Proving systems improve constantly, and every improvement ships with a multiplier. The multiplier is rarely false. It is just, reliably, an answer to a question the headline doesn’t state.
Performance in this field lives on three axes that trade against each other: prover time (how long it takes to make the proof - the expensive part, often thousands of times the cost of just running the computation), verifier time (how long to check it - ideally milliseconds), and proof size (what you pay to store or post it, which matters enormously when the verifier is a blockchain charging by the byte). Any system can look spectacular on one axis by spending on the others; recursion and folding shift costs between them further still. A speedup claim without its axis is a number without units.
The question that sorts every claim
Faster than what, proving what, on what hardware? The baseline might be the team’s own previous release, a rival system configured unfavourably, or a genuinely comparable setup - the multiplier looks identical in all three cases. The workload matters just as much: systems have very different strengths across hashing, signatures and general computation, so a benchmark on one circuit says little about another. And hardware is the quiet variable, since GPU and specialised acceleration can dominate the comparison entirely.
What good looks like is the same here as everywhere on this desk: named baseline, named circuit, named hardware, all three axes reported, code available to rerun. The teams doing the strongest work publish exactly that - which is itself a useful signal about everyone who doesn’t.
Hardware is half the headline
Proving workloads are dominated by a small set of mathematical kernels - enormous polynomial arithmetic and elliptic-curve operations - that parallelise superbly, which makes them ideal fodder for GPUs and, increasingly, purpose-built silicon. The consequence for benchmark reading: a large fraction of any headline speedup may belong to the machine, not the mathematics. A prover rewritten for GPUs will demolish its own CPU baseline while the underlying protocol stands still; specialised hardware compounds it. Neither is illegitimate - cheaper proofs are cheaper proofs - but claims about a proof system must be normalised to shared hardware, and claims about a proving service should be read as price-performance, where the honest denominator is dollars, or joules, per proof.
The reproducibility bar
The field’s saving grace is that its benchmarks are unusually checkable: circuits are code, inputs are data, and several open harnesses exist precisely to run competing systems on identical workloads and machines. So the bar this desk applies is simple - a published command line that reproduces the number, or an entry in a neutral harness, upgrades a claim from marketing to measurement. Teams doing strong work meet the bar as a matter of course; the multiplier-only announcements, reliably, do not, and after enough repetitions of that pattern the absence of a benchmark script becomes data about the benchmark.
The denominators that matter
As proving industrialises, the interesting numbers stop being raw times and become unit economics, because proofs are increasingly bought rather than run. Proving marketplaces and rollup operators think in dollars per proof and proofs per joule; a protocol that proves twice as fast on hardware three times as expensive has gone backwards for them. The same shift makes latency a first-class axis alongside cost - a proof for an exchange withdrawal is worth more in one minute than in ten, whatever it costs - and mature announcements now quote a point on the cost-latency curve rather than a single stopwatch figure. When one does, you are reading engineering; the curve is where dishonesty goes to be discovered, because a competitor can buy the same hardware and check.
Calibration: what the state of the art actually is
Benchmarks only mean something against a live baseline, so pin these 2025-26 reference points to the wall. Full Ethereum blocks - real, adversarial, 30-million-gas-plus workloads - now prove in under ten seconds for 99% of blocks on published target hardware; one system reported 99.7% under twelve seconds on sixteen consumer GPUs, another a 6.9-second average on sixty-four, with hardware bills cut in half between generations. Public, apples-to-apples comparison finally exists too: the EthProofs effort benchmarks multiple zkVMs against the same mainnet blocks in the open. So when a press release claims a proving breakthrough, the desk’s first move is now trivial: is it faster than the public frontier, on comparable blocks, on disclosed hardware, at a disclosed security level? Three of those four are usually missing.
THE SECURITY COLUMN NOBODY PRINTS
Seconds and dollars get headlines; bits decide soundness. The 2026 target the base-layer teams set themselves - 128-bit provable security at ≤300 KB proofs - exists precisely because some record-setting systems achieved their speed at conjectured, and recently eroded, security margins. A benchmark without its security parameter is half a number.
GO DEEPER
- The techniques behind the numbers - our recursion-and-folding analysis.
- Who verifies the verifiers - trusted setups, and the ceremony record.
