Verifiable AI hits crypto infra: on-chain inference, TEE attestation, and agent messaging
Four distinct approaches—on-chain learning, ZKML, TEE-based attestation, and decentralized agent networking—are maturing into a stack that lets smart contracts trust AI outputs without trusting the model runner.
Crypto’s appetite for AI is shifting from hype to plumbing. The question is no longer whether AI belongs on-chain, but how to make it verifiable without breaking the gas bank or the trust model. Four recent projects—each tackling a different layer of the stack—show the contours of a coherent answer.
The most concrete on-chain learning framework to date trains models on an L2 to sidestep gas costs, propagates verified updates to L1, and exposes gas-bounded inference directly inside smart contracts [^claim_1003]. It doesn’t just theorize: the system curates 298 real-world exploits from 2020–2025 across 402 transactions on eight EVM chains, using them as supervised training data to predict vulnerable contracts [^claim_1013]. This is verifiable ML with a specific crypto use case—security—baked in from the start.
Parity Protocol takes a different trust path. Instead of cryptographic proofs, it runs containerized LLM tasks across several nodes, hashes each output, and cross-checks before accepting [^claim_1004]. The design is simple and practical: no client-side GPU, no cloud dependency, compatible with any containerized model. The same mechanism—per-node output hashing and cross-checking—makes it a natural decentralized AI oracle for smart contracts that need consensus on model outputs [^claim_1010].
For those who want stronger guarantees than consensus, ZKML is maturing fast. Zator proves correct inference of a 512-layer neural network via recursive SNARKs, enabling on-chain or off-chain verification without re-running the computation [^claim_1007]. The generic capability—proving that a specific model with claimed parameters was executed correctly on given inputs—is exactly what Equilibrium Labs calls out as the primary constraint: verification must be substantially cheaper than recomputation [^claim_1011]. Systems like XYZ go further, transpiling ONNX-format weights to Cairo for STARK proving on StarkNet, handling models with a few million parameters [^claim_1008]. Kudelski Security emphasizes that ZKML can also certify that models were trained correctly and generated with particular content, all without exposing inputs or model internals [^claim_1014].
But proofs alone don’t cover the supply chain. EQTY Lab’s Verifiable Compute uses a notary running in TEEs on both CPU and GPU to produce tamperproof X.509-signed attestations of AI workload lineage—which prompts, which embeddings, which training data, which benchmarks [^claim_1005]. This hardware-based trust lets users verify the exact payload sent to closed-source endpoints like ChatGPT or Claude, and attest which RAG embeddings were retrieved [^claim_1012]. For regulated DeFi or identity protocols, this bridges the gap between cryptographic correctness and auditability.
Finally, MOD-X addresses the networking layer. It proposes a many-to-many topic-based publish-subscribe backbone, an ontology-based semantic translation and cross-model embedding alignment layer, and blockchain-secured, reputation-scored agent identities with revocable state sharing [^claim_1009]. This is the infrastructure for agent DAOs and intent-based routers that need both composability and on-chain accountability.
The takeaway: verifiable inference is not a single technology. It’s a stack—L2 training + L1 settlement, multi-node consensus, recursive SNARKs, TEE attestation, and agent messaging—each solving a distinct trust problem. The pieces now exist. The next step is composability.
Provenance ledger
12 claims web-citedEvery claim below cites a source URL, and each URL was checked for validity before publish. The excerpt shown is the researcher's own summary of the page — it is not re-derived from the source, so it is not a verified verbatim quote. Follow the link to confirm any claim against the original. Citation markers in the text jump here.
[1] The "On-Chain Decentralized Learning and Cost-Effective Inference" framework performs gas-prohibitive model training on an L2, propagates verified model updates to L1, and exposes gas-bounded, low-latency inference directly inside smart contracts. web-cited
We present the first decentralized, fully on-chain learning framework that: (i) performs gas-prohibitive computation on Layer-2 to reduce cost, (ii) propagates verified model updates to Layer-1, and (iii) enables gas-bounded, low-latency inference inside smart contracts.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[2] Parity Protocol’s decentralized compute engine runs verifiable LLM inference by executing containerized tasks across several nodes, having each node generate an output plus hash, and cross-checking outputs before acceptance, with no need for client-side GPU or cloud access. web-cited
Tasks are processed within a Docker container across several nodes. Each node generates output along with a corresponding hash. Outputs are cross-checked and validated before being accepted. There’s no reliance on cloud services or GPU capabilities from the client side. It is compatible with any containerized LLM, including open-source models.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[3] EQTY Lab’s Verifiable Compute framework uses a notary running in trusted execution environments (TEEs) on both CPU and GPU to produce tamperproof X.509-signed attestations (e.g., RSA‑4096, EC368) of AI workload lineage, governance, and confidentiality, enabling runtime verification of which prompts, embeddings, training data, and benchmarks were actually used. web-cited
Hardware-based Assurance to Govern and Audit AI Workloads. Leverage a new hardware root of trust to produce tamperproof certificates of authenticity for any AI process. We’re introducing a new form of silicon-based trust for AI that allows users to verify at runtime the lineage and governance of any AI dataset, model, or agent… Using a notary run in a trusted execution environment (TEE) on both the CPU and GPU, users can verify that an AI compute session is confidential and meets required govern
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[4] Modern ZKML systems provide cryptographic proofs that a specific ML model with claimed parameters was executed correctly on given inputs, enabling verifiable inference, integrity of parameters, and correct execution of each layer while keeping inputs and model private. web-cited
zkML can be used to delegate the execution of machine learning models to service providers and obtain proofs that a particular trained model produces the correct output given some inputs (i.e. verifiable inference)… Correct Application: A specific model and set of parameters (e.g. weights of a neural network) were used to compute the output from given inputs. Integrity of Parameters: The parameters used are the ones claimed… Correct Execution: Each step in the computation (e.g. for each layer in
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] Zator demonstrates verified inference of a 512‑layer neural network via recursive SNARKs, showing that deep neural network inference can be proven and verified on-chain or off-chain without re-running the entire computation. web-cited
Zator - Verified inference of a 512-layer neural network using recursive SNARKs… Generic SNARK for ML inference: ability to easily prove and verify that an output is the product of a given model and input pair.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[6] XYZ’s on-chain AI inference system converts ONNX-format neural network weights into Cairo programs so that inference can be proven using STARKs on StarkNet, enabling smart contracts to consume AI outputs with zero‑knowledge proofs of correctness for models with a few million parameters. web-cited
XYZ uh is a company that uses starkware uh and Cairo to bring AI model inference on chain so that you could use them in smart contracts and the way that they do this they take this format called Onyx which is used to store neural network weights and basically transpiles them to Cairo so they could be proven with ZK and Starks uh on Stark net… the state-of-the-art is probably like a few millions of parameters that we can verify using zkl today.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] MOD‑X proposes a layered, decentralized communication framework for heterogeneous AI agents combining a many‑to‑many topic‑based publish–subscribe backbone, an ontology-based semantic translation and cross‑model embedding alignment layer, and blockchain‑secured, reputation‑scored agent identities with revocable contextual state sharing. web-cited
MOD-X introduces a novel, layered architecture for decentralized, interoperable communication among heterogeneous AI agents, integrating a semantic translation layer, decentralized messaging, state persistence, and blockchain-secured trust… (UMB): Proposes a many-to-many, topic-based publish-subscribe backbone enabling dynamic routing between domain-specific, cross-domain, and utility agents… Embedding Alignment: Introduces a runtime translation layer using ontology-based semantic mapping and cr
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[8] Parity Protocol’s verifiable LLM inference design uses per-node output hashing and cross-checking to detect and reject Byzantine nodes, making it suitable as a decentralized AI oracle for smart contracts that require consensus on model outputs. web-cited
Tasks are processed within a Docker container across several nodes. Each node generates output along with a corresponding hash. Outputs are cross-checked and validated before being accepted.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] Equilibrium Labs highlights that verifiable inference in blockchain contexts increases on-chain expressivity by letting smart contracts enforce AI agent behavior and delegate ML computations to off-chain provers, as long as proofs verify substantially cheaper than recomputation. web-cited
In a blockchain context, verifiable inference is mainly relevant to increasing the expressivity of onchain applications, enforcing onchain agents, and enabling… the primary constraint for both concepts is that the verification of the computation should require substantially less computational effort than performing the computation from scratch.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[10] EQTY Lab’s TEE-based Verifiable Compute can attest which RAG embeddings were retrieved, which data was used to fine-tune or train a model, and how it was benchmarked, providing an auditable AI supply chain for closed-source endpoints like ChatGPT or Claude. web-cited
Verifiable Compute ensures your entire AI supply chain is secure, safe, and auditable… From ChatGPT to Claude, verify the exact payload sent to closed source AI endpoints… Verify exactly which embeddings were retrieved from a RAG database and used in inference… Verify what data was used to fine tune an LLM, train a SLM, and prove it was accurately benchmarked.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[11] The on-chain decentralized learning framework curates 298 unique real-world exploits from 2020–2025 across 402 exploit transactions on eight EVM chains, using them as supervised training data for an on-chain model that predicts vulnerable smart contracts. web-cited
We curate 298 unique real-world exploits (2020 - 2025) with 402 exploit transactions across eight EVM chains, collectively responsible for $3…
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[12] Kudelski Security’s description of ZKML emphasizes that zero-knowledge proofs can verify that specific ML models were trained and executed correctly and can even certify that models were generated with particular content, without exposing either inputs or model internals. web-cited
For machine learning systems, ZKML creates powerful verification frameworks that ensure network nodes perform computations correctly without requiring complete visibility into the model’s internal mechanisms… A key capability of ZKML is to verify whether specific ML models are generated with particular content without exposing either the input data or the model itself… ZKML offers a solution by providing cryptographic proofs that the training procedures were executed correctly according to speci
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.AFT.2025.35
- https://www.reddit.com/r/selfhosted/comments/1m4ujre/decentralized_llm_inference_from_your_terminal/
- https://vcomp.eqtylab.io
- https://www.archetype.fund/media/verifiable-compute-scaling-trust-with-cryptography
- https://github.com/worldcoin/awesome-zkml
- https://www.youtube.com/watch?v=3e5sBHrojGY
- https://www.linkedin.com/posts/amanc_artificialintelligence-genai-research-activity-7349988448788787200-1j2q
- https://equilibrium.co/writing/state-of-verifiable-inference
- https://kudelskisecurity.com/modern-ciso-blog/zkml-verifiable-machine-learning-using-zero-knowledge-proof