zkML and TEEs Converge: Verifiable AI Inference Hits Production for On-Chain Agents
From Jolt Atlas streaming proofs to Nautilus TEE offloading and DeepProve-1's GPT-2 proofs, 2025–2026 infrastructure makes verifiable AI a practical primitive for rollups, coprocessors, and agent frameworks.
The 2025–2026 infrastructure cycle finally delivers what the AI×crypto thesis promised: verifiable inference that fits within on-chain fee budgets and agent execution windows. Three approaches—zkML, TEEs, and distributed reproducibility—now compete and complement each other, with concrete benchmarks and production deployments behind each.
zkML hits production scale. Lagrange Labs’ DeepProve-1 is the first production zkML system to generate cryptographic proofs over a full GPT-2 large language model inference [^claim_2082]. Its companion compiler, zkPyTorch (March 2025), reports a VGG-16 (138M parameters) proof generation time of approximately 2.2 seconds [^claim_2082]. EZKL benchmarks show on-chain verification for ~18M-parameter CNNs with CPU proving times from seconds to minutes, and 5–10x speedups from GPU support [^claim_2082]. Jolt Atlas extends the Jolt proving system to model inference by applying lookup-centric arguments directly to ONNX tensor operations, enabling streaming (memory-constrained) provable inference with succinctly verifiable proofs that can be generated and verified on-device without specialized hardware [^claim_2080].
TEEs offer a pragmatic hybrid. Nautilus, deployed on Sui mainnet in June 2025, provides a TEE-based verifiable off-chain compute framework that offloads private model training and ZK-ML proof generation to AWS Nitro Enclaves while maintaining on-chain verifiability [^claim_2081]. It pairs with Mysticeti v2 consensus, achieving a 35% reduction in delays to support real-time AI inference for on-chain agents [^claim_2081]. Ritual’s Infernet acts as an open, modular compute orchestration layer that lets smart contracts natively call off-chain AI inference results; its proof-system-agnostic architecture lets nodes choose between TEE-based execution and zero-knowledge proof-based verification, ensuring every AI-generated inference is traceable, auditable, and integrity-guaranteed within on-chain environments [^claim_2084].
Distributed verifiability without ZK. Theta EdgeCloud’s distributed verifiable LLM inference service guarantees reproducible and tamper-proof outputs for chatbots and AI agents. It uses blockchain-backed public randomness beacons and, for higher-stakes use cases, publishes inference metadata (prompt, distribution, random seed, result) on-chain to be attested by decentralized guardians or witnesses [^claim_2083]. Theta positions itself as the first and only platform (as of mid‑2025) offering trustless LLM inference across both crypto-native and traditional cloud platforms [^claim_2086].
The infrastructure stack matures. By 2025–2026, actively validated services (AVS) built on restaking markets (EigenLayer-style shared security) and ZK coprocessors such as Axiom and Brevis provide production-grade infrastructure for GPU-hosted AI inference and broader verification workflows. Inference is executed off-chain and a compact zero-knowledge proof is submitted on-chain as a tamper-resistant, publicly verifiable attestation of correct model execution [^claim_2085]. A SNARK circuit instantiated over an entire transformer forward pass can cryptographically bind an AI agent’s execution to a committed program, providing a software-only G2 guarantee of computational integrity and reproducible behavior without relying on TEE hardware [^claim_2087]. Sui’s AI stack—Nautilus for verifiable off-chain computing, Walrus for decentralized data storage, and Seal for programmable access control—provides a complete verifiable control plane for scalable AI agents. On-chain autonomy, privacy protection, and fine-grained access control are enforced using Sui’s object-centric data model and parallel execution engine [^claim_2089].
Bottom line. The era of toy-model zkML is over. Production systems now prove GPT-2 inference in seconds, stream proofs on-device, and offer TEE fallbacks for latency-sensitive agents. For rollup designers, coprocessor networks, and agent frameworks, the constraint shifts from “can we prove it?” to “which proof system fits our fee budget and latency SLA?” Watch for DeepProve-1’s integration into WAVS, Nautilus’s adoption beyond Sui, and whether Theta’s distributed verifiability gains traction in gaming and social protocols where deterministic replay matters more than zero-knowledge.
Provenance ledger
10 claims web-citedEvery claim below cites a source URL, and each URL was checked for validity before publish. The excerpt shown is the researcher's own summary of the page — it is not re-derived from the source, so it is not a verified verbatim quote. Follow the link to confirm any claim against the original. Citation markers in the text jump here.
[1] Jolt Atlas extends the Jolt zero‑knowledge proving system to model inference by applying lookup‑centric arguments directly to ONNX tensor operations, enabling streaming (memory‑constrained) provable inference with succinctly verifiable proofs that can be generated and verified on-device without specialized hardware. web-cited
“We present Jolt Atlas, a zero-knowledge machine learning (zkML) framework that extends the Jolt proving system to model inference. Unlike zkVMs … Jolt Atlas adapts Jolt's lookup-centric approach and applies it directly to ONNX tensor operations… We demonstrate that Jolt Atlas can prove model inference in memory-constrained environments — a prover property commonly referred to as streaming… Jolt Atlas enables cryptographic verification that can be run on-device, without specialised hardware. The
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[2] Nautilus, deployed on Sui mainnet in June 2025, provides a TEE-based verifiable off-chain compute framework that offloads private model training and ZK‑ML proof generation to AWS Nitro Enclaves while maintaining on-chain verifiability, and is paired with Mysticeti v2 consensus achieving a 35% reduction in delays to support real-time AI inference for on-chain agents. web-cited
“Nautilus Framework: Verifiable + Privacy-Preserving Off-Chain Computing - Nautilus extends Sui's on-chain primitives to verifiable execution off-chain, relying on TEE hardware enclaves like AWS Nitro Enclaves. Developers can offload high-computational tasks (such as private model training and ZK-ML proof generation) to TEE while retaining on-chain result verifiability… Technology upgrades include the launch of the Mysticeti v2 consensus protocol in November 2025, achieving a 35% reduction in de
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[3] Lagrange Labs’ DeepProve‑1, released in 2025, is described as the first production zkML system to generate cryptographic proofs over a full GPT‑2 large language model inference, and the related zkPyTorch compiler (March 2025) produces zero‑knowledge circuits from PyTorch models, with a reported VGG‑16 (138M parameters) proof generation time of approximately 2.2 seconds and EZKL benchmarks showing on-chain verification for ~18M‑parameter CNNs with CPU proving times from seconds to minutes and 5–10x speedups from GPU support. web-cited
“Lagrange Labs shipped DeepProve-1, the first production zkML system to generate cryptographic proofs over a full LLM inference (GPT-2)… zkPyTorch (released March 2025) automates this conversion for PyTorch models, enabling VGG-16 inference proofs in ~2.2 seconds… EZKL benchmarks: For smaller convolutional networks (~18M parameters), Modulus Labs has demonstrated on-chain proof verification. Proving times range from seconds (simple classifiers) to minutes (larger models) on CPU; GPU support adde
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[4] Theta EdgeCloud’s distributed verifiable LLM inference service implements an industry-grade verifiable LLM engine that guarantees reproducible and tamper-proof outputs for chatbots and AI agents by using blockchain-backed public randomness beacons and, for higher-stakes use cases, publishing inference metadata (prompt, distribution, random seed, result) on-chain to be attested by decentralized guardians or witnesses. web-cited
“We’re excited to announce the newest feature of Theta EdgeCloud: A large language model (LLM) inference service with distributed verifiability… This new feature will allow chatbot and AI agent to perform trustworthy and independently verifiable LLM inference, powered by blockchain-backed public randomness beacons… Building on these advancements, we designed and implemented a Distributed Verifiable Inference system that guarantees that LLM outputs are both reproducible and tamper-proof… We’re re
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] Ritual’s Infernet acts as an open, modular compute orchestration layer that lets smart contracts natively call off-chain AI inference results, and its proof-system-agnostic architecture allows nodes to choose between TEE-based execution and zero-knowledge proof-based verification so that every AI-generated inference is traceable, auditable, and integrity-guaranteed within on-chain environments. web-cited
“The second category, represented by Ritual, introduces a new compute orchestration layer… Its product, Infernet, allows smart contracts to seamlessly call AI inference results, solving the long-standing limitation that on-chain applications cannot natively run AI… Ritual’s architecture is designed with proof-system agnosticism, allowing nodes to choose between: TEE-based execution; ZK proof-based verification. This ensures every AI-generated inference is: Traceable; Auditable; Integrity-guarant
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[6] By 2025–2026, actively validated services (AVS) built on restaking markets (EigenLayer-style shared security) and ZK coprocessors such as Axiom and Brevis provide production-grade infrastructure for GPU-hosted AI inference and broader verification workflows, where inference is executed off-chain and a compact zero-knowledge proof is submitted on-chain as a tamper-resistant, publicly verifiable attestation of correct model execution. web-cited
“The most direct cryptographic approach is to run inference off-chain… and submit a compact zero-knowledge proof on-chain that attests the computation was performed correctly. The chain verifies the proof cheaply relative to running the model directly… By 2025 and into 2026, Actively Validated Services (AVS) built on restaking markets (such as EigenLayer-style shared security) have become a practical mechanism for GPU-hosted inference… ZK coprocessors help developers add verifiable compute to bl
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] Theta EdgeCloud positions itself as the first and only platform (as of mid‑2025) offering trustless LLM inference across both crypto-native and traditional cloud platforms, by combining distributed verifiable inference with blockchain-backed randomness so that neither the service provider nor a single node can undetectably tamper with LLM outputs. web-cited
“With this implementation, EdgeCloud is the first and only platform to offer trustless LLM inference for all, among both crypto-native and traditional cloud platforms… Building on these advancements, we designed and implemented a Distributed Verifiable Inference system that guarantees that LLM outputs are both reproducible and tamper-proof, even by the service provider (such as Theta Labs for EdgeCloud).”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[8] A SNARK circuit instantiated over an entire transformer forward pass can cryptographically bind an AI agent’s execution to a committed program, providing a software-only G2 guarantee of computational integrity and reproducible behavior without relying on TEE hardware. web-cited
“A SNARK circuit over the complete transformer forward pass provides the strongest software G2 guarantee—computational integrity without TEE hardware—by cryptographically binding the agent’s execution to its registered code commitment C_{P}=\mathrm{CommitProg}(P).”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] DeepProve (by Lagrange Labs) is a framework designed to prove neural network inference using zero-knowledge techniques for both MLP and CNN architectures, providing fast verification of computations without revealing underlying data and integrating with Layer One’s WAVS runtime to enable AI decisions and off-chain computations to be proven on-chain for trustless agents. web-cited
“Welcome to DeepProve, a cutting-edge framework designed to prove neural network inference using zero-knowledge cryptographic techniques. Whether you're working with Multi-Layer Perceptrons (MLPs) or Convolutional Neural Networks (CNNs), DeepProve offers a fast and efficient way to verify computations without revealing the underlying data.” (integration context from ZK/AI Latest: “@LayerOnEth: Collaborated to integrate DeepProve into Layer One’s WAVS runtime, enabling AI decisions and off-chain
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[10] Sui’s AI stack, including Nautilus for verifiable off-chain computing, Walrus for decentralized data storage, and Seal for programmable access control, provides a complete verifiable control plane for scalable AI agents in which on-chain autonomy, privacy protection, and fine-grained access control are enforced using Sui’s object-centric data model and parallel execution engine. web-cited
“As of November 2025, the Sui ecosystem fully supports the construction and operation of scalable AI Agents, with key frameworks including Nautilus for privacy-preserving off-chain computing, Walrus for decentralized data storage, Seal for programmable access control, and the overarching Sui AI Stack—a complete verifiable control plane that enables seamless integration of large-scale AI models and on-chain settlements… The core focus of the Sui AI ecosystem in 2025 is on on-chain autonomy and pr
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://arxiv.org/abs/2602.17452
- https://www.chaincatcher.com/en/article/2225271
- https://zylos.ai/research/2026-03-18-zero-knowledge-proofs-ai-agent-verification/
- https://medium.com/theta-network/introducing-distributed-verifiable-llm-inference-on-theta-edgecloud-combining-the-strengths-of-ai-c678bec54483
- https://htxofficial.medium.com/ai-crypto-deep-research-report-the-symbiotic-era-of-algorithms-and-ledgers-86e049f7e168
- https://www.blockchain-council.org/blockchain/verifiable-ai-inference/
- https://arxiv.org/html/2603.14332v2
- https://github.com/Lagrange-Labs/deep-prove