infrastructure spotlight

ERC-7992 Turns zkML Into a Swappable ABI Primitive; Selective Verification Caps Cost

A registry mapping modelId to ModelCommitment and proofSystemId lets contracts verify inference without a custom ABI. Expect full proofs for up to 50M parameters; larger models get commitments and dispute backstops.

In the beginning, smart contracts did not reason; they queried. If you have ever stared into a 19th-century shipping ledger, you know the difference: either you believe the bookkeeper or you re-audit the cargo. zkML has now stopped being a benchmark artifact and become an ABI-level primitive, and the audit trail is being carved into the protocol itself. ERC-7992 specifies a registry linking a modelId to a ModelCommitment — hashes of the model’s weights and architecture, proving circuit/AIR, verifying key — plus a proofSystemId and a verifyInference(modelId, inputCommitment, output, proof) function. The function dispatches to the declared proof system (Groth16, Plonk, or STARKs) and reverts on any mismatch, emitting an InferenceVerified event [^claim_1288]. That is the switch from trust to proof: standard on-chain AI trusts the server running the model; zkML generates a cryptographic proof that a specific committed model consumed specific inputs and produced a specific output, verifiable on-chain without rerunning, with optional weights and input hiding [^claim_1301]. A DeFi contract can now consume ML output without knowing which prover produced it — a purely collateralized handshake.

But every cryptographic comfort has a cost envelope, and this one still bites. Ancilar’s 2026 measurements put zkML proving between 0.1 seconds and well over one minute per inference; EZKL logs sub-second proofs for linear regression, SVM, and tree ensembles, while random forest creeps past six seconds and larger neural networks blow past one minute on standard hardware [^claim_1290]. Modulus Labs priced the smallest practical on-chain verification at roughly 300,000 gas — about $20 per verification at tested gas prices [^claim_1290]. The deployable pattern is selective verification, an options market between paying for proof and paying for trust: models in the 1M–50M-parameter range get full proofs per inference, while larger models run off-chain with only an on-chain commitment to outputs, and disputes are settled by re-execution or a proof over a distilled surrogate model or training provenance [^claim_1295].

The tooling already fits that split. zkML compiles quantized models — float32 down to int8 or int16 — into arithmetic circuits: linear layers become matrix multiplication circuits, ReLU comparisons, softmax lookup tables. The witnesses then feed Halo2, Plonky3, or SP1, and the smart contract verifies in O(1) time regardless of model size [^claim_1294]. EZKL 1.0 accepts ONNX models up to roughly 50 million parameters and proves an MNIST-sized inference in under one second with fewer than 180 megabytes of memory, verifiable on EVM, CLI, or browser WASM [^claim_1289]. That places the full-proof band squarely between 1M and 50M. zkPyTorch proves VGG-16 in 2.2 seconds; 2026’s multi-folding splits circuits across clusters, aggregates sub-proofs, and pushes LLM inference from a single large prover to distributed provers [^claim_1293].

Infrastructure is now scaling into a verifiable coprocessor layer, with enough liquidity to make proof production look like a high-frequency desk. Inference Labs’ Verified Inference Network runs AI models as zero-knowledge circuits off-chain, hides weights and inputs, and had processed over 281 million zkML proofs by August 2025 [^claim_1292]. Its testnet added over 160 million proofs since early 2026 after Subnet-2 passed 300 million by late 2025; DSperse reports 65% faster proof generation and sub-1GB prover memory [^claim_1291]. EZKL, Giza, and Ritual map to five production patterns: verifiable AI inference for high-value DeFi contracts, trust-minimized AI for regulated workflows, on-chain agent coordination, model/data provenance with on-chain attestation, and hybrid on/off-chain inference with an on-chain verification layer [^claim_1296]. ORA’s opML runs an optimistic dispute game and opAgent supports perpetual on-chain agents; Allora pays workers, reputers, and validators for on-chain inferences; Ritual Infernet connects on-chain apps and agents to off-chain models with metered payments [^claim_1297].

The agent layer is the canary in this coal mine, and the canary looks sick. ElizaOS provides an open-source AI agent framework with a data layer, LLM integration, extensible agent logic, and plugins for Solana and other chains, letting LLM-driven agents submit transactions through pre-built protocol adapters [^claim_1300]. The IACR attack on ElizaOS shows prompt and history injection can manipulate context into unintended asset transfers and protocol violations [^claim_1298]. Bedrock’s supervisor-collaborator reference architecture delegates blockchain tasks through AWS Web3 infrastructure rather than a user wallet, but it still composes LLM-generated actions [^claim_1299]. zkML proves a model ran correctly; it does not prove the agent’s intent. Expect constrained transaction templates, optimistic guards, or zk/optimistic policy proofs to arrive before LLM agents manage serious on-chain value — because otherwise the volatility will be someone else’s alpha.

Provenance ledger

11 span-verified · 3 web-cited

11 claims below are locked to a verbatim span re-verified against the source. The remaining 3 are web citations: the URL was checked, but the excerpt is the researcher's summary and was not re-derived from the page. Citation markers in the text jump here.

[1] ERC‑7992 standardizes verifiable ML inference on Ethereum by defining a registry that maps a modelId to a ModelCommitment (hashes of the model’s weights/architecture, proving circuit/AIR, and verifying key) plus a proofSystemId, and a verifier interface verifyInference(modelId, inputCommitment, output, proof) that dispatches to the declared proof system (e.g., Groth16, Plonk, STARKs) and reverts on any mismatch, with successful verification emitting an InferenceVerified event. span-verified
Verbatim source span
“This ERC standardizes how smart contracts reference machine-learning (ML) models and accept zero-knowledge attestations of their inferences… It defines a registry that issues a `modelId` for a `ModelCommitment`, hashes of the model’s weights/architecture, proving circuit/AIR, and verifying key, along with a `proofSystemId` for the proving system… A verifier interface provides `verifyInference(modelId, inputCommitment, output, proof)`: it retrieves the model commitment, dispatches verification t
SHA-256 of span
743cc3ee2b208211c9da2ad04e353d8325297f0fce46b9fc3df0ab7c423264ab
↩ back to text
[2] EZKL 1.0 supports ONNX models up to roughly 50 million parameters and can prove an MNIST‑sized image classification inference in under 1 second using less than 180 megabytes of memory, with resulting proofs verifiable on the Ethereum Virtual Machine, from the command line, or in a browser via WebAssembly. span-verified
Verbatim source span
“EZKL, built by Jason Morton’s team at Zkonduit, reached a 1.0 release supporting ONNX models up to roughly 50 million parameters, and can prove an MNIST-sized image classification inference in under a second using less than 180 megabytes of memory, verifiable on the Ethereum Virtual Machine, from the command line, or in a browser via WebAssembly.”[12]
SHA-256 of span
760fcb0d87696f3a5632246cab5922a6551a980122bbbc23d1bd2e89399c8027
↩ back to text
[3] Ancilar reports that in 2026 zkML proving adds between 0.1 seconds and well over 1 minute of latency per inference, and that EZKL benchmarks show sub‑second proving for linear regression, SVM, and tree ensemble models, while random forest classification takes over 6 seconds and larger neural networks push past 1 minute on standard hardware; on-chain verification benchmarks by Modulus Labs measured the smallest practical zkML proof verification at roughly 300,000 gas per transaction, priced at about 20 dollars per verification at the tested gas prices. span-verified
Verbatim source span
“zkML proving adds 0.1s to well over a minute of latency and real gas cost per verification in 2026… EZKL benchmarks show sub-second proving for linear regression, SVM, and tree ensemble models, but random forest classification takes over six seconds and larger neural networks push past a minute on standard hardware… Modulus Labs benchmarked the smallest practical on-chain proof verification at roughly 300,000 gas per transaction, which priced out to about 20 dollars per verification at the gas
SHA-256 of span
d4fe25d863b99fc1cc7c79987ed036a1118a0b948a592c69cf68493e7cc2af45
↩ back to text
[4] Inference Labs’ decentralized inference subnet has generated over 160 million zkML proofs on testnet since early 2026, after previously surpassing 300 million zk proofs on Subnet‑2 by late 2025, and its DSperse verification system is reported to boost proof generation speed by 65% while reducing prover memory usage to under 1 GB for scalable zkML workloads. web-cited
Excerpt reported by researcher (not re-verified)
“Their Subnet-2 already smashed 300 million zk proofs by late 2025, and now with 160 million more on testnet in 2026, they're scaling like wildfire… Early 2026 Proof of Inference protocol went live on testnet… generating over 160 million zk proofs by February 2026… Introduced DSperse verification system, boosting proof generation speed by 65% while reducing memory usage to under 1GB for scalable zkML.”[4]

This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.

↩ back to text
[5] The Verified Inference Network by Inference Labs runs AI models as zero‑knowledge circuits off‑chain and has processed over 281 million zkML proofs by August 2025, while keeping model weights and inputs hidden; cryptographic proofs of execution are posted on-chain so AI predictions become on-chain‑settleable artifacts for decentralized inference markets. span-verified
Verbatim source span
“Inference Labs converts them into zero-knowledge circuits, proving execution traces off-chain while attesting results on-chain… This software-centric method… deploys AI systems on Web3 infrastructure without revealing weights or inputs… Live on testnet, with mainnet eyed for late Q3, it has already processed over 281 million zkML proofs by August 2025 - a testament to production readiness.”[7]
SHA-256 of span
f5f3e20f42b524c5714791d6056db86cf3b3d6ed18835da0f2526552cbd89d3e
↩ back to text
[6] zkPyTorch, released in March 2025, can prove VGG‑16 inference in 2.2 seconds, and zkML frameworks are adopting multi‑folding in 2026 to split circuits and parallelize proof generation across clusters, enabling larger models (including LLMs) to be proven by aggregating sub‑proofs rather than relying on a single large prover. span-verified
Verbatim source span
“zkPyTorch dropped in March 2025 and suddenly you can prove VGG-16 inference in 2.2 seconds… 2026 zkML: proof generation gets parallelized across a cluster. Split the circuit, distribute to multiple provers (multi-folding), aggregate the results… This is research-stage now but will ship in 2026. When it does: LLM inference in zkML goes from 'prove on big machine' to 'prove anywhere'.”[6]
SHA-256 of span
c9148d6ef56475de19cacfa325a21085974cb3a606df5adc02571d85a950387b
↩ back to text
[7] On Ethereum, zkML systems follow a pipeline of model quantization (e.g., float32 to int8 or int16), circuit compilation that maps linear layers to matrix multiplication circuits, ReLU activations to comparison circuits, and softmax to lookup table circuits, followed by witness generation and proof generation using systems like Halo2, Plonky3, or SP1; the resulting proof is then verified by a smart contract in O(1) time regardless of model size. span-verified
Verbatim source span
“zkML systems convert neural network inference into an arithmetic circuit, then generate a ZK proof of correct execution: 1. Model quantization: Convert floating-point weights to fixed-point (e.g., float32 → int8 or int16) 2. Circuit compilation: Translate each neural network layer into arithmetic constraints: - Linear layers → matrix multiplication circuits - ReLU activations → comparison circuits - Softmax → lookup table circuits 3. Witness generation… 4. Proof generation: Use a proving system
SHA-256 of span
10f4af30aa1e2360ffcb234bafb434c0fa5a662a87efa9d1f90ff19ebdf6bd2a
↩ back to text
[8] The 2026 zkML production pattern is selective verification: models in the 1M–50M parameter range are proven per inference with full zk proofs, while larger models run off‑chain with only an on-chain commitment to their outputs, and disputes are resolved either by re‑execution or by generating a proof over a distilled surrogate model or proof of training provenance. span-verified
Verbatim source span
“The pragmatic takeaway: models up to a few tens of millions of parameters are provable today at costs measured in seconds-to-minutes of prover time per inference… The deployable pattern in 2026 is selective verification: - Small model, full proof. Risk models and filters in the 1M–50M parameter range, proven per-inference… - Big model, committed output. The heavyweight model runs off-chain; only a commitment lands on-chain, with disputes escalated to re-execution or a proof over a distilled sur
SHA-256 of span
20bcee3e10f47b7218914bc313e4dc7fd37255a2a581c7dcbf33657f61075621
↩ back to text
[9] EZKL, Giza, and Ritual are identified as the primary on-chain inference toolchains in 2026, with EZKL converting ONNX models to arithmetic circuits and generating zk‑SNARK proofs verifiable on-chain, and these toolchains are used to implement five specific patterns: verifiable AI inference for high‑value DeFi contracts, trust‑minimized AI for regulated workflows, on‑chain agent coordination, AI model/data provenance with on-chain attestation, and hybrid on‑chain + off‑chain inference with an on-chain verification layer. span-verified
Verbatim source span
“Zero-knowledge machine learning (ZKML) lets you prove that a specific model, given a specific input, produced a specific output — without revealing the model weights or, optionally, the input itself. EZKL, Giza, and Ritual are the serious players in 2026. EZKL converts an ONNX model into an arithmetic circuit, generates a zk-SNARK proof, and lets you verify that proof on-chain… What are the 5 patterns where on-chain inference is useful in 2026? - Verifiable AI inference for high-value contracts
SHA-256 of span
20c1195ac687d398fbda01f6b4111aab0229c1a54488600fec36742339b16da2
↩ back to text
[10] The ORA opML system implements optimistic machine learning for verifiable inference via an on-chain dispute game, and its opAgent framework supports on‑chain, perpetual AI agents; Allora Network defines three on-chain roles—Workers, Reputers, and Validators—for a self‑improving decentralized ML network where inferences are paid out on-chain, and Ritual Infernet provides a decentralized inference network and RPC layer that connects on-chain apps and agents to off‑chain AI models with usage‑metered payments. span-verified
Verbatim source span
“Ritual - Infernet - Decentralized inference network & RPC for AI to connect on-chain apps/agents to off-chain models with payments & metering. - Allora Network - Self-improving, decentralized ML network with roles (Workers/Reputers/Validators) and paid inferences; powering agent use cases like predictions and trading. - ORA - Onchain AI Oracle & opAgent - opML (optimistic ML) dispute game for verifiable inference; opAgent for on-chain, perpetual agents. - Modulus Labs (zkML) - zk-verified ML ou
SHA-256 of span
cfd5e54ac415c61adb1a067bf6d3757c9e6f3eae4e5f2e6a75247245925ec877
↩ back to text
[11] ElizaOS, a decentralized AI agent framework for automated Web3 operations, is empirically shown to be vulnerable to prompt and history injection attacks where adversaries manipulate context with malicious instructions, leading to unintended asset transfers and protocol violations in on-chain executions. span-verified
Verbatim source span
“Through empirical analysis of ElizaOS, a decentralized AI agent framework for automated Web3 operations, we demonstrate how adversaries can manipulate context by injecting malicious instructions into prompts or historical interaction records, leading to unintended asset transfers and protocol violations which could be financially devastating.”[11]
SHA-256 of span
118225ec78e59e1da4ec28702fb279618ed500ca0d27d3423fcd027d1513ec28
↩ back to text
[12] Amazon’s Bedrock Web3 reference architecture for crypto AI agents uses a supervisor–collaborator pattern where a supervisor agent orchestrates task decomposition and collaborates with specialized agents that use LLMs to perform blockchain-related tasks (such as transaction construction or protocol interactions), exposing these capabilities via AWS Web3 infrastructure rather than directly from a user’s wallet. span-verified
Verbatim source span
“These agents use large language models (LLMs) for their intelligence to accomplish a variety of blockchain-related tasks through a supervisor-collaborator architecture.”[15]
SHA-256 of span
5a67d159511b750d7e7cc702dde15eb1620a1bd7145ff865c67e7d26a6d3f887
↩ back to text
[13] ElizaOS provides an open‑source AI agent framework with a data layer, LLM integration, and an extensible agent logic layer, and includes plugins that allow agents to interact directly with Solana and other chains so that LLM‑driven agents can submit on‑chain transactions through pre‑built protocol adapters. web-cited
Excerpt reported by researcher (not re-verified)
“ElizaOS (now open-source) provides the core ‘brain’ and architecture for AI agents — combining a data layer, LLM integration, and an extensible agent logic — with plugins for Solana and other platforms.”[9]

This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.

↩ back to text
[14] Standard on-chain AI inference trusts the server running the model, whereas zkML architectures replace this trust by generating a cryptographic proof that a specific committed model ran on specific inputs and produced a specific output, which can be verified on-chain without rerunning the computation and, depending on circuit design, without revealing model weights or raw inputs. web-cited
Excerpt reported by researcher (not re-verified)
“Standard on-chain AI inference trusts the server running the model. zkML produces a cryptographic proof that a specific model ran on specific inputs and produced a specific output, verifiable on-chain without rerunning the computation… Zero-knowledge machine learning proves an AI model ran honestly, without redoing the work or exposing its weights.”[1][12]

This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.

↩ back to text

Sources

  1. https://eips.ethereum.org/EIPS/eip-7992
  2. https://hoge.gg/zkml-explained-zero-knowledge-proofs-verify-ai/
  3. https://www.ancilar.com/knowledge-hub/blogs/verifiable-ai-in-production-zkml-latency-and-cost-at-scale
  4. https://decentralizedinference.org/2026/02/22/inference-labs-zkml-proofs-for-verifiable-decentralized-ai-inference-in-defi
  5. https://decentralizedinference.org/2026/02/11/inference-labs-zkml-proofs-for-verifiable-decentralized-ai-inference-markets
  6. https://blog.icme.io/the-definitive-guide-to-zkml-2025/
  7. https://opensoft.asia/blog/zk-proofs-beyond-rollups-verifiable-ai-inference-ethereum
  8. https://www.blokz.dev/articles/zkml-verifiable-inference-landscape
  9. https://www.agilesoftlabs.com/blog/2026/05/ai-blockchain-in-2026-5-onchain
  10. https://github.com/michaltakac/awesome-crypto-ai-agents
  11. https://eprint.iacr.org/2025/526
  12. https://aws.amazon.com/blogs/web3/build-crypto-ai-agents-on-amazon-bedrock/
  13. https://medium.com/@grigon/ai-agents-and-the-future-of-crypto-how-intelligent-systems-are-shaping-blockchain-in-2025-9dae972f7039
  14. https://www.ancilar.com/knowledge-hub/blogs/verifiable-ai-inference-how-zkml-enables-trust-minimised-on-chain-model-execution
zkmlerc-7992verifiable-aiai-agentsdefiinference-labsezklelizaosalloraritual
AUTOMATED

Get the synthesis

AI×crypto research, repackaged with every claim hash-locked to its source. New arXiv → analysis in ~3 hours.