When a model denies your loan, moderates your post or grades your exam, you are asked to trust three things at once: that the stated model was used, that it received the stated input, and that it produced the stated output. Today you mostly take the operator’s word. A branch of cryptography called ZKML is trying to replace that word with a proof.
The claim to be proved
Verifiable inference means producing, alongside a model’s output, a cryptographic proof that a specific committed model, run on a specific input, yields exactly that output - without revealing the model’s weights. The tool is the zero-knowledge proof: the operator proves the computation was performed faithfully while keeping the proprietary parameters secret. In principle this resolves a genuine tension - commercial models are trade secrets, but their decisions demand accountability - by separating the two.
| Approach | What it gives you | The catch |
|---|---|---|
| Zero-knowledge proofs (ZKML) | A cryptographic receipt that the stated model produced the output | Proving overhead is enormous; practical for small models, not frontier ones |
| Trusted hardware (TEEs) | Attestation that code ran inside a sealed enclave | You are trusting the chip vendor and its supply chain |
| Optimistic re-execution | Anyone can re-run and challenge a claimed result | Requires the model to be available to challengers |
The applications are easy to imagine. A regulator could verify that the model actually deployed is the one that was audited. A user could confirm that the cheaper, faster model wasn’t quietly swapped in. A marketplace could prove a result came from the advertised system.
The price
The difficulty is cost, and it is not a rounding error. Proving the execution of a large neural network in zero-knowledge can be orders of magnitude more expensive than running the network itself. Modern models involve billions of operations; expressing each as a cryptographic constraint and proving the whole is, for the largest models, still impractical. This is why claims in this area deserve scrutiny rather than applause, and why we hold “verifiable AI” assertions to that standard in our reporting carefully.
The question is not whether verifiable inference is possible. It is whether it is affordable - and for the biggest models, not yet.
Where it stands
Progress is real. Purpose-built proving systems, custom arithmetisations for common network operations, and folding techniques that batch repeated layers have pushed feasible model sizes steadily upward. For small and medium models - a fraud classifier, a moderation filter, a recommendation scorer - verifiable inference is moving from research into something deployable. For frontier-scale language models it remains, for now, aspirational.
There are lighter-weight alternatives worth knowing about. Trusted hardware enclaves can attest to a computation at far lower cost, trading cryptographic guarantees for trust in a chip vendor. Optimistic schemes assume honesty and prove only when challenged. Each is a different point on the same trade-off between cost and the strength of the guarantee.
Why it is worth watching
The direction of travel is what makes this a story rather than a curiosity. As models take on decisions that demand accountability, the ability to prove what a system did - not merely assert it - becomes valuable enough to pay for. The honest position today is that verifiable inference works where it is cheap enough and doesn’t where it isn’t, and the boundary between those two regions is moving in one direction.
The cost wall, plainly
The reason this field is a frontier rather than a product category is arithmetic. Producing a zero-knowledge proof of a computation costs orders of magnitude more than running the computation - for the small neural networks where proving has been demonstrated end-to-end, factors in the thousands are routine, and the gap widens with model size because proving cost grows with every multiplication the model performs. A frontier language model executes trillions of operations per response. Nobody has proven one, and nobody credibly claims to be close; what is genuinely advancing is the proving of components - a small classifier, a single attention layer, a quantised model - and the folding techniques that might one day chain components into wholes.
Hardware trust, the pragmatic rival
This is why trusted execution environments dominate the deployed end of the market despite their weaker guarantee. A TEE gives you a signed attestation that specific code ran on genuine, unmodified hardware - at essentially native speed. The catch is the trust anchor: you are believing a chip vendor’s key, its manufacturing chain, and the absence of the side-channel attacks that have repeatedly, publicly dented these systems. The honest framing is a spectrum: cryptographic proof where the stakes justify a thousandfold overhead, hardware attestation where speed matters and the vendor is acceptable, re-execution and spot-checking where openness allows. A vendor who names which rung they stand on is being straight with you; one who says “verifiable” without a rung is selling the word.
The 2026 reality check - what the proving boom does and doesn’t change
The headline numbers from the proving world are genuinely astonishing - full Ethereum blocks proven in seconds, costs down forty-five-fold in a year - and it is tempting to read them as “proven AI is imminent.” Resist the syllogism. A block of transactions is millions of simple, exact operations; a frontier model’s forward pass is billions of approximate ones, in floating-point arithmetic that proof systems must first pin down exactly. The honest 2026 state: proving small and mid-sized model inference is practical and shipping in narrow deployments; proving frontier-scale inference at interactive latency is not, and the gap is measured in orders of magnitude, not quarters. What the boom does change is the trajectory’s credibility - the same recursion-and-hardware curve that compressed sixteen minutes to sixteen seconds is now pointed at neural workloads, and this desk’s benchmark rules apply unchanged: model size, hardware, latency, security bits, or it didn’t happen.
MEANWHILE, THE CHEAP SEATS
Most “verified AI” a reader meets in 2026 is not zero-knowledge at all - it is attestation (signed claims about which model ran, from trusted hardware) and provenance (signed outputs). Weaker guarantees, deployable today, and honestly labelled they are worth having. The scandal is only ever in the conflation.
THE DESK’S BOTTOM LINE
Verifiable inference is real, early, and moving on the fastest cost curve in cryptography. Grade every claim on the four numbers - parameters, seconds, dollars, security bits - and treat any pitch missing one as marketing until it isn’t.
