zkML hits production: VGG-16 in 2.2 seconds, 18M-parameter models on-chain
Three converging toolchains—Ezkl, DeepProve, and zkPyTorch—bring verifiable ML inference within reach of DeFi, oracles, and on-chain agents.
The gap between machine learning and on-chain verification is closing fast. In March 2025, zkPyTorch dropped and suddenly you can prove VGG-16 inference in 2.2 seconds [^claim_2255]. That’s a reduction in zkML overhead from roughly 1,000,000× to around 10,000× compared to native inference. The overhead is still real, but the trajectory is clear.
Lagrange Labs’ DeepProve goes further. It introduces a GKR-with-sum-check proof system specialized for neural network circuits, achieving major speedups for large transformer and LLM inference over prior systems like Ezkl [^claim_2256]. DeepProve generated the first complete GPT-2 proof. Meanwhile, Ezkl—built on Halo2 over BLS12-381—remains the most production-ready zkML library for small-to-medium networks. Modulus Labs used it to verify an 18-million-parameter model on-chain [^claim_2257]. For DeFi scoring or oracle models under 18M parameters, Ezkl’s lower memory usage and faster performance than Risc0 make it the pragmatic choice.
These proof systems plug into Ethereum’s existing infrastructure. Smart contracts can efficiently verify zk-SNARK proofs using BLS12-381 pairing precompiles [^claim_2263]. The three primary toolchains—Ezkl, DeepProve, and SP1—each offer different trade-offs in memory, model support, and generality, but all target the same goal: trust-minimized on-chain AI inference.
For workloads that don’t fit a fixed model, general-purpose zkVMs step in. Brevis’s Pico v1.0 is a modular zkVM designed as a “zk data coprocessor.” It executes arbitrary off-chain computations on historical and cross-chain data, returning succinct proofs that smart contracts verify cheaply [^claim_2258]. This effectively extends L1s with a verifiable compute layer.
To keep gas bounded for LLM inference, VeriLLM adopts a two-tier design: off-chain computation and Merkle proof generation, with only compact digests, VRF proofs, and sampled Merkle openings submitted on-chain [^claim_2259]. This probabilistic verification keeps overhead low while maintaining public auditability.
Another approach shifts training to L2. The first fully on-chain decentralized learning framework uses a Proof-of-Improvement (PoIm) protocol: model updates propagate to L1 only if at least one metric improves without degrading others [^claim_2260]. Inference for logistic regression, SVMs, MLPs, CNNs, and gated RNNs is made gas-bounded and bit-exact via quantization and loop-unrolling proven in Z3.
On the agent side, Moonlight’s review formalizes a six-stage Agent Action Pipeline—Observe → Interpret → Decide → Construct Intent → Validate Policy → Execute Transaction—with Transaction Intent Schema (TIS) and Policy Decision Record (PDR) as standardized interfaces [^claim_2261]. CARV’s D.A.T.A. Framework gives agents real-time on-chain activity alerts, autonomous actions like airdrops and token transfers, and cross-chain insights under an attestation-based data integrity layer [^claim_2262].
The ZKML compiler from ACM automates the entire pipeline from TensorFlow models to zk-SNARK circuits, covering state-of-the-art vision models and a distilled GPT-2 [^claim_2264]. No manual circuit engineering required.
Crypto implications: DeFi protocols can now verify ML-driven risk models on-chain without trusting a centralized oracle. MEV protection agents can prove their inference was correct. Agent-to-agent markets can pay for provably correct inferences rather than opaque APIs. The tooling is production-ready for small-to-medium models; the next frontier is scaling to larger LLMs with acceptable overhead.
What to watch: Adoption of PoIm for L2 training pipelines, gas benchmarks for on-chain verification of transformer proofs, and integration of TIS/PDR into major agent frameworks.
Provenance ledger
10 claims web-citedEvery claim below cites a source URL, and each URL was checked for validity before publish. The excerpt shown is the researcher's own summary of the page — it is not re-derived from the source, so it is not a verified verbatim quote. Follow the link to confirm any claim against the original. Citation markers in the text jump here.
[1] zkPyTorch can generate a zero-knowledge proof for VGG-16 inference in 2.2 seconds, representing a reduction in zkML overhead from earlier estimates of around 1,000,000× to around 10,000× compared to native inference. web-cited
“In 2025, ZKML is still expensive. The overhead is real. But the overhead is getting better (1,000,000x → 100,000x → 10,000x) and the value proposition is getting clearer. zkPyTorch dropped in March 2025 and suddenly you can prove VGG-16 inference in 2.2 seconds.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[2] Lagrange Labs’ DeepProve is a zkML inference framework that introduces a new GKR-with-sum-check based proof system specialized for neural network circuits, achieving major speedups for large transformer and LLM inference compared to prior systems like Ezkl, and has been used to generate a complete GPT‑2 proof. web-cited
“DeepProve by Lagrange Labs is a state-of-the-art zkML inference framework focused on speed and scalability. Launched in 2025, DeepProve introduced a new proof system that is dramatically faster than previous solutions like Ezkl. Its design centers on the interactive GKR proof protocol with sum-check and specialized optimizations for neural network circuits.” and “Lagrange DeepProve achieves major speedups over EZKL for transformer architectures and generated the first complete GPT-2 proof (ICME
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[3] Ezkl, built on the Halo2 proving system (a PLONK-style SNARK over BLS12-381), has been used by Modulus Labs to verify an 18-million-parameter neural network model on-chain using zk-SNARKs, and in 2026 is considered the most production-ready zkML library for DeFi scoring/oracle models under 18M parameters due to significantly lower memory usage and faster performance than Risc0 for small-to-medium networks. web-cited
“The traditional approach to zkML uses zk-SNARKs… Ezkl (by ZKonduit/Modulus Labs) is a leading example of this approach. It builds on the Halo2 proving system (a PLONK-style SNARK with polynomial commitments over BLS12-381)… Notably, projects like Modulus Labs demonstrated verifying an 18-million-parameter model on-chain using SNARKs (with heavy optimization).” and “EZKL (Halo2-based) is the most production-ready for small-to-medium neural networks: it is significantly faster than Risc0 and uses
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[4] Brevis’s Pico v1.0 is a zero-knowledge virtual machine designed as a modular zkVM and ‘zk data coprocessor’ that executes arbitrary off-chain computations on historical and cross-chain data and returns succinct proofs that can be cheaply verified by smart contracts on Ethereum and other chains, effectively extending L1s with a general-purpose verifiable compute layer. web-cited
“Brevis has introduced Pico v1.0, a zero-knowledge virtual machine (zkVM) designed for modular and flexible verifiable computing… Brevis is an efficient, verifiable off-chain computation engine that brings limitless computation capacity to existing smart contract blockchains. Utilizing zero-knowledge proofs, Brevis offloads data-intensive, costly computations from on-chain environments to a drastically lower-cost off-chain engine, and empowers Web3 applications to scale seamlessly while preservi
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] VeriLLM is a publicly verifiable, decentralized LLM inference framework built on a blockchain substrate that uses on-chain verification contracts plus off-chain computation and Merkle proof generation; it submits only compact digests, VRF proofs, and sampled Merkle openings on-chain to keep verification overhead low and compatible with real-time inference. web-cited
“VeriLLM is a publicly verifiable, decentralized inference framework for large language models (LLMs) built atop a blockchain substrate. The system targets three objectives: publicly auditable correctness, low verification overhead compatible with real-time inference, and transparent incentive enforcement via smart contracts… To achieve these goals, VeriLLM consists of… on-chain verification contracts… To reduce gas costs, VeriLLM adopts a two-tier design: computation and Merkle proof generation
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[6] The ‘On-Chain Decentralized Learning and Cost-Effective Inference for DeFi Attack Mitigation’ framework implements the first fully on-chain decentralized learning system where gas-prohibitive training is shifted to a Layer‑2, model updates are propagated to Layer‑1 only when a Proof-of-Improvement (PoIm) shows at least one metric (accuracy, F1, precision, or recall) improves without degrading others, and inference for logistic regression, SVMs, MLPs, CNNs, and gated RNNs is made gas-bounded and bit-exact to off-chain versions via quantization and loop-unrolling proven in Z3. web-cited
“We present the first decentralized, fully on-chain learning framework that: (i) performs gas-prohibitive computation on Layer-2 to reduce cost, (ii) propagates verified model updates to Layer-1, and (iii) enables gas-bounded, low-latency inference inside smart contracts. A novel Proof-of-Improvement (PoIm) protocol governs the training process and verifies each decentralized micro update as a self-verifying training transaction. Updates are accepted by PoIm only if they demonstrably improve at
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] The Moonlight ‘Autonomous Agents on Blockchains’ review formalizes a six-stage Agent Action Pipeline for on-chain agents (Observe → Interpret → Decide → Construct Intent → Validate Policy → Execute Transaction) and introduces two interface abstractions, the Transaction Intent Schema (TIS) and Policy Decision Record (PDR), to standardize goal specification and auditable policy enforcement at the point where agents submit transactions to blockchain execution environments. web-cited
“1. The Agent Action Pipeline: A six-stage model for transforming observed state into an irreversible state transition… Observe (state acquisition)… The Transaction Intent Schema (TIS) and Policy Decision Record (PDR) are proposed as foundational interface abstractions to standardize unambiguous goal specification and auditable policy enforcement across complex, high-stakes agent-blockchain interactions.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[8] CARV’s D.A.T.A (Data Authentication, Trust, and Attestation) framework provides AI agents with real-time on-chain activity alerts, supports autonomous actions such as airdrops and token transfers, and aggregates cross-chain insights by combining on-chain and off-chain data under an attestation-based data integrity layer. web-cited
“CARV… unveils its D.A.T.A Framework to transform how AI agents interact with both on-chain and off-chain data… By solving these critical challenges, the D.A.T.A Framework – Data Authentication, Trust, and Attestation – delivers real-time decision-making capabilities while maintaining rigorous privacy and security standards… In the first phase, D.A.T.A. Framework will introduce real-time on-chain activity alerts, autonomous actions such as airdrops and token transfers, and comprehensive cross-ch
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] The 2026 zkML verifiable inference architecture survey describes that Ethereum smart contracts can efficiently verify zk-SNARK-based ML proofs using BLS12-381 pairing precompiles, and positions three stacks—Ezkl (Halo2-based SNARK circuits), Lagrange DeepProve (GKR-based neural net prover), and SP1 (zkVM)—as the primary toolchains enabling trust-minimized on-chain AI inference, each with different trade-offs in memory usage, model type support, and generality. web-cited
“Smart contracts can include verification logic to check the proof, often using precompiled cryptographic primitives. For example, Ethereum has precompiles for BLS12-381 pairing operations used in many zk-SNARK verifiers, making on-chain verification of SNARK proofs efficient… How zkML proof systems (EZKL, Lagrange DeepProve, SP1) enable trust-minimised on-chain AI inference. Architecture, benchmarks, and build guide for 2026… EZKL (Halo2-based)… Risc0 suits general-purpose zkVM workloads in Rus
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[10] The ZKML optimizing system (ACM paper) compiles TensorFlow models into zk-SNARK circuits and produces proofs for state-of-the-art vision models and a distilled GPT‑2, providing an automated pipeline from high-level ML graphs to constraint systems to enable realistic on-chain or rollup-verified ML inference without manual circuit engineering. web-cited
“In this work, we present the first framework, ZKML, to produce ZK-SNARKs for realistic ML models, including state-of-the-art vision models, a distilled GPT-2… To do so, we build ZKML, an optimizing compiler that transforms TensorFlow models to ZK-SNARK circuits.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://blog.icme.io/the-definitive-guide-to-zkml-2025/
- https://blockeden.xyz/blog/2025/04/22/verifiable-on-chain-ai-with-zkml-and-cryptographic-proofs
- https://markets.businessinsider.com/news/currencies/brevis-unveils-pico-the-next-generation-of-zkvms-1034342617
- https://arxiv.org/html/2509.24257v4
- https://arxiv.org/abs/2510.16024
- https://www.themoonlight.io/tw/review/autonomous-agents-on-blockchains-standards-execution-models-and-trust-boundaries
- https://www.the-blockchain.com/2025/01/22/carv-launches-d-a-t-a-framework-giving-ai-agents-eyes-and-ears-with-on-chain-and-off-chain-data/
- https://dl.acm.org/doi/pdf/10.1145/3627703.3650088