zkML Benchmarks Are In—But the Real Shift Is Composable Verification
Proving times for VGG-16 and Llama-3 have fallen, but the bigger story is the emergence of tiered verification stacks that mix full proofs, sampling, and aggregation—enabling practical on-chain AI for DeFi and agents.
Verifiable AI infrastructure no longer hinges on feasibility—the benchmarks have arrived.[^3032] The real shift is composability: protocols can now assemble verification pipelines that match cryptographic strength to asset value, mixing full zk proofs, statistical sampling, and proof aggregation.[^3032][^3039][^3040]
Proving a VGG-16 model takes 2.2 seconds with zkPyTorch.[^3032] Llama-3 is proven at 150 seconds per token.[^3032] ZKTorch runs GPT-J (6B parameters) in 20 minutes on 64 threads, producing an 85KB ResNet-50 proof—a dramatic compression from earlier 1.27GB proofs.[^3032] On the practical deployment side, EZKL (Halo2-based) is significantly faster and uses less memory than Risc0, making it the default for production DeFi models under 18 million parameters in 2026.[^3035] Lagrange DeepProve achieves major speedups for transformers and produced the first complete GPT-2 proof.[^3035]
On-chain inference is getting leaner. A decentralized learning framework for DeFi attack mitigation uses quantization and loop-unrolling to fit logistic regression, SVMs, CNNs, and gated RNNs within Ethereum’s block gas limit while maintaining bit-exact parity to off-chain models.[^3030] VeriLLM slashes verification overhead to approximately 1% of full inference cost through Merkle-based commitments, VRF-driven sampling, and on-chain adjudication.[^3031]
Developer tooling is converging. Mina’s zkML library converts ONNX models into proof circuits, deploys o1js smart contracts, and exposes a REST API for on-chain verification.[^3033] For new ZKML projects, SP1 is the default zkVM: write inference in Rust, compile to an SP1 guest, and proofs become first-class on-chain primitives that smart contracts consume directly.[^3034]
Agent infrastructure completes the picture. Autonomys Auto Agents permanently archive every interaction, decision, and reasoning trace on-chain, delivering verifiable, censorship-resistant memory.[^3036] ElizaOS provides an open-source agent core with chain-specific plugins, while GOAT supplies a unified action library across 30+ chains.[^3037]
The privacy-preserving design pattern combines client-side encryption, MPC-based key control, TEE inference with attestations, and ZK proofs, leveraging ZK rollups and zkVMs as verifiable compute layers.[^3038] Two new techniques expand the verification spectrum: a sampling-based framework that replaces full cryptographic proofs with statistical guarantees,[^3039] and Mira, a folding scheme that directly supports pairing-based arguments and enables Groth16 proof aggregation for verifiable ML inference.[^3040] Meanwhile, major zkML frameworks—including EZKL, Lagrange, zkPyTorch, and Jolt—are shifting from simply running on GPUs to being genuinely optimized for them.[^3041]
The composability of these components means protocols can build risk-tiered verification. A high-value oracle update might demand a full zk proof via EZKL or ZKTorch; a lower-stakes agent action could rely on sampling-based checks; a rollup could batch many such attestations with Mira. This directly shapes how L2–L1 oracle networks, fraud-proving systems, and MEV-aware monitoring agents architect their security budgets.
Provenance ledger
11 span-verified · 1 web-cited11 claims below are locked to a verbatim span re-verified against the source. The remaining 1 is a web citation: the URL was checked, but the excerpt is the researcher's summary and was not re-derived from the page. Citation markers in the text jump here.
[1] The 2025 on-chain decentralized learning framework for DeFi attack mitigation executes gas-prohibitive ML training on Layer-2, propagates verified model updates to Ethereum Layer-1, and supports gas-bounded, low-latency inference for logistic regression, SVMs, MLPs, CNNs, gated RNNs, and formally verified decision trees within the Ethereum block gas limit while remaining bit-exact to off-chain models. span-verified
“We present the first decentralized, fully on-chain learning framework that: (i) performs gas-prohibitive computation on Layer-2 to reduce cost, (ii) propagates verified model updates to Layer-1, and (iii) enables gas-bounded, low-latency inference inside smart contracts… We develop quantization and loop-unrolling techniques that enable inference for logistic regression, SVM, MLPs, CNNs, and gated RNNs (with support for formally verified decision tree inference) within the Ethereum block gas lim
86dd46fc482333b8ae3a966506342fe2b5c06c475c72c23c4cfc68774600c4b1 [2] The VeriLLM protocol for decentralized LLM inference achieves publicly verifiable correctness and accountability with approximately 1% verification overhead relative to full inference cost by using Merkle-based commitments, VRF-driven sampling, a commit–then–sample procedure, and on-chain adjudication. span-verified
“We introduce VeriLLM, a publicly verifiable protocol for decentralized LLM inference that achieves security with incentive guarantees while maintaining practical efficiency… VeriLLM reduces the verification burden to approximately 1% of the inference cost… Any participant can verify inference correctness without relying on trust or replication… The verification process is auditable both off-chain (via hidden-state recomputation) and on-chain (via sampled scalar checks)… By combining Merkle-base
0dbbe4801c53680517638eed0f1a7b17b2a70fa1f5410c672263e756c4b03dcc [3] Polyhedra’s zkPyTorch, released in March 2025, can generate a zk proof for VGG-16 inference in 2.2 seconds and for Llama-3 at 150 seconds per token, while ZKTorch (July 2025) proves GPT-J (6B parameters) in 20 minutes on 64 threads, GPT-2 in 10 minutes, and a ResNet-50 proof of size 85KB compared to Mystique’s 1.27GB, making ZKTorch the current speed leader for general-purpose zkML. span-verified
“zkPyTorch dropped in March 2025 and suddenly you can prove VGG-16 inference in 2.2 seconds… zkPyTorch… First to prove Llama-3 — 150 seconds per token… ZKTorch (Daniel Kang, July 2025)… GPT-J (6 billion parameters): 20 minutes on 64 threads… GPT-2: 10 minutes (down from 1+ hour)… ResNet-50 proof: 85KB (Mystique was generating 1.27GB proofs)… This is the current speed king for general-purpose zkML.”[3]
1236bc3f88a842f4ad307017ffa893c177e374816695a32270ca435966d52af6 [4] Mina’s zkML library converts AI models in ONNX format into zero-knowledge proof circuits, generates a Mina proof of an AI inference job over private inputs via a Rust prover, and provides a CLI and zkML Verifier tool that deploys o1js smart contracts and exposes a REST API so arbitrary proof inputs can be submitted and verified on-chain. span-verified
“Mina’s zkML library enables anyone to generate a zero knowledge proof from an AI inference job using private inputs… Convert AI models (in the widely used ONNX format) into zero knowledge proof circuits… a prover written in Rust for generating a zero knowledge proof from an ONNX file, a command-line interface (CLI) for generating a verifier for your proof and deploying it to the Mina blockchain… To make it easy for anyone to verify a proof and record it on the Mina chain we are also releasing t
c6e0c2cf84b79c0823421a807a052c5827bd0f03fa2665cd2dad7229dd6445c7 [5] The ZKML for On-Chain AI Agents framework recommends SP1 as the default zkVM for new ZKML projects in 2026, allowing developers to write inference logic in Rust, compile it to an SP1 guest, and generate proofs that become first-class on-chain primitives so smart contracts can act directly on verified AI decisions without revealing model weights, inputs, or intermediate computations. span-verified
“Zero-Knowledge Machine Learning (ZKML)… lets you prove that a model ran correctly on a given input and produced a given output — without revealing the model weights, the input data, or any intermediate computation… The proof output becomes a first-class on-chain primitive. Smart contracts can act on verified AI decisions… SP1 is a zkVM by Succinct Labs. It proves execution of arbitrary Rust programs… For new ZKML projects in 2026, SP1 is the default recommendation; use Risc0 if you need battle-
028e07580593de6684939698b2b7e564f7bbe6a764dd936da2ce1b9d160a5986 [6] EZKL, built on Halo2, is reported to be significantly faster than Risc0 and to use dramatically less memory for equivalent tasks, making it the current default zkML proof system for production DeFi deployments under 18M parameters in 2026, while Lagrange DeepProve achieves major speedups for transformer architectures and produced the first complete GPT-2 proof. span-verified
“EZKL (Halo2-based) is the most production-ready for small-to-medium neural networks: it is significantly faster than Risc0 and uses dramatically less memory for equivalent tasks, making it the current default for production DeFi deployments (EZKL Benchmarks, 2025)… Lagrange DeepProve achieves major speedups over EZKL for transformer architectures and generated the first complete GPT-2 proof… For DeFi oracles and scoring models under 18M parameters, EZKL remains the most battle-tested choice in
4f4e1ac8cb005e86b21e98a652ed92332ac398d8071b9182e386f0ab6352eaf5 [7] The Autonomys Auto Agents framework permanently archives each interaction, decision, and reasoning process of an on-chain AI agent on the Autonomys Network so that every aspect of agent operation is accessible, auditable, and cryptographically verified, enabling verifiable interaction and censorship-resistant agent memory. span-verified
“The Autonomys Agents (Auto Agents) Framework enables developers to build truly autonomous on-chain AI agents capable of dynamic functionality, verifiable interaction, and permanent, censorship-resistant memory through the Autonomys Network. By permanently archiving each interaction, decision, and reasoning process on-chain, Auto Agents ensure that every aspect of their operation is accessible, auditable, and cryptographically verified.”[14]
961866f02f32d2a5806b506b1a56d80915b1b7e0f07890db2aa7b7a1641298ed [8] ElizaOS provides an open-source, general-purpose AI agent framework that exposes a core data layer, LLM integration, and extensible agent logic with plugins for Solana and other chains, while Crossmint’s GOAT toolkit supplies a unified library of on-chain actions that lets agents interact with smart contracts across 30+ chains and supports at least five popular agent frameworks. web-cited
“ElizaOS (now open-source) provides the core ‘brain’ and architecture for AI agents — combining a data layer, LLM integration, and an extensible agent logic — with plugins for Solana and other platforms… GOAT’s ambition is to be the universal adapter between AI agents and any blockchain application. GOAT provides a unified library of on-chain actions, enabling agents to seamlessly interact with smart contracts across 30+ different chains in a standardized way. It supports multiple programming la
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] The described privacy-preserving AI architecture for blockchain applications combines client-side encryption, MPC-based key control, TEE-based model inference that outputs attestations, and ZK proofs to verify policy compliance or correctness constraints before anchoring results on-chain, using ZK rollups and zkVMs as verifiable compute layers that execute logic off-chain and post succinct proofs. span-verified
“A common pattern for privacy-preserving AI with blockchain follows this structure: 1. Client-side encryption protects raw data… 2. MPC-based key control ensures decryption… 3. TEE-based inference runs the model inside an enclave, producing outputs and attestations efficiently. 4. ZK proofs verify policy compliance or correctness constraints, then anchor results on-chain for auditability… Verifiable compute in Layer 2: ZK rollups and zkVMs can execute logic off-chain and post succinct proofs on-
8031624c7b7b87c42fc9f1d441fe1811c30621662f44022ccce3d831191ae583 [10] The cryptographic sampling-based verification framework in 2026 for verifiable AI replaces full cryptographic proofs with a lightweight protocol grounded in statistical properties of neural networks, reducing verification cost while still providing correctness guarantees, and is designed as an alternative to heavyweight ZKP-based verifiable ML. span-verified
“We present a verification framework and protocol that replaces full cryptographic proofs with a lightweight, sampling-based approach grounded in statistical properties of neural networks.”[10]
87ebca2d9ded832ddafc6401b7f97eaf4af30fc2b88ef1ee4f0c93bea34e9e42 [11] The Mira folding scheme directly supports pairing-based arguments and can be used for Groth16 proof aggregation and verifiable ML inference by generalizing Protostar’s framework to a broader class of special-sound protocols, enabling more efficient aggregation of zkSNARK proofs relevant to batching verifiable ML attestations. span-verified
“In this work, we introduce Mira, a folding scheme that directly supports pairing-based arguments… We construct this folding scheme by generalizing the framework in Protostar to support a broader class of special-sound protocols… We demonstrate the versatility and efficiency of this framework through two key applications: Groth16 proof aggregation and verifiable ML inference.”[11]
ecff07af9e86b17fa459b905becadeb40819ac8d5799fe5e2063bfd75462e76a [12] The 2026 zkML verifiable on-chain AI inference architecture identifies EZKL (Halo2), Risc0, Lagrange DeepProve, and SP1 as the core zkML proof systems and states that in 2026 most major zkML frameworks, including EZKL, Lagrange, zkPyTorch, and Jolt, run on CUDA with GPU support, with the design direction shifting from merely ‘runs on GPUs’ to being ‘optimized for GPUs.’ span-verified
“EZKL, Lagrange, zkPyTorch, Jolt, all running on CUDA. But 2025's GPU support was ‘it runs on GPUs.’ 2026's will be ‘it's optimized for GPUs.’”[3]
4fb7e2c2a7ca467a0528dc16bbbcdc90304ebd9e999aba19885ab2cdf20140ab Sources
- https://arxiv.org/abs/2510.16024
- https://arxiv.org/html/2509.24257v4
- https://blog.icme.io/the-definitive-guide-to-zkml-2025/
- https://minaprotocol.com/blog/minas-zkml-library-developer-guide
- https://cercuit-ola.github.io/zklm-docs/
- https://www.ancilar.com/knowledge-hub/blogs/verifiable-ai-inference-how-zkml-enables-trust-minimised-on-chain-model-execution
- https://github.com/autonomys/autonomys_gitbook/blob/main/auto-suite/auto-agents.md
- https://medium.com/@grigon/ai-agents-and-the-future-of-crypto-how-intelligent-systems-are-shaping-blockchain-in-2025-9dae972f7039
- https://www.blockchain-council.org/blockchain/privacy-preserving-ai-with-blockchain-zk-proofs-mpc-secure-enclaves/
- https://arxiv.org/abs/2603.19025
- https://eprint.iacr.org/2024/2025