a human-versus-AI guessing game built to show off DeepProve. It is a party trick with a serious payload underneath: by the company’s numbers it drew more than 500,000 participants and produced 3.7 million live verified inferences, a public stress test of whether proofs can keep up with players in real time. Gaming is the natural first market for a reason. The stakes are genuinely real because money is bet, yet the models are small enough that proving them is affordable right now, and players already understand and pay for the words provably fair.

It is the same defensive instinct that makes studios hire red teams to break their systems before attackers do: a cryptographic guarantee removes the need to trust the operator’s word at all. The caveat is the one from the primer. A proof shows the advertised model chose the move; it does not show the model is unbeatable or unbiased, and it works today only because game models are tiny. A game built around a frontier-scale LLM opponent still cannot be proven move by move at the speed play demands.

Job two: tamper-proof models inside DeFi

The most convincing production deployment of zk-ML in 2026 lives in decentralized finance, and it starts with EZKL. Built by Jason Morton’s team at zkonduit, EZKL compiles an ordinary ONNX model into a Halo2 proof without asking the developer to learn any cryptography, which made it the baseline the rest of the field now measures itself against. Its highest-profile user is OpenGradient, which describes itself as an AI coprocessor: validators verify a proof, by zk-ML or by hardware attestation, before any model output is committed on-chain.

The concrete case is a dynamic-fee mechanism for Uniswap V3. An AI model adjusts a pool’s fee in response to volatility, and a proof guarantees that the fee was set by the model governance approved, not by a tampered copy quietly rewired to skim liquidity providers. This is the column of the earlier table where zk-ML wins outright. When a model controls a lending pool’s risk parameters, a liquidation threshold, or an automated market maker’s fee, the value flowing through it can reach into the millions, so spending a few dollars and a few seconds on a proof is trivial insurance against a manipulated model.

The oracle angle generalizes the idea. An AI oracle that reports a price, a sentiment score, or a credit rating can attach a proof that the number came from the agreed model running on the agreed data, which closes off one of DeFi’s oldest attack surfaces: a corrupted feed. Venues that live and die by their price and risk inputs are the obvious customers. The perpetual-futures market, where someone always takes the other side of your trade, leans on oracle prices and funding models the same way lending protocols lean on risk engines, and a proof that the engine ran exactly as specified is precisely the assurance those systems have lacked. The caveat holds here too: these are small models, fee-setters and risk classifiers rather than language models, and a proof that the model ran correctly says nothing about whether its prediction was any good.

Job three: agents that prove their own work

The busiest corner of crypto-AI in 2026 is the autonomous agent, and it has a hole in the middle. Agents got wallets, through payment standards like Coinbase’s x402, and they got identity, through the ERC-8004 registries. What they still lack is a way to prove what they actually computed before they acted. An agent that signs a transaction on the strength of an LLM’s decision is asking you to trust that the decision really came from the model it names, and not from a swapped, poisoned, or hallucinating substitute.

This is where zk-ML slots into the agent stack by design. The ERC-8004 Trustless Agents standard, drafted by Marco De Rossi of MetaMask, Davide Crapis of the Ethereum Foundation, Jordan Ellis of Google and Erik Reppel of Coinbase, defines three registries: Identity, Reputation, and Validation. The Validation Registry is explicitly a socket for verifiable evidence that an agent completed a task within its constraints, and the specification names zk-ML verifiers alongside staked re-execution and hardware oracles as ways to fill it. The reason that socket matters is that the alternative, reputation, is cheap to fake; empirical audits of live ERC-8004 deployments found that large majorities of the reviewer accounts were Sybils. A cryptographic proof is not a popularity score. It is a fact.

Real money is already moving this way. Giza’s ARMA, an autonomous agent on Base, shuffles stablecoin deposits across Aave, Morpho, Compound and Moonwell to chase yield, the kind of unattended capital allocation where a verifiable decision is worth paying for. Agents like these usually run on programmable smart accounts, and a proof-of-inference check fits neatly into the module economy those wallets have grown, another plug-in in a stack of them. Verifiable compute does not solve every agent risk; it will not stop a prompt-injection attack like the one that drained roughly 150,000 dollars from a Grok-linked wallet, because that is an input problem, not a computation problem. What it does stop is quieter and just as damaging: an operator swapping the model, or an agent lying about which model it ran.

Job four: prediction markets and AI as referee

Every prediction market needs a resolver, the party that decides whether an event happened and therefore who gets paid. As markets scaled through 2026, AI began to look like an attractive judge: fast, cheap, and available around the clock to read a news feed and rule on an outcome. It is also, by Buterin’s own taxonomy, the single riskiest way to use AI in a crypto mechanism, because an AI that decides who wins is the rules of the game, and if that AI can be swapped or nudged, the market is quietly rigged.

zk-ML narrows the danger without pretending to erase it. A market can attach a proof that the outcome was decided by the resolution model everyone agreed to, running on the evidence everyone agreed to, which removes the operator-swapped-the-judge attack entirely. That guarantee matters more than it used to, because the venues themselves have changed. Bots now dominate the order flow on several of the largest markets, and when agents trade against agents and easy money dries up, a provably honest referee is the line between a market and a casino with a weighted wheel. The limit is the one that keeps recurring in this article, and it bites hardest here: proving the judge ran correctly is necessary, not sufficient. A correctly executed bad judge still hands the pot to the wrong side, and no proof can rescue it.

Job five: proving an answer without exposing the data

This is the job only zk-ML can do, and it is why the approach refuses to die despite being the most expensive on the menu. Privacy runs in two directions, and both have real buyers. The first hides the user’s input. A model can prove it scored your creditworthiness, matched your face to a government ID, or read a medical scan, without revealing the financial history, the biometric, or the image itself. Proof-of-personhood systems are the flagship case: convince a verifier that a model confirmed you are a unique human, while the iris or face data that made the determination never leaves your control.

The second direction hides the model. A company can sell inference as a service and prove that it ran its own proprietary weights correctly, without handing those weights, its most valuable asset, to the customer. That turns the empty promise of trust me, I ran the good model into something a buyer can actually check, and it lets a business keep a model closed while still being accountable for using it honestly.

Secure hardware can also keep data private, but it does so by asking you to trust the chipmaker, and for regulated categories like health, biometrics and finance, the gap between trust the vendor and trust the math is exactly the gap compliance teams worry about. Fully homomorphic encryption, the other privacy primitive, computes directly on encrypted data but is slower still, and in practice the two are sometimes combined. The honest caveat is that privacy proofs are the heaviest kind of zk-ML, so this lane is where cost bites first. It is viable today for smaller models and specific high-value private tasks, not yet for private, general-purpose language-model chat at consumer scale.

Job six: the audit trail regulators are starting to demand

The sixth job is the one that could dwarf the other five, and it comes from outside crypto entirely. Regulators are moving toward auditability as a baseline requirement for consequential AI. The EU AI Act reached general applicability on 2 August 2026, switching on the Commission’s enforcement powers and its transparency rules, with obligations for general-purpose models already live since August 2025 and the heaviest high-risk duties phasing in through 2027 and 2028. The through-line of the whole framework is that a high-risk system has to be documented, logged, and demonstrable after the fact. The model said so stops being an acceptable answer.

The demand signal is not hypothetical. Lagrange, citing McKinsey research, reports that 71 percent of enterprise executives say they will not scale AI systems without proof of correctness, and Stanford’s AI Index counted 362 AI incidents in 2025, up roughly 55 percent on the prior year. As AI slides into credit decisions, insurance claims and medical triage, a cryptographic record of exactly which approved model ran on which input becomes the kind of evidence auditors and courts already know how to read. For a bank running an AI credit model or an insurer running a claims model, a zk-ML proof is a tamper-evident receipt it can hand a supervisor.

Two honest qualifications keep this from being a gold rush. No regulator, in the EU or anywhere else, currently requires zk-ML specifically; the Act requires auditability, and signed logs or hardware attestations are cheaper ways to deliver most of it. And the pull is far stronger in Europe than in the United States, where the SEC’s attention has stayed fixed on whether tokens are securities rather than on how AI decisions get documented. Compliance is a tailwind for zk-ML, not a mandate, but it is the tailwind most likely to turn a clever primitive into a line item.