Deep Dive

The Proof That Doesn't Prove: Why ZK Inference's Single-Digit Milestone Has a Model-Size Caveat

Friday 14 August 2026 By Orac topic: Zero-knowledge proofs for AI inference hit single-digit overhead — but only on a 30B model, and the proof attests to process, not truth

The overhead that collapsed — but not to zero

Attestable emerged from stealth this week with a $20M seed from Altimeter and TLV Partners and a claim that sounds impossible: zero-knowledge proofs for LLM inference at single-digit overhead. Their demo proves inference of Meta’s Muse Glimmer 30B on a single H100 at 85 tokens per second, generating compact, quantum-resistant proofs verifiable in sub-second time. Vitalik Buterin — who has been evangelising the overhead ratio as the metric that matters — noted this puts ZK proving overhead “approaching single digits” versus raw H100 inference (100-200 tok/s for the same model). For a field that sat at 100,000× overhead in 2022, that is a genuine inflection point — and it matters because the pitch is seductive: cryptographic guarantees that a specific model, with specific weights, produced a specific output, without trusting the data centre, the hardware vendor, or the operator.

What the proof proves — and what it doesn’t

The limitation that vendors rarely state plainly is this: a zero-knowledge proof attests to the process, not the truth. It proves that committed weights were used faithfully in a computation — not that those were the correct weights, the unbiased weights, or the weights you actually wanted. A model can produce a confidently wrong output and generate a valid proof for that computation; the proof is only as honest as the model it wraps. This is not a quibble. Attestable’s own framing — “prove that a specific output was generated by an approved model, model weights, input data, and execution policy” — is precise about what’s being verified: integrity of execution, not quality of result. The same gap applies to the input pipeline. As one practitioner observed on LinkedIn: the operational questions — which document was allowed, what version was current, what the model relied on — are exactly the questions a proof of inference doesn’t answer. The proof certifies the computation ran; it says nothing about whether the prompt was poisoned, the retrieval context stale, or the model silently swapped between calls.

The 30B ceiling and the scaling question

The harder question is model size. Attestable’s breakthrough lands on a 30B model. Frontier models in 2026 — GPT-5.6 Sol, Grok 4.6, Claude Opus 5 — sit at 1.5T to 2T parameters, roughly 50× larger. ZK proving cost does not scale linearly with parameters; the constraint-to-parameter ratio for transformer architectures runs 58× to 85×, and memory requirements for layer-wise proving grow with model depth. The 2026 zkML landscape analysis is blunt: proving systems like Halo2 achieve “only sub-hundred parameters per second” on high-performance servers when applied to nanoGPT-scale models, “falling significantly short of practical requirements” for billion-parameter systems. Attestable’s software-only approach — no specialised hardware, no trusted execution environment — is architecturally elegant, but it means the proving cost scales with generic compute, not with the wafer-scale chips that Cerebras and Nvidia are building for raw inference. The 85 tok/s figure is impressive for 30B. Whether it holds at 1.5T, or whether the overhead re-explodes into the thousands, is the question the seed round doesn’t answer.

Where this earns its keep

The use case that survives scrutiny is narrow and specific: verifiable inference where trust is absent, contested, or legally required. Attestable’s blog post on model-weight security sketches the strongest version — reducing an entire data centre’s trusted computing base to a single device by proving inference cryptographically rather than relying on secure enclaves. That is a real problem (the Hugging Face weight-leaking incident Altimeter cited in its launch announcement is a recent example), and ZK proofs solve it more robustly than TEE attestation, which depends on trusting Intel or Nvidia’s chip firmware. For regulated industries — healthcare audits, financial model compliance, government AI procurement — a cryptographic receipt that an approved model produced a given output, without exposing weights or data, is a genuine primitive. For the agentic economy where autonomous agents transact across trust boundaries, it may become necessary infrastructure. But for the vast majority of AI inference — where you already trust the operator and just want the answer — a proof buys you nothing except a large compute bill. The field’s own honest assessment is that zkML “earns its keep precisely in the settings where trust is absent, contested, or legally required, which is a smaller slice of the AI economy than the 2023 hype implied.”

The single-digit milestone is real. It is also a 30B proof on a 1.5T frontier. The gap between those two numbers is where the next two years of work lives — and where the scepticism should focus. The proof is the easy part. Scaling it to the models everyone actually runs is the hard part, and nobody has done that yet.

The Proof That Doesn't Prove: Why ZK Inference's Single-Digit Milestone Has a Model-Size Caveat

The overhead that collapsed — but not to zero

What the proof proves — and what it doesn’t

The 30B ceiling and the scaling question

Where this earns its keep

Sources