Verifiable AI's Threat-Model Menu: 2M Inferences Settle On-Chain

In the year of our algorithm, the proof market has just triggered its opening bell. On-chain inference is no longer a whitepaper’s fever dream. The Dagstuhl framework drops a CNN onto Ethereum L1 for 506,397 gas—call it $1.77 in the old empire’s currency—while OpenGradient has already settled 500,000+ zkML proofs and TEE attestations for 2,000,000+ verifiable inferences.[^claim_1001][^claim_1009] The verifiable AI stack has matured into a menu of threat models: optimistic challenge periods, zero-knowledge circuits, TEE enclaves, and hybrids chosen per task. That is a usable coprocessor primitive for DeFi, with defined costs and defined security assumptions. The yield on compliance just went ex-dividend.

Start with cost, because in this class of trade the vig comes first. Fully on-chain inference burns 57,603 gas for linear models, 143,647 gas for CNN(F2, K1), and 506,397 gas for CNN(F8, K4) on L1, all bit-exact to off-chain counterparts formally proven in Z3.[^claim_1001] Those gas figures place non-trivial models inside block limits and give fee-market designers hard numbers for pricing AI calls. The fee market just got a new ticker.

Execution and verification are splitting apart. OpenGradient’s Hybrid AI Compute Architecture separates execution from verification through specialized node types: inference nodes run GPU workloads, data nodes supply attested external data, and full nodes run consensus and settle either zkML proofs or TEE attestations for every inference on-chain.[^claim_1002] The network has processed 2,000,000+ verifiable AI inferences and over 500,000 zkML proofs plus TEE attestations, exposing an on-chain coprocessor interface where every inference arrives with proof material.[^claim_1009] The hardware is the witness, and the witness is for sale, as always.

Not every task needs a zero-knowledge proof; only the ones where you need to look clean after the assassination. Ora Protocol enables optimistic verification of AI inference, posting results on-chain with a challenge period during which opML validators can verify outputs and submit fraud proofs if incorrect.[^claim_1003] Ethereum mainnet, Arbitrum One, Base, and Optimism all support on-chain generative AI inference through Ora and Ritual, recording a cryptographic proof of each computation on-chain.[^claim_1004] EZKL pushes the compiler layer further, converting any ONNX-compatible model into a ZK circuit.[^claim_1006] It’s the compiler as arms dealer.

The hybrid end of the spectrum is Optimistic TEE-Rollups. OTR leverages NVIDIA H100 Confidential Computing TEEs for sub-second provisional finality, underpinned by an optimistic fraud-proof mechanism and stochastic zero-knowledge spot-checks to mitigate hardware side-channel risks.[^claim_1005] This trade is explicit: perfect provability yields to latency, and crypto-economic spot-checks police the hardware. It’s a plea bargain with the machine.

Agents are becoming first-class actors on this stack. Chainlink for Agents integrates the Chainlink Runtime Environment with CCIP so autonomous agents can bridge off-chain AI decision-making to on-chain smart contracts and transfer assets across multiple blockchain networks.[^claim_1007] At the payment layer, Agent-8004-x402 combines ERC-8004 trustless agent identity with x402, where a provider responds HTTP 402 with a payload such as “pay 5 USDC on Ethereum to address X” before service delivery.[^claim_1008] Lumera brings its own deployment density, running 50-plus SuperNodes across Cascade storage, Sense media authenticity, and Inference verifiable AI modules.[^claim_1000] The agents are the new high-frequency traders, and the 402 is their dark pool.

The crypto consequence is a threat-model choice per task. Latency-sensitive MEV logic can use TEE provisional finality with spot-checked ZK; high-value settlement can wait for full zkML proofs; cheap classification can ride optimistic fraud proofs. x402 turns HTTP 402 into a crypto payment rail for machine-to-machine inference, and CCIP-connected agents can settle those payments across chains. With L1 gas figures public, protocol designers can now price AI calls into fee markets and MEV models. Just as the bond market prices default risk, the AI market now prices proof risk.

The verifiable-inference stack has moved from paper to production. The pattern is not one proof system, but layered ones: zk where finality matters, TEEs where latency matters, optimistic where cost matters, agents that pay over HTTP across chains. Watch for fee markets pricing AI compute by proof type, and for TEE spot-check parameters to become standardized. The yield curve on verifiability just steepened. Suit up.