Proving an ML Inference: zkML, the Committed-Input Guarantee, and the Honest Cost

Abstract

This closing article of the zero-knowledge series applies the whole apparatus to machine learning. zkML — zero-knowledge machine learning — is the use of a succinct proof to convince a verifier that a model produced a particular output on a committed input, in three guarantee modes: hiding the input (a private prompt to a public model), hiding the model (a committed private model run on a public input), or hiding both. It explains the committed-input structure that gives the guarantee its force: the proof binds to a commitment of the input and/or the weights, so a prover cannot swap in a different input or a cheaper model after the fact. It then gives the honest cost. Proving an inference means arithmetizing the network into a circuit and producing a proof, which is orders of magnitude more expensive than the inference itself, dominated by prover time and memory, and hardest exactly at the non-linearities that also trouble homomorphic encryption. Small and medium models are provable today; large language models remain the research frontier. It closes on the agent-trust applications — verifiable agent decisions, proof that the promised model was actually run, and public audit trails with no trusted hardware — that make zkML a foundational primitive for a trustworthy AI ecosystem. The theme: zkML turns a model's output into a publicly checkable claim, at a real but falling prover cost.

Everything in this series was building toward a single application: proving that a machine-learning model actually produced the output it claims. zkML — zero-knowledge machine learning — lets a party convince anyone that running a specific model on a specific input yields a specific output, while hiding the input, the model, or both. It is the completeness, soundness, and zero-knowledge of the first article, made non-interactive by Fiat-Shamir, delivered succinctly by a SNARK or transparently by a STARK, and pointed at a neural network. This article explains what zkML proves, the committed-input structure that makes the guarantee meaningful, the honest cost of producing such proofs, and why this primitive matters for trustworthy AI agents.

What zkML proves

At its core zkML proves a statement of the form: the output y is the result of running model M on input x. What makes it powerful is which of x and M can be kept secret, giving three guarantee modes. In the input-private mode, the model is public and the input is hidden — a user proves they ran the public model on their private prompt and got y, revealing nothing about the prompt. In the model-private mode, the input is public and the model is hidden — a provider proves that its committed proprietary model produced y on a given input, without revealing the weights. In the fully private mode, both are hidden.

Each mode maps onto the zero-knowledge definition directly. The public statement is the claimed output and the commitments; the secret witness is whatever is hidden — the input, the weights, or both; completeness lets an honest prover convince; soundness stops a prover from claiming an output the model did not produce; and zero-knowledge protects the hidden data. The proof is produced with the machinery of the previous articles: the inference is arithmetized into a circuit, and a SNARK or STARK proves the circuit was satisfied by a valid witness.

The result is a portable, publicly checkable claim about an inference. Anyone who receives the proof and the commitments can verify — cheaply, thanks to succinctness — that the stated output really is what the stated model computes on some committed input, without learning the protected parts and without rerunning the model. That single capability underlies every zkML application, from private inference to verifiable model serving to auditable agent decisions.

A model and input are arithmetized into a circuit, a proof is generated, and any verifier checks it against the commitments.

\[\text{Statement: } y = M(x), \qquad \text{commitments } c_x = \mathsf{Commit}(x),\; c_M = \mathsf{Commit}(M)\]

\[\text{Prover knows } (x, M) \text{ opening } (c_x, c_M) \text{ such that } M(x) = y\]

The committed-input guarantee

The force of a zkML proof comes from binding it to commitments. Before proving, the prover commits to the hidden input and/or the hidden weights — publishing a binding, hiding commitment as in the second article — and the proof is about those specific committed values. Because the commitment is binding, the prover cannot later substitute a different input or a different, cheaper model; the proof only verifies for the exact values that were committed. Because it is hiding, the commitment reveals nothing about them.

This is what stops the obvious cheats. Without a commitment to the weights, a provider could prove it ran some model producing y while secretly having used a smaller, cheaper, or different model — the proof would be meaningless. Committing to the weights ties the claim to a specific model, so a later audit can check that the committed model is the one that was supposed to be served. Committing to the input ties the claim to specific data, so a prover cannot prove a favorable output by quietly changing the input it used.

The commitment also enables accountability over time. A model provider can publish a commitment to its weights once, and thereafter every inference proof references that commitment, so all outputs are provably from the same disclosed-by-commitment model. A user can commit to an input and later prove properties of the inference on it. The committed-input structure is thus not a technicality but the mechanism that turns a bare proof of some computation into a meaningful, auditable claim about this model on this input.

Committing the input, the model, or both yields input-private, model-private, or fully private verifiable inference.

The honest cost

zkML is expensive, and it is important to be honest about it. Producing a proof of an inference means representing the entire forward pass as an arithmetic circuit and running a prover over it, which costs orders of magnitude more time and memory than simply performing the inference. The prover's work and memory footprint scale with the size of the network, so the resource demands of proving a model dwarf those of running it. Verification, by contrast, stays cheap — that asymmetry is the point of using a succinct proof — but the prover pays heavily.

The hardest part is precisely the non-linearities, the same obstacle that homomorphic encryption faced. Matrix multiplications arithmetize into constraints straightforwardly, but activations and comparisons — ReLU, softmax, argmax — are awkward to express in a constraint system and inflate the circuit, so they dominate the proving cost. Techniques mirror the FHE story: low-degree polynomial approximations, lookup arguments that evaluate a function via a committed table, and quantization to smaller fields. Each reduces cost while introducing approximation or engineering complexity, and getting non-linearities cheap is the active research problem.

The practical frontier follows directly. Small and medium models — classifiers, modest convolutional and fully connected networks, small transformers — can be proven today with real but manageable prover cost, and there are deployed zkML systems for such models. Large language models remain the research frontier: the circuit for a full LLM forward pass is enormous, and proving it at acceptable time and memory is not yet routine, though rapid progress in provers, hardware, and non-linearity handling is steadily pushing the boundary outward, exactly as it is for homomorphic inference.

The honest cost profile of proving an inference.
Aspect	zkML reality
Prover time	orders of magnitude over plain inference
Prover memory	scales with the whole circuit
Proof size / verification	succinct and cheap (the payoff)
Non-linearities	dominant cost; approximated or via lookups
Feasibility today	small/medium models yes; large LLMs frontier

Agent trust, and why this matters

The application that makes zkML strategically important is agent trust. As autonomous AI agents take consequential actions, the parties affected need assurance that an agent's decision was actually produced by the model and process it claims, not fabricated or produced by a different, cheaper, or tampered model. A zkML proof provides exactly that: an agent can accompany a decision with a proof that the committed model produced it on the given input, turning trust me into a checkable guarantee. This is a direct, cryptographic answer to the question of whether an agent did what it says it did.

The guarantee needs no trusted hardware and no live prover, which distinguishes it from the confidential-computing approaches of the homomorphic-encryption series. Where a trusted execution environment asks you to trust silicon and a live enclave, a zkML proof is a self-contained object anyone can check later against a public commitment, with soundness resting only on cryptography. Combined with a transparent, post-quantum STARK, such a proof is publicly verifiable, needs no ceremony, and does not expire when quantum computers arrive — the properties a long-lived, open agent ecosystem requires.

This is where the whole series lands. The completeness, soundness, and simulator-defined zero-knowledge of the first article; the Fiat-Shamir non-interactivity of the second; the succinctness of SNARKs and the transparency and post-quantum durability of STARKs — all of it exists, for the purposes of this track, to make a model's behavior provable to anyone without revealing its secrets. zkML is the direct agent-trust primitive: it lets an AI system prove it ran the right model on the right input and produced the claimed output, publicly and durably. The cost is real and the largest models are still ahead of what is practical, but the trajectory is clear, and the capability — verifiable, privacy-preserving proof of an inference — is foundational to an AI ecosystem in which agents must be trusted by parties that cannot see inside them.

✅

A checkable claim about an inference. zkML proves that a committed model produced a specific output on a committed input, hiding the input, the weights, or both. It needs no trusted hardware and, with a STARK, no trusted setup and no quantum expiry. Small models are provable today; large LLMs are the frontier; the agent-trust payoff is the point.

Key takeaways

zkML proves the statement that output y is the result of running model M on input x, in input-private, model-private, or fully private modes.
It instantiates the zero-knowledge definition: the commitments and output are public, the hidden input/weights are the witness, soundness stops false output claims.
Binding commitments to the input and/or weights give the guarantee force — a prover cannot swap in a different input or a cheaper model after committing.
Producing the proof is orders of magnitude costlier than the inference, dominated by prover time and memory, and hardest at the non-linearities.
Small and medium models are provable today; large language models remain the research frontier as provers, hardware, and non-linearity handling improve.
zkML is a direct agent-trust primitive: with no trusted hardware and, via STARKs, no setup or quantum expiry, an agent can prove it ran the promised model.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

✅Designing a zkML proofchecklist

Questions that shape a verifiable-inference deployment.

Which must be hidden — the input, the model weights, or both?
Are the input and/or weights committed so the claim is binding?
How are the non-linearities arithmetized (approximation or lookups)?
Is the prover cost acceptable for the model size, or is the model too large today?
Does the use case need a transparent, post-quantum proof (STARK) for durability?

🚀The zkML mental modelquickstart

Three facts to hold onto.

It proves y = M(x) while hiding the committed parts.
Proving is far costlier than inference; verification is cheap.
Small models work now; large LLMs are the frontier; agent trust is the goal.

🔒Verifiable-inference stancepolicy

A stub recording the zkML requirements.

zkml_inference:
  statement: y_equals_M_of_x
  commitments: [input, weights]
  guarantee_mode: [input_private, model_private, both]
  cost:
    prover: heavy
    verifier: succinct
    hard_part: non_linearities
  durability:
    proof_system: stark   # transparent, post-quantum
  purpose: agent_decision_provenance

Illustrative documentation template, not a product config.

Glossary

zkML: Zero-knowledge machine learning: using a succinct proof to prove a model produced a specific output on a committed input, hiding the input, weights, or both.
Guarantee mode: Which parts are hidden: input-private (public model, private input), model-private (public input, private weights), or fully private.
Committed input/model: A binding, hiding commitment to the input or weights that the proof references, so they cannot be swapped after the fact.
Arithmetization of inference: Expressing a model's forward pass as an arithmetic circuit or constraint system that a proof system can attest to.
Lookup argument: A technique to evaluate an awkward function (e.g., a non-linearity) via a committed table, reducing constraint cost in zkML.
Agent-trust primitive: A mechanism letting an autonomous agent prove its decision was produced by the claimed model and process, without revealing secrets.