zkML (Zero-Knowledge Machine Learning) is the use of zero-knowledge proofs to show that a machine-learning model produced a particular output from a particular input, without the verifier re-running the model and, if desired, without revealing the model's weights or the input data. Its main audience is blockchain developers who want a smart contract to act on an AI result it can trust, and researchers working on verifiable or private AI.
zkML sits at the meeting point of cryptography and artificial intelligence. It applies the same proving systems used by ZK-rollups, usually a zk-SNARK, to neural-network inference. It is an early-stage field: as of 2026 it works for small and medium models but remains far too costly for today's largest language models. Its main alternative is opML, which relies on fraud challenges rather than proofs.
zkML in plain terms
Think of a sealed exam hall. A student claims a calculator gave a certain answer. Normally the examiner would have to borrow the calculator and type the sum again. With zkML, the student hands over a small, tamper-proof receipt that proves "this exact calculator, given this exact question, printed this exact answer", and the examiner can check the receipt in seconds.
The receipt can also keep secrets. The calculator's inner workings, which might be a company's valuable trained model, stay hidden, and so can the question, which might be someone's private medical or financial data. The examiner learns only that the answer is genuine.
How zkML works
A trained model is a long chain of mathematical operations: matrix multiplications, additions and activation functions. zkML tools translate that chain into an arithmetic circuit that a proving system can handle. The typical steps are:
- The developer trains a model in a standard framework such as PyTorch and exports it, often in the ONNX format.
- Because proof systems work with whole numbers in a finite field, the model's decimal weights are quantised into fixed-point integers, which can change outputs slightly.
- A compiler turns the quantised model into a circuit and generates proving and verification keys.
- For each inference, a prover runs the model and creates a proof; a verifier, which can be a contract on the EVM, checks it for a modest gas fee.
The best-known open-source toolkit is EZKL, maintained by Zkonduit, which converts ONNX models into circuits built on the Halo 2 proving system and can output a Solidity verifier. Other teams have built zkML systems on STARK-based provers and zero-knowledge virtual machines.
Uses and proposed applications
Most uses so far are pilots and research demonstrations rather than mass-market products. Proposed applications include:
- On-chain decisions. A DeFi lending protocol could adjust risk parameters from a model's output only if a valid proof accompanies it.
- Private credit and identity checks. A user could prove that a credit-scoring model approved them, or that a face-matching model recognised them, without sharing raw data. This links zkML to data-privacy goals.
- Model integrity. A service could prove it really used the model it advertised, rather than a cheaper substitute.
- Autonomous agents. Developers of AI agents that hold crypto wallets see proofs as a way to make agent decisions auditable.
- Fraud and compliance. Banks already use machine learning in fraud detection; zkML could in principle let one party prove a screening model was run without exposing the model to fraudsters.
Limitations
The main barrier is cost. Generating a proof is typically orders of magnitude slower than running the model normally, and memory needs grow quickly with model size, so large language models with billions of parameters are out of practical reach for full zkML as of 2026. Quantisation introduces small accuracy differences. A proof also says nothing about whether the model is fair, accurate or trained on good data; it only confirms that a specific computation was carried out. Finally, the toolchains are young and several are labelled as unaudited or experimental by their own maintainers.
zkML compared with other approaches
Three broad approaches to verifiable AI on blockchains are discussed in the literature:
- zkML. Gives mathematical certainty at proof time and can keep data private, but proving is expensive.
- opML. Assumes results are correct unless challenged within a dispute window, as an optimistic rollup does; it is cheaper and handles larger models but offers no privacy and finality is delayed.
- Trusted hardware. Runs models inside secure enclaves and relies on the chip maker's attestation, which is fast but adds trust in hardware vendors.
Hybrid designs, where sensitive parts of a model are proven with zkML and the rest is handled optimistically, have also been proposed. Data feeds that carry proofs, known as a zkOracle, use related techniques to bring verified data and computation to a blockchain oracle setting.