The Definitive Guide to ZKML (2026).

Another year and amazing things have happened in the world of zero-knowledge machine learning. Check out our 2025 guide as a historic reference. Is ZKML mainstream?

Close to home, Jolt Atlas went academic early this year, and others started building on it. One paper benchmarked lookup costs on Jolt Atlas and upstreamed a prover speedup. Another cited it as the foundation for regulatory zkML in fair lending. Jolt itself entered the lattice era: a16z and LayerZero’s Lattice Jolt, built on the Akita commitment scheme, is post-quantum, 2–3x faster than the elliptic-curve version it replaces, and produces proofs under 100 KB. Post-quantum no longer costs speed. Out joint work with AWS (zkARc) showed how variants of ZKML can be used for zero trust agentic guardrails.

Meanwhile, in the broader ZKML ecosystem, things got exciting! Anthropic joined the race by open-sourcing FlashProve, a research prototype. It proves Meta’s 400B-parameter Llama 4 Maverick at about 110 tokens per second on a single H100, with 19 MB proofs that verify in about 17 seconds on a CPU. Proving still costs roughly 70–95x the GPU time of normal inference. Attestable reports similar speeds on a dense model: Gemma 4 31B at 53–77 tokens per second on one H100, with 4–8 MB proofs that verify in under a second. Last year, zkPyTorch needed 150 seconds per token for Llama-3 8B on a single CPU core. The hardware differs, but that’s a leap of several orders of magnitude in a year. Attestable also closed a $20 million seed round, one of the largest raises yet for a company focused purely on ZKML. So, did ZKML go mainstream? Let’s look at the progress achieved this year. 👇

How Did Our Predictions Hold Up From Last Year?

Last year we made some educated guesses about the next 10x unlocks. Here’s how they landed.

Hardware Wave

GPU acceleration, predicted 5–10x: 🚀 Beat. We expected models that took 30 seconds to drop to 3–5 seconds. Instead, FlashProve proves a 400B mixture-of-experts model at about 110 tokens per second on one H100. It fits on a single 80 GB GPU by streaming weights from host memory. Attestable hits 53–77 tokens per second on Gemma 4 31B, also on one H100.

Multi-machine proving: ✅ Hit. DeepProve proves Gemma 3 at about 86 tokens per minute on one machine and scales to 1,855 tokens per minute with distributed proving.

“Llama goes from curiosity to usable”: 🚀 Beat. We were talking about Llama-3 8B. This year someone proved Llama 4 Maverick, at 400B parameters.

Proof Systems: Better Math

Smaller fields and lattices: ✅ Hit. Lattice Jolt shipped in September. It is post-quantum, 2–3x faster than the curve-based version, and its proofs are under 100 KB.

Folding becomes standard everywhere: 🟡 Partial. Folding powers zero knowledge in Jolt Atlas via BlindFold. But the two headline LLM provers went hash-based instead. Both are post-quantum, and Attestable says its verification cost doesn’t grow with model size or context length.

Streaming proofs ship: ✅ Hit. Jolt Atlas proves inference in memory-constrained environments. On-device proving is real.

Operator Coverage Explosion

Transformer primitives get optimized: ✅ Hit.

• DeepProve added grouped-query attention, RMSNorm and rotary embeddings to prove Gemma 3.
• FlashProve handles mixture-of-experts routing and hides which experts were activated.
• Attestable proves non-linear operations in floating point, which we called “theoretically possible” last year.

Still missing: long contexts. FlashProve caps at 1,024 tokens and Attestable at 16K. Both still quantize matrix multiplications to integers.

Cost Curve Shifts Lead To Use Case Evolution

DeFi agents go real-time: ❌ Not yet. The proving speed is there now, but we haven’t seen reactive, proof-per-trade agents in production.

Healthcare real-time verification: ❌ Not yet. Regulation moved faster than deployments. The EU AI Act’s high-risk obligations took effect in August.

Trustless agents go to production: 🟡 Partial. ERC-8004 went live on mainnet in January and x402 payments took off. Most agent-side proofs today are policy proofs, such as spend limits and roles, or TEE attestations rather than zkML. Our guardrail work with AWS is a step toward closing that gap.

Gaming: 🟡 Partial. Lagrange’s Turing Roulette asked 144,309 players whether they were talking to a human or an AI, and proved more than 3.7M inferences along the way.

Model marketplaces, with proofs standard above $0.01 per call: ❌ Miss, but the closest call. Proving that you got the model you paid for is exactly the problem FlashProve was built for. No major provider ships proofs to customers yet.

Most new adoption has nothing to do with crypto.

Last year, crypto was clearly leading the charge. Coinbase launched x402 in May 2025, reviving the long-dormant HTTP 402 “Payment Required” code so AI agents could pay for APIs in stablecoins. Circle announced Arc in August 2025, a Layer-1 with USDC as its native gas token, and CEO Jeremy Allaire pitched it as core infrastructure for an agentic economy. ERC-8004 was proposed the same month, with zkML proofs written into its Validation Registry. By December, x402 had processed 75 million transactions. The story was simple: agents move money, money needs proofs, and crypto would pull ZKML into the mainstream.

The rails did arrive. Stripe integrated x402 in February, Arc launched mainnet in May after a $222M token presale, and Amazon added x402 to Bedrock AgentCore. But look at what agents actually prove today. Most of it is spend limits and role membership in small Circom circuits, and LLM calls are verified with TEE attestations, not zkML. Crypto built the payment layer, but it didn’t become ZKML’s biggest buyer.

AI security did. Fun fact: Anthropic was a launch partner for x402 in 2025. In 2026 it shipped FlashProve instead, as part of its Frontier Safety Roadmap commitment to verify which model produced an output. The threat model is not a rogue trading bot. It is stolen weights, swapped models and tampered serving infrastructure. In July, more than 1,300 frontier-lab employees signed Pacing the Frontier, asking the US government to support tools for deliberately pacing AI development. Attestable answered directly: proofs can show an approved, unchanged model served the traffic, and work accounting can bound what else the hardware might be doing.

Follow the money and the founders. Attestable’s $20M seed was led by Altimeter and TLV Partners, not crypto funds, and its founders came from RAND and StarkWare. Even Lagrange, a crypto-native team, now sells DeepProve into Anduril and Raytheon. Add the EU AI Act’s high-risk obligations, which took effect in August, and papers on ZK verification of frontier training. In 2026, the people asking “can you prove it?” are safety teams, defense primes and regulators. ZKML found a new customer: AI safety.

Predictions for ZKML in 2027

Here are our educated guesses for the next 10x unlocks. Last year we underestimated the hardware and overestimated how fast the apps would follow, so take these with appropriate skepticism. 😉

The first big shift will be overhead. Proving a frontier model today costs roughly 70–95x the GPU time of serving it. That’s incredible for a first release, but it still means running a second fleet beside the one you serve with. We expect the best systems to get within 10–20x of native inference for open-weight LLMs in 2027. The levers are GPU-native commitments, batching across requests, and reusing one weight commitment across millions of calls. At that point, proving every response for a mid-sized API stops being a research expense and becomes something any high value system just does.

Context length and decoding are the biggest remaining gaps. Current provers top out between 1K and 16K tokens, and some only support greedy decoding, while production models run at 128K and beyond and they sample. We expect 128K-token proofs, and proofs that cover sampled decoding from a committed random seed. That is a lot of engineering. Verification should stay sublinear in context length.

Floating point

Floating point will go all the way down. Every serious LLM prover in 2026 still quantizes matrix multiplications to integers, even where the non-linear operations are proven in floating point. Attestable proves almost every operation in floating point, but dynamically quantizes the linear layers to 8-bit integers. On Gemma 4 31B that held up on hard reasoning (GPQA Diamond) better than a standard INT8 baseline, but it still lost ground on instruction-following (IFEval). FlashProve proves an integer version of Llama 4 Maverick built from its public 4-bit weights. Anthropic itself notes that outputs produced with floating-point arithmetic may diverge from what can be proven. Last year’s systems had the same caveat in a different form: zkPyTorch, for example, reported 99.32% cosine similarity to the original Llama-3 outputs, close but not identical.

The gap is now a research topic of its own. A recent study on ZK-friendly quantization argues there is still no formal definition of what quantization is safe to prove. Its authors call for operator-aware precision rather than squeezing everything to the smallest bit-width. At the other end, proposals for verifying frontier training are designing around native BF16/FP32 precompiles that check the actual floating-point computation the GPU performed, not a fixed-point approximation. Lookup-centric provers like Jolt Atlas are well placed here too, because they don’t need to materialize full lookup tables, so they aren’t locked into a single quantization scheme.

We expect at least one system to prove an LLM end to end in the format it was trained in, matmuls included. When that happens, “the proven model is a slightly different model” will stop being a footnote. It will also close the last easy objection from skeptics: that a proof only shows a cheaper approximation ran, not the model you paid for.

Lattice meet hash

Lattices will be everywhere. Lattice Jolt showed that post-quantum can be faster, and the key unlock is Akita, a new lattice-based polynomial commitment scheme from LayerZero Labs, a16z crypto research (Justin Thaler again, #tendsToBeRight), CMU, USC and Georgetown. Akita rests on the standard Module-SIS assumption, the same family behind NIST’s post-quantum signature and key-exchange standards. Its proofs are only 61–70 KB, matching Greyhound at the same security level while verifying 10x to 94x faster. Its prover memory grows sublinearly beyond storing the polynomial itself. Integrated into Jolt, it gives a 1.3x to 2.2x prover speedup and a 2.2x to 7.4x verifier speedup across every program size tested.

The property that matters most for ZKML is sparsity. Akita’s commitment time scales with the number of nonzero entries in a polynomial, not its length. Hash-based schemes, today’s post-quantum default, can’t do that. It is exactly what the one-hot polynomials in Twist and Shout need, and lookup-heavy ML workloads are full of them. Akita is part of a wider lattice wave this year, alongside Hachi, Grand Danois, Maltese and Jindo for client-side proving. Lattice operations also run natively on GPUs, without the data-shuffling overhead of elliptic-curve multi-scalar multiplication.

We expect new zkML systems to ship post-quantum by default, split between hash-based and lattice-based commitments, with elliptic-curve zkML becoming legacy. Expect lattice commitments to land in Jolt Atlas, along with zero-knowledge versions of the lattice provers. GPU proving will make the numbers competitive with the hash-based systems live today.

Formal methods & user expansion

Formal verification will become table stakes. This year brought both machine-checked security proofs for a major zkML system and critical soundness bugs across several zkVMs. A proof system you can’t trust is worse than no proof at all. Serious buyers, especially frontier labs and regulators, will start requiring machine-checked security statements. AI will also write a growing share of prover optimizations, which is exactly why those formal checks matter.

Not every token needs a proof, and deployments will start to reflect that. Small models like guardrails, classifiers and embedding models are cheap enough to prove on every call, even on-device. The big model gets proofs on demand or on a sample, triggered by an auditor, a customer or a dispute. We expect this hybrid of proving the small model and sampling the big one to become the default pattern, often running alongside TEEs and matrix-multiplication delegation rather than replacing them.

Finally, training and fine-tuning will get proofs. Inference proofs are maturing, and training is next. Verifiable fine-tuning already proves LoRA steps in under a minute, with sub-second final verification, and zkLoRA brought end-to-end zero-knowledge fine-tuning to NDSS this year. We expect fine-tuning proofs to become practical for regulated deployments in 2027. The first credible attestations about frontier pre-training compute should appear too, as prototypes, driven by the pacing and governance agenda.