ZKML and TEEs Converge: Verifiable AI Hits Production for On-Chain Agents
Zero-knowledge proofs and trusted execution environments are merging to deliver cryptographically attested AI inference for high-stakes DeFi, legal, and agent coordination workflows, with mainnet launches and sub-second finality in sight.
The AI×crypto stack is converging on a single thesis: if AI agents are going to hold keys, route liquidity, and make high-stakes decisions on-chain, their outputs need to be cryptographically verifiable. Two tracks—zero-knowledge machine learning (ZKML) and trusted execution environments (TEEs)—are merging into production-ready infrastructure that delivers attested inference without trashing privacy or throughput. This is effectively the cryptographic equivalent of the 1890s shipping container: a standardised, trust-minimised box that lets value move without constant inspection.
Inference Labs’ Proof of Inference protocol is live on testnet, with a mainnet launch scheduled for late Q3 2025. It uses zero-knowledge proofs to validate AI model outputs from decentralized off-chain resources while keeping model weights private [^claim_1766]. That’s the core tension in verifiable AI: proving correctness without exposing proprietary models. On the ZKML side, Modulus Labs benchmarks on-chain proof systems supporting models up to 18 million parameters, and EZKL converts ONNX model files into ZK-SNARK circuits for efficient on-chain verification [^claim_1767]. zkPyTorch extends this to the PyTorch ecosystem, letting provers convince verifiers of inference correctness without revealing the model or input data [^claim_1772]. A zk-STARK-based design defines verifiable inference as a scalable transparent argument of knowledge using cryptographic hashing [^claim_1774].
TEE-based approaches offer complementary strengths. Atoma Network runs a confidential AI inference network on Intel SGX, TDX, and NVIDIA Confidential Computing GPUs, producing on-chain-verifiable inference receipts and paying node operators in stablecoins [^claim_1768]. Optimistic TEE-Rollups (OTR) go further: using NVIDIA H100 TEEs, they deliver sub-second provisional finality through an optimistic fraud-proof mechanism and stochastic zero-knowledge spot-checks. Simulations show OTR hits 99% of centralized throughput at a marginal cost overhead of $0.07 per query while maintaining Byzantine fault tolerance against rational adversaries [^claim_1770]. The key insight: TEEs and ZK aren’t competing—they compose. Wrapping TEE remote attestation in a zero-knowledge proof, as Risc Zero and Automata are exploring, cuts on-chain verification cost by 8x compared to verifying attestations directly on-chain [^claim_1769].
By 2026, EZKL, Giza, and Ritual are the primary protocols implementing verifiable AI inference on-chain. Their systems are in an ‘early production’ maturity stage, suited to high-value, low-volume, audit-critical workflows: verifiable DeFi decisions, regulatory compliance checks, identity and reputation systems, supply-chain provenance, and autonomous agent coordination [^claim_1771]. This niche is deliberate—proof generation costs remain non-trivial, so the economic case only closes where trust and attestation matter more than speed or volume.
The agent layer is already integrating. A multi-agent LLM framework for DeFi transaction intent mining uses domain-expert and evaluator agents to infer user intent from combined on-chain and off-chain data, forming an AI agent layer that interfaces directly with DeFi protocols [^claim_1773]. When those agents’ outputs are backed by ZK or TEE attestations, they become trust-minimized actors capable of autonomous, auditable action.
With mainnet launches imminent, sub-second TEE finality at $0.07 per query, and 8x cheaper ZK-wrapped attestations, the infrastructure exists to deploy AI agents that can safely hold keys, route liquidity, and participate in on-chain governance. The next step is composability—wiring these attestation primitives into smart contract verifiers, rollup sequencers, and oracle networks. Watch for the first DeFi protocols to mandate verifiable inference for agent-operated positions. The yield on compliance just went ex-dividend.
Provenance ledger
9 claims web-citedEvery claim below cites a source URL, and each URL was checked for validity before publish. The excerpt shown is the researcher's own summary of the page — it is not re-derived from the source, so it is not a verified verbatim quote. Follow the link to confirm any claim against the original. Citation markers in the text jump here.
[1] Inference Labs’ “Proof of Inference” protocol uses zero-knowledge proofs to validate AI model outputs from decentralized off-chain resources while keeping model weights private, and is live on testnet with a mainnet launch scheduled for late Q3 2025. web-cited
“Proof of Inference, a zero-knowledge cryptographic protocol that enables AI models to hyperscale with decentralized off-chain resources while proving the soundness of their outputs… This allows model operators to keep their intellectual property private while still offering verifiable services… The protocol's Proof of Inference system is currently live on testnet, with mainnet launch scheduled for late Q3.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[2] Modulus Labs benchmarks on-chain zero‑knowledge proof systems for AI inference supporting models up to 18 million parameters, and the EZKL tooling converts ONNX model files into zk‑SNARK circuits for efficient on-chain verification of deep learning inference. web-cited
“ZKML facilitates the deployment of models on-chain or in decentralized networks, with zero-knowledge proofs compressing model verification. For example, EZKL can take ONNX files, converting them to ZK-SNARK circuits for efficient on-chain verification. Modulus Labs shows the benchmarking proof systems for on-chain inference up to 18 million parameters.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[3] Atoma Network builds a confidential AI inference network that combines Intel SGX, Intel TDX, and NVIDIA Confidential Computing GPU support to produce on‑chain‑verifiable inference receipts, paying node operators in stablecoins for verifiable AI compute. web-cited
“Atoma is a more recent entrant building a confidential AI inference network using a mix of SGX, TDX, and Nvidia Confidential Computing GPU support. The pitch is verifiable AI compute that pays in stablecoins and produces onchain-verifiable inference receipts.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[4] Wrapping TEE remote attestation in a zero‑knowledge proof, as explored by Risc Zero and Automata, can reduce on-chain verification cost by 8x compared to directly verifying attestations on-chain. web-cited
“For easier and more permissionless verification, the attestation can be posted on a blockchain along with a verification program. Wrapping the remote attestation inside a ZKP would reduce the verification overhead, something that at least Risc Zero and Automata have explored (8x lower onchain verification cost).”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] Optimistic TEE‑Rollups (OTR) use NVIDIA H100 Confidential Computing TEEs to provide sub‑second provisional finality, an optimistic fraud‑proof mechanism, and stochastic zero‑knowledge spot‑checks; simulations show OTR achieves 99% of centralized throughput at a marginal cost overhead of $0.07 per query while maintaining Byzantine fault tolerance against rational adversaries. web-cited
“OTR leverages NVIDIA H100 Confidential Computing Trusted Execution Environments (TEEs) to provide sub-second Provisional Finality, underpinned by an optimistic fraud-proof mechanism and stochastic Zero-Knowledge spot-checks… Extensive simulations demonstrate that OTR achieves 99% of the throughput of centralized baselines with a marginal cost overhead of $0.07 per query, maintaining Byzantine fault tolerance against rational adversaries even in the presence of transient hardware vulnerabilities
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[6] In 2026, EZKL, Giza, and Ritual are identified as the primary protocols implementing verifiable AI inference (ZKML) on-chain, where proofs are generated off-chain and verified by a smart-contract verifier; these systems are described as in an “early production” maturity stage suited to high‑value, low‑volume, audit‑critical DeFi and legal workflows. web-cited
“EZKL, Giza, and Ritual are the serious players in 2026… | Verifiable Inference (ZKML) | Proof verification, verifier contract | Model weights, proof generation | EZKL, Giza, Ritual | Early production | Legal/financial proof value outweighs proof cost… High‑value, low‑volume, audit‑critical scenarios: verifiable DeFi decisions, regulatory compliance checks, identity and reputation systems, supply‑chain provenance, and autonomous agent coordination where trust and attestation matter more than spe
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] zkPyTorch provides a framework to run PyTorch machine‑learning computations and generate zero‑knowledge proofs that they were executed correctly, enabling a prover to convince an on-chain or off-chain verifier of inference correctness without revealing the model or input data. web-cited
“zkPyTorch: Verifiable PyTorch with Zero-Knowledge Proofs… It employs a cryptographic primitive called Zero-Knowledge Proofs (ZKPs) to provide a cryptographically secure verification mechanism for ML models. ZKPs enable one party (the prover) to convince another (the verifier) that a computation was correctly executed without revealing any sensitive or proprietary information involved in the computation.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[8] A multi‑agent LLM framework for DeFi transaction intent mining proposed by Mao et al. (2025) uses specialized domain‑expert and evaluator agents to infer user intent from combined on‑chain and off‑chain data, forming an AI agent layer that interfaces directly with DeFi protocols. web-cited
“Mao et al. (2025) propose a multi-agent LLM framework for DeFi transaction intent mining, using domain experts and evaluators to infer user intent from on-chain and off-chain data.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] A zkML system design based on zk‑STARKs defines verifiable machine‑learning inference as a scalable transparent argument of knowledge, using cryptographic hashing and STARK proofs to attest that a given model evaluation was performed correctly without revealing the model internals. web-cited
“We focus on a specific type of zkML system based on zk-STARK (Zero-Knowledge Scalable Transparent ARguments of Knowledge)… [and] cryptographic hashing…”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://www.theblock.co/press-releases/360011/inference-labs-raises-6-3m-to-secure-ai-agents-through-verifiable-inference-protocol
- https://kudelskisecurity.com/modern-ciso-blog/zkml-verifiable-machine-learning-using-zero-knowledge-proof
- https://eco.com/support/en/articles/14796360-tees-in-blockchain-use-cases-and-projects
- https://equilibrium.co/writing/state-of-verifiable-inference
- https://arxiv.org/html/2512.20176v1
- https://www.agilesoftlabs.com/blog/2026/05/ai-blockchain-in-2026-5-onchain
- https://blog.polyhedra.network/zkpytorch/
- https://arxiv.org/html/2607.00245v1
- https://ml4physicalsciences.github.io/2025/files/NeurIPS_ML4PS_2025_180.pdf