Verifiable AI inference has a price list — and on-chain agents can pay it
zk proofs, TEE attestations, hashing, and sampling now have measurable costs, and agent frameworks can finally spend them.
The verifiable-inference debate has shifted from “can we prove an LLM output?” to “which proof do we buy for this workload?” The cost data is now granular enough to answer: full zk for high-assurance DeFi, TEE attestations for large confidential agents, hashing and sampling for high-volume inference, and optimistic fraud proofs for deterministic lower-stakes jobs. The remaining bottleneck is wiring those primitives into agent tooling that can actually move money.
On the zk side, the numbers are no longer theoretical. Polyhedra’s zkPyTorch proves 50–100 tokens of an 8-billion-parameter Llama 3 in roughly 2–4 hours on a single CPU using the Expander proof system and ProofCloud network [^claim_799]. zkLLM verifies a 13-billion-parameter model in under 15 minutes and emits a proof smaller than 200 kB, with verification in 1–3 seconds [^claim_812]. Polyhedra’s compiler chain — PyTorch to ONNX, ZKP-friendly quantization, hierarchical circuit optimization — makes operations like convolutions, softmax, and ReLU cryptographically checkable without revealing inputs [^claim_811]. EZKL already runs this class of verifiable compute in production at Balancer and Optimism [^claim_806]. The implication: proof verification is cheap enough for on-chain settlement, even when proving is slow, because the proving cost is amortized outside the transaction.
TEEs cover the workloads zk can’t reach. Marlin’s Oyster wraps a TEE remote attestation in a zero-knowledge proof that takes about 15 minutes to generate and cuts on-chain verification cost roughly 8× [^claim_802]. Phala and NEAR AI’s private-ml-sdk runs LLMs on NVIDIA H100/H200/B100 GPU TEEs and Intel TDX CPUs with remote attestation, secure channels, and a key management service [^claim_803], and those keys can be split across nodes via MPC to reduce single-TEE compromise risk [^claim_814]. Aizel splits inference into gate, data, inference, and verifier nodes, with attestations validated in a dedicated stage [^claim_813]. Atoma runs three TEE-backed models across six nodes and also offers random sampling with user-controlled redundancy [^claim_805]. For high-value agents, TEE-plus-MPC is the right trust assumption; for volumes that can’t justify hardware enclaves, sampling and hashing take over.
At the cheap end of the stack, verification becomes marginal cost. Hyperbolic’s SVIP detects the wrong model with false negatives below 5% and false positives below 3%, though only for fixed-length inputs between 5 and 48 tokens [^claim_800]. Prime Intellect’s TOPLOC commits to top-k hidden states and can detect unauthorized model or prompt modifications with about 100% accuracy at ~1% validator overhead [^claim_801]. Hyperbolic’s Proof of Sampling re-runs a random subset of requests on an independent node, triggering arbitration on mismatch [^claim_808]. VeriLLM validates LLM outputs at about 1% of inference cost by rerunning prefill segments rather than full generation [^claim_809]. Ora’s optimistic opML posts results on-chain with a challenge window that delays finality [^claim_804]. For the high-volume, lower-stakes inference that decentralized GPU networks need to settle, these probabilistic guarantees are economically sufficient.
The execution layer is catching up. Lightchain’s AIVM turns inference into an on-chain module where users submit AI queries from a dashboard, smart contracts verify the tasks, and the network coordinates rewards [^claim_810]. Coinbase AgentKit goes further: it exposes 50+ built-in on-chain actions — wallets, ERC-20, ERC-721, Compound, Morpho, Across, Pyth, NFTs — and mounts them as tools in LangChain, Vercel AI SDK, or MCP, with no OpenAI key required [^claim_807]. Any of the verification primitives above can sit behind those actions.
The take: choose the primitive by the capital at stake. zkML for high-assurance, low-frequency decisions; TEE-plus-MPC for confidential agents controlling significant value; hashing and sampling for volume; opML for deterministic workloads that tolerate delayed finality. Then plug the result into AgentKit-style tooling so the model can transact. Watch for GPU provers — Polyhedra is building them [^claim_799] — and for sampling schemes extending past 48-token prompts [^claim_800]; those two upgrades would collapse the remaining cost gaps.
Provenance ledger
11 span-verified · 5 web-cited11 claims below are locked to a verbatim span re-verified against the source. The remaining 5 are web citations: the URL was checked, but the excerpt is the researcher's summary and was not re-derived from the page. Citation markers in the text jump here.
[1] Polyhedra’s zkPyTorch framework can prove a typical inference of 50–100 tokens from an 8‑billion‑parameter Llama 3 model in approximately 2–4 hours on a single CPU, with verification performed via their Expander proof system and ProofCloud proving network. span-verified
“Benchmarks from Polyhedra show that proving a typical inference (50-100 tokens) of an 8 billion Llama3 model takes ~2-4 hours with their zkPyTorch framework (single CPU)… On the backend, it leverages Polyhedra’s proof system Expander, while their proving network ProofCloud is used for outsourced computation and proof generation. The team is currently working on GPU compatibility for the prover.”
645c4d070f57d373734b9497eedd95ca350ed197a3dac184b0afa4defc05be1a [2] Hyperbolic’s SVIP hashing-based verifiable LLM inference scheme achieves false negative rates below 5% and false positive rates below 3% when validating that a specific model (e.g., Llama 3.1 70B) was used, but requires fixed-length inputs and was only empirically tested on prompts between 5 and 48 tokens. span-verified
“A separate proxy model is trained exclusively on the hidden states from a specific model (e.g. Llama3.1 70bn)… Empirical testing shows that SVIP achieves false negative rates below 5% and false positive rates below 3%, but it requires fixed-length inputs and was only tested on prompts between 5 and 48 tokens long. In addition, parts of the proxy model need to remain hidden from the inference provider.”
685d49a6a0bf64a09a9d949f251c1b0773396f16d6d7e1bec03b2867727d97d1 [3] Prime Intellect’s TOPLOC framework for verifiable inference commits to the top‑k values in the last hidden state during LLM inference and can detect unauthorized modifications to models, prompts, or compute precision with approximately 100% accuracy, while limiting overhead to around 1% for validators. span-verified
“During inference, the service provider commits to the top-k values in the last hidden state, which can later be verified by the validator by recomputing the last hidden states (limits overhead to ~1%). While initial empirical evaluations show that Toploc can detect unauthorized modifications to models, prompts, or compute precision with ~100% accuracy…”
7f8077103c28a5089ee103bc7ba356d2e1c5d4ffe63f76cbfafc8c19f8ece048 [4] Marlin’s coprocessor Oyster can wrap TEE remote attestations in a zero-knowledge proof whose generation takes about 15 minutes, reducing on-chain verification cost by approximately 8× compared to direct attestation verification. web-cited
“Marlin… provides the infrastructure to host apps on both CPU and GPU TEEs through their coprocessor Oyster… Marlin also enables wrapping the attestation in a ZKP for easier and cheaper onchain verification (proof generation takes ~15mins)… Wrapping the remote attestation inside a ZKP would reduce the verification overhead, something that at least Risc Zero and Automata have explored (8x lower onchain verification cost).”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] Phala’s private-ml-sdk, built with NEAR AI, enables deployment of LLMs inside NVIDIA H100/H200/B100 GPU TEEs and Intel TDX CPU TEEs with remote attestation and a key management service, providing verifiable and confidential LLM inference for agent workflows. span-verified
“The private-ml-sdk framework (granted by NEAR AI and built by Phala) provides the infrastructure to deploy and run LLMs securely within GPU TEEs. This includes a secure execution environment, remote attestation (verification), secure communication between the user and LLM, and a key management service… It enables leveraging the latest NVIDIA TEE GPUs (H100/H200/B100) and has Intel TDX support.”
b6149e28573b6531abd5faa7b12f40958ea92b7c785ba85a6ce46eec7e121726 [6] Ora’s opML protocol posts AI inference results on-chain with a challenge period during which opML validators can submit fraud proofs; if a result is found incorrect, the correct output replaces the original, making finality dependent on the length of the challenge window. web-cited
“Ora: Enables optimistic verification of AI inference, where the result is posted onchain with a challenge period. During this time, opML validators can verify the result, and if found to be incorrect, submit a fraud proof. The correct result replaces the original one… the optimistic approach to verification requires a sufficiently long challenge period to allow watcher nodes enough time to verify the computation, thereby delaying the finality of the results.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] Atoma Network currently runs three deployed TEE-backed models (Llama 3.3 70B, Mistral Nemo, DeepSeek V3) across 6 nodes and offers an alternative random-sampling mode where at least two non-TEE nodes re-execute the same inference, with user-controlled redundancy and optional cross-validation sampling reducing overhead at the cost of weaker guarantees. span-verified
“Atoma Network: Offers TEE-nodes for verifiable (and confidential) inference… Currently, there are three models deployed (Llama 3.3 70B, Mistral Nemo, and DeepSeek V3) with 6 nodes across all networks… In addition to their TEE approach, Atoma also offers random sampling for verifiable inference on hardware that doesn’t support TEE. In this case, at least two nodes run the same computation (inference) and compare results. The user can determine the amount of redundancy they want… Cross-validation
ad2da451c847268bfdcd4ad68db0bd1debd27599b02a5d80d11ec6b114c45ce1 [8] EZKL converts any ONNX-compatible model into zero-knowledge circuits and is used by production DeFi protocols (including Balancer and QuantAMM), Optimism, and decentralized inference networks like Inference Labs to provide verifiable analytics and AI-powered strategy execution on-chain. span-verified
“EZKL: Provides compute for verifiable AI (inference) and analytics products along with a compiler framework to convert models into ZK circuits (works for any model compatible with the ONNX standard)… Used by a wide range of DeFi protocols (Balancer, QuantAMM,..), L2s (Optimism), and decentralized inference networks such as Inference Labs.”
af50d07e116fbd2cdf9a87812f2b5ad877ee336fd8191b0c4c3374882f41b651 [9] Coinbase AgentKit requires Node.js v22+, exposes 50+ built-in on-chain actions across wallets, ERC‑20, ERC‑721, DeFi (Compound, Morpho, Moonwell, Superfluid), bridges (Across), price oracles (Pyth), social, and NFT tooling, and can be mounted as tools in LangChain, Vercel AI SDK, or Model Context Protocol so that any LLM can invoke these actions without AgentKit needing an OpenAI key. span-verified
“AgentKit is Coinbase's open-source framework for building AI agents with onchain capabilities. It provides wallet management, 50+ built-in actions (transfers, swaps, contract deployment, NFT minting), and integrations with LangChain, Vercel AI SDK, and Model Context Protocol… AgentKit itself is model-agnostic. It creates tools/actions that any LLM framework can call. You only need an OpenAI key if you use LangChain with ChatOpenAI… Requirements: Node.js v22+… AgentKit can run as an MCP server,
afd47ba255e2aff3f99f50137b80deb595727657725c59271f9da3b48bc67c1b [10] Hyperbolic’s Proof of Sampling scheme randomly re-runs and verifies a subset of inference requests on an independent node and can trigger arbitration if misbehavior is detected, providing low-overhead correctness checks for decentralized inference at the expense of weaker guarantees and lack of privacy. span-verified
“Hyperbolic… has also developed a scheme called Proof of Sampling which randomly verifies a subset of all inference requests. A second independent node runs the same computation and can trigger arbitration if it finds the original node has misbehaved. Low overhead, but limited strength of guarantees… Hyperbolic… Verification of correct inference is through Proof of Sampling… or hashing (SVIP). Doesn’t enable privacy-preserving inference.”
8a8e687789c6ef5c573cb95c19b8a5e1090bc664545124f693f8211053e905b3 [11] VeriLLM’s decentralized inference protocol allows verifiers to validate LLM outputs at approximately 1% of the underlying inference cost by rerunning only lightweight prefill segments combined with minimal on-chain checks, exploiting the separation between prefill and autoregressive decoding to prevent free‑riding. span-verified
“We introduce VeriLLM, a publicly verifiable protocol for decentralized LLM inference that achieves security with incentive guarantees while maintaining practical efficiency. VeriLLM combines lightweight empirical rerunning with minimal on-chain checks to preclude free-riding, allowing verifiers to validate results at approximately 1% of the underlying inference cost by exploiting the structural separation between prefill and autoregressive decoding.”
54ea1003a5f55006ee8a0df59d485bdc78e9af271fe5e1ab9675563f27d1e253 [12] Lightchain’s AI Virtual Machine (AIVM) is an on-chain execution environment where users submit AI queries via a dashboard and have them processed by a decentralized network; smart contracts verify inference tasks and coordinate rewards, forming an on-chain inference module as part of a Layer‑1 blockchain. span-verified
“Het team voltooit een robuuste on-chain inferentiemodule waarmee gebruikers AI-vragen rechtstreeks vanuit het Lightchain-dashboard kunnen indienen en ontvangen. Aangedreven door Lightchain’s AI Virtual Machine (AIVM), maakt deze module slimme contract-geverifieerde inferentieopdrachten mogelijk die worden verwerkt in een gedecentraliseerd netwerk—het inluiden van een nieuw tijdperk van open, niet-censureerbare AI-hulpmiddelen.”
fa23ba782fb4c764f2a677e63f2b76d9e37670ba58cff3b6576ef1ac68629798 [13] Polyhedra’s zkML pipeline transforms PyTorch models to ONNX, applies ZKP-friendly quantization and hierarchical circuit optimizations, and supports cryptographically verifiable operations including convolutions, softmax, and ReLU while generating a zero-knowledge proof of correctness that can be publicly verified without revealing inputs or internal model details. web-cited
“zkML bridges machine learning models and zero-knowledge cryptography using an optimized compiler pipeline… The model is transformed into a ZK-friendly format using: Graph-based preprocessing (via ONNX); ZKP-friendly quantization; Hierarchical circuit optimization. This ensures all operations—like convolutions, softmax, or ReLU—can be cryptographically verified… At inference time… produces… a zero-knowledge proof that the output is correct for the specific model and inputs. This proof can be ver
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[14] Sun et al.’s zkLLM system can verify the inference of a 13‑billion‑parameter LLM in under 15 minutes, producing a proof smaller than 200 kB with verification time between 1 and 3 seconds, demonstrating practical zkML scalability for large language model workloads. web-cited
“Building on this foundation, zkLLM is the first zero-knowledge proof system designed specifically for large language models. Sun et al., CCS 2024 report that zkLLM can verify the inference of a 13-billion-parameter model in under 15 minutes, producing a proof smaller than 200 kB — demonstrating practical scalability for LLM workloads. The zkLLM paper reports <15 min proving time for a 13 B-parameter model, <200 kB proof size, and 1–3 s verification…”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[15] Aizel Network’s TEE-based inference architecture splits responsibilities into gate nodes (routing user requests), data nodes (storing models and metadata), inference nodes (executing models), and verifier nodes (validating remote attestations), and is already integrated with ecosystems including Peaq, Avalanche, Mode, and Virtuals. span-verified
“Aizel Network: TEE-based verifiable inference infrastructure for state-of-the-art LLMs, AI agent infrastructure, and smaller models (e.g. face recognition). Splits the architecture into four parts: gate nodes (receive user requests and assign inference tasks to appropriate inference nodes), data nodes (store models and other information), inference nodes (perform the actual inference tasks), and verifier nodes (validate remote attestations)… existing partnerships include Peaq, Avalanche, Mode,
ab1c8191ca3ca86fe05e3f9bc70f6b138d49bffe5e6de5754f9ba6fc0f628b0d [16] Near AI and Phala’s private-ml-sdk supports running agentic LLM workloads on NVIDIA H100/H200/B100 GPU TEEs with Intel TDX CPUs, pairing remote attestation with MPC-style key splitting to mitigate single-TEE compromise risks for high-value on-chain agents. web-cited
“Near & Near AI… Leverages TEEs for inference, focusing on both verifiability and privacy guarantees. Private-ml-sdk is a secure and verifiable solution for running LLMs in TEEs… It enables leveraging the latest NVIDIA TEE GPUs (H100/H200/B100) and has Intel TDX support… For use cases that require strong guarantees, TEEs can be paired with cryptography (e.g. MPC) to increase robustness. For example, splitting the private key across multiple different nodes running on different hardware.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://equilibrium.co/writing/state-of-verifiable-inference
- https://cryptoskills.dev/skills/coinbase-agentkit
- https://arxiv.org/abs/2509.24257
- https://news.bitcoin.com/nl/lightchain-ai-verhoogt-ontwikkeling-van-gedecentraliseerde-inference-beloningen-en-federated-training-systemen/
- https://www.polyhedra.network/zkML
- https://lightcapai.medium.com/decentralized-ai-systems-cryptographic-infrastructures-verifiable-computation-and-federated-6355d3dea7f9