| Myth | Reality |
|---|---|
| zkML lets you run any AI model fully on a blockchain. | zkML proves a computation happened correctly off-chain; only the compact proof and result get verified on-chain, since actual model inference is far too expensive to run inside a blockchain itself. |
| Zero-knowledge proofs make AI models transparent and explainable. | The opposite: zkML is designed to prove correctness while keeping the model weights and often the input completely hidden from the verifier. |
| zkML works today for any size of language model. | Proof generation cost scales steeply with model size; small models like image classifiers are practical now, while full large language model inference remains too slow and expensive for most production use as of 2026. |
| zkML is only relevant to blockchain and crypto projects. | The same verifiable-inference guarantee is useful anywhere a party needs proof a model wasn’t tampered with, including regulated industries and any outsourced inference scenario. |
Every time a machine learning model runs, whoever receives the output has to trust that the model actually ran as claimed — the correct weights, the correct input, no tampering, no substitution of a cheaper or biased model to save money. In most deployments that trust is implicit, backed by contracts and reputations rather than mathematics. Zero-knowledge machine learning, or zkML, replaces that implicit trust with a cryptographic proof: a verifier can check, in milliseconds, that a specific model produced a specific output from a specific input, without ever seeing the model’s weights or, depending on the setup, the input itself. This explainer covers how zkML actually works, the frameworks turning it into working software, the use cases where it already makes sense, and the hard limits that keep it from being a general-purpose solution yet.
What Zero-Knowledge Proofs Actually Prove
A zero-knowledge proof lets one party (the prover) convince another party (the verifier) that a statement is true, without revealing any information beyond the fact that it’s true. Applied to machine learning, the statement being proven is typically something like: “running model M on input X produces output Y.” The prover — whoever ran the actual inference — generates a proof alongside the result. The verifier, who might not have access to the model weights at all, checks the proof and gains high confidence that the computation was performed correctly, without learning the weights, and often without learning the input either, depending on how the circuit is constructed.
The property that makes this useful in practice is the asymmetry between proving cost and verification cost. Generating a zero-knowledge proof for a non-trivial computation is expensive, often requiring far more compute than the original computation itself. But verifying that proof is cheap and fast, frequently completing in milliseconds regardless of how expensive the underlying computation was. This asymmetry is exactly what makes zkML attractive for scenarios where one party needs to trust a computation performed by another party without redoing that computation themselves.
| Property | What it means for zkML |
|---|---|
| Completeness | If the model really did produce that output, a valid proof can always be generated |
| Soundness | A false claim about the model’s output cannot produce a convincing proof, except with negligible probability |
| Zero-knowledge | The verifier learns nothing beyond the truth of the claim, not the model weights or hidden inputs |
| Succinctness | The proof is small and fast to verify, regardless of how large or expensive the original computation was |
How a Model Becomes a Zero-Knowledge Circuit
Turning a trained neural network into something a zero-knowledge proof system can reason about requires converting its computation graph — matrix multiplications, activation functions, and so on — into an arithmetic circuit, a representation zero-knowledge proof systems can operate over. This conversion step is one of the main practical bottlenecks in zkML today: not every operation common in modern neural networks maps cleanly or efficiently onto arithmetic circuits, and operations like non-linear activation functions often need to be approximated in circuit-friendly ways, introducing a tradeoff between circuit efficiency and exact fidelity to the original model’s behavior.
Most current zkML tooling standardizes on the ONNX (Open Neural Network Exchange) format as an intermediate representation, since it captures a model’s architecture and weights in a widely supported format that tooling can automatically translate into a circuit, sparing developers from hand-writing circuits for each new model architecture.
The zkML proof and verification flow
A prover runs inference on a hidden model and input, converts the computation into an arithmetic circuit, and generates a succinct proof alongside the output; a verifier with only the proof and the claimed output can confirm correctness in milliseconds without ever seeing the model weights.
Current Frameworks and Projects
EZKL
EZKL is one of the most widely used open-source zkML libraries, built to automatically convert ONNX-format models into zero-knowledge circuits and generate proofs compatible with Ethereum’s EVM, meaning a smart contract can verify a zkML proof directly on-chain. Its broad ONNX support has made it a common starting point for developers experimenting with verifiable inference for smaller models such as classifiers and regression models.
Modulus Labs
Modulus Labs focuses specifically on proving neural network inference with zero-knowledge proofs, building specialized circuits optimized for the kinds of computation neural networks require. Its demonstration of a verified on-chain chess-playing AI in 2023 was an early, widely cited proof that zkML could move from theory to a working, verifiable application, and the project has continued pushing on applications like fraud detection and automated decision-making that benefit from provable correctness.
Giza
Giza is a framework for deploying machine learning models on-chain using Cairo, the programming language used by StarkNet, and also relies on ONNX for model interoperability. Rather than treating zkML purely as a proving library, Giza positions itself as a broader platform for putting verifiable ML models into on-chain and Web3 applications, targeting developers who want to deploy and extend models without building their own proving infrastructure from scratch.
| Project | Focus | Notable milestone |
|---|---|---|
| EZKL | General-purpose ONNX-to-circuit proving library | Broad model support and EVM-compatible proof verification |
| Modulus Labs | Specialized neural network proving circuits | Verified on-chain chess AI inference (2023) |
| Giza | On-chain ML deployment platform on StarKnet/Cairo | ONNX-based model interoperability for Web3 apps |
Realistic Use Cases Today
The clearest current use case is verifiable on-chain AI oracles: smart contracts that need to act on an AI model’s output — a price prediction, a risk score, a game-state evaluation — but cannot run the model on-chain themselves due to cost, and previously had no way to confirm the off-chain result wasn’t fabricated or tampered with. zkML lets the oracle submit a proof alongside its answer, letting the smart contract verify correctness cheaply without trusting the oracle operator.
A second practical use case is proving a model wasn’t tampered with or swapped for a cheaper substitute. This matters in any scenario where an inference provider is paid based on using a specific, agreed-upon model — for example, a service promising to run a specific certified model for a regulated use case could use zkML to let auditors verify that the certified model, not a cheaper stand-in, actually produced a given result, without needing to hand over the model weights themselves.
Fraud detection and recommendation models, both comparatively small and well within current proving capacity, are also realistic near-term targets, since they don’t require the enormous circuit sizes that large language models do.
Current Practical Limits
The honest limitation of zkML today is proof generation cost and latency for large models. While proof generation times have dropped substantially — from minutes down to seconds for smaller models — as hardware acceleration and circuit optimization have improved, full-scale large language model inference remains too expensive to prove for most production use cases. The circuit sizes required to represent a modern large language model’s billions of parameters translate into proving costs and times that are simply not viable for real-time or high-volume applications yet.
This means the realistic zkML deployment surface right now sits mostly with small-to-medium models: image classifiers, fraud detection models, recommendation systems, and simple decision models — not the largest generative language or vision models currently deployed in production elsewhere.
Common mistake
Teams new to zkML frequently assume they can take an existing large production model and simply “add a zero-knowledge proof” to it as a bolt-on feature. In practice, model architecture choices made without zkML in mind, particularly heavy use of non-linear activations or operations that don’t map cleanly to arithmetic circuits, often need to be redesigned or approximated specifically for provability, sometimes trading off some model accuracy for circuit efficiency.
What worked
A project building an on-chain risk-scoring oracle chose a small, purpose-built gradient-boosted or shallow neural network model instead of a larger off-the-shelf classifier specifically because it produced smaller, faster-to-generate zero-knowledge circuits, accepting a modest accuracy tradeoff in exchange for proof generation times that stayed practical for their update frequency.
Frequently Overlooked Details
- Circuit-unfriendly operationsNon-linear activation functions like ReLU or softmax often need circuit-friendly approximations, which can subtly change model behavior compared to the original floating-point implementation.
- Input privacy versus model privacySome zkML setups hide only the model weights while revealing the input, others hide both; the two are separate design choices with different circuit implications.
- Trusted setup requirementsSome proof systems used in zkML require a one-time trusted setup ceremony, which introduces its own trust assumption that needs to be understood before relying on the resulting proofs.
- Quantization for circuitsModel weights typically need to be quantized to fixed-point or integer representations for circuit compatibility, another source of small accuracy deviation from the original model.
- Hardware acceleration dependencyMuch of the recent drop in proof generation time comes from specialized hardware and optimized proving libraries, meaning practical zkML deployment still depends on access to that tooling, not just algorithmic improvements.
Glossary
- Zero-knowledge proof
- A cryptographic method allowing one party to prove a statement is true to another party without revealing any information beyond the statement’s truth.
- Arithmetic circuit
- A representation of a computation as a sequence of addition and multiplication operations, the form zero-knowledge proof systems typically operate over.
- Succinctness
- The property that a zero-knowledge proof stays small and fast to verify regardless of how large or expensive the underlying computation was.
- On-chain oracle
- A service that feeds external, real-world data or computed results to a blockchain smart contract, which can otherwise only access on-chain data.
- Trusted setup
- A one-time cryptographic ceremony required by some zero-knowledge proof systems to generate public parameters, whose integrity is an assumption underlying the security of resulting proofs.
Key Takeaways
- zkML uses zero-knowledge proofs to verify a model inference ran correctly without revealing model weights or, often, the input.
- Verification is cheap and fast even when the original proof generation was expensive, which is what makes zkML practically useful.
- EZKL, Modulus Labs, and Giza are leading current frameworks, each with different focuses from general ONNX proving to on-chain platforms.
- Verifiable on-chain AI oracles and tamper-proofing for outsourced inference are the clearest realistic use cases today.
- Large language model inference remains too expensive to prove for most production use as of 2026.
- Model architectures often need circuit-friendly redesign, since not every operation maps cleanly onto arithmetic circuits.
- Small-to-medium models like classifiers, fraud detectors, and recommenders are the realistic zkML deployment surface right now.
FAQs
What is zero-knowledge machine learning (zkML)?
zkML combines zero-knowledge proofs with machine learning to let a party prove a model inference was run correctly, without revealing the model’s weights or, depending on the setup, the input, while letting anyone verify the proof quickly.
How is zkML different from just publishing model outputs?
Publishing an output alone requires trusting the party that ran it; a zkML proof provides a cryptographic guarantee that the claimed model and input actually produced that output, without needing to trust the operator or see the model.
Can zkML run large language models today?
Not practically in most production settings as of 2026; proof generation costs scale steeply with model size, so full-scale large language model inference remains too slow and expensive to prove, while smaller models like classifiers are well within reach.
What is EZKL used for?
EZKL is an open-source library that automatically converts ONNX-format machine learning models into zero-knowledge circuits and generates proofs compatible with Ethereum’s EVM, letting smart contracts verify model correctness on-chain.
What did Modulus Labs demonstrate?
Modulus Labs demonstrated a verified on-chain chess-playing AI in 2023, one of the first widely cited practical proofs that zero-knowledge machine learning could move from research into a working, verifiable application.
Is zkML only useful for blockchain applications?
No, while blockchain and Web3 use cases like on-chain oracles are the most visible applications today, the underlying guarantee of provable, tamper-proof inference is useful anywhere outsourced or opaque model execution needs independent verification.
Why can’t every model architecture be used directly with zkML?
Some common neural network operations, particularly non-linear activation functions, don’t map cleanly onto the arithmetic circuits zero-knowledge proof systems require, so models often need circuit-friendly approximations or redesign.
What is the main practical limit of zkML in 2026?
Proof generation cost and latency for large models remain the main limit; while proving times for smaller models have dropped from minutes to seconds, large-scale generative models are still too expensive to prove for most production use cases.
Readers interested in other cryptographic and statistical approaches to trustworthy machine learning may also want our piece on differential privacy in real deployments, which covers a different way of protecting data rather than proving computation correctness. For teams thinking about model evaluation more broadly, our guide to LLM evaluation frameworks and our piece on model monitoring in production cover complementary trust and reliability concerns. Fraud and risk models, one of the realistic near-term zkML use cases, are also covered from a different angle in our guide to graph neural networks for fraud and risk detection, and reproducibility concerns that overlap with provable inference are discussed in our article on reproducible ML.
- ICME Labs, “The Definitive Guide to ZKML (2025)”
- Kudelski Security, “ZKML: Verifiable Machine Learning using Zero-Knowledge Proof”
- World, “An introduction to zero-knowledge machine learning (ZKML)”
- arXiv, “A Survey of Zero-Knowledge Proof Based Verifiable Machine Learning”
- Cryptowisser, “zkML: How Zero-Knowledge Proofs Enable Private AI in Crypto”
