# Scaling up Trustless DNN Inference with Zero-Knowledge Proofs

arXiv: https://arxiv.org/abs/2210.08674 · HTML: https://mlsanity.com/paper/2210.08674/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 54 references that are in the map.
- First posted on arXiv 17 Oct 2022.

## Builds on (most cited first, 11 of 11)

- [MobileNetV2: Inverted Residuals and Linear Bottlenecks](https://mlsanity.com/paper/1801.04381/) (2018)
- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [CrypTen: Secure Multi-Party Computation Meets Machine Learning](https://mlsanity.com/paper/2109.00984/) (2021)
- [CrypTFlow: Secure TensorFlow Inference](https://mlsanity.com/paper/1909.07814/) (2019)
- [SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted Cloud](https://mlsanity.com/paper/1706.10268/) (2017)
- [DeepReDuce: ReLU Reduction for Fast Private Inference](https://mlsanity.com/paper/2103.01396/) (2021)
- [HEMET: A Homomorphic-Encryption-Friendly Privacy-Preserving Mobile Neural Network Architecture](https://mlsanity.com/paper/2106.00038/) (2021)
- [pvCNN: Privacy-Preserving and Verifiable Convolutional Neural Network Testing](https://mlsanity.com/paper/2201.09186/) (2022)
- [Time-Optimal Interactive Proofs for Circuit Evaluation](https://mlsanity.com/paper/1304.3812/) (2013)
- [Privacy-Preserving Video Classification with Convolutional Neural Networks](https://mlsanity.com/paper/2102.03513/) (2021)
- [Tabula: Efficiently Computing Nonlinear Activation Functions for Secure Neural Network Inference](https://mlsanity.com/paper/2203.02833/) (2022)

## Built on by (most cited first, 30 of 31)

- [Hybrid LLM: Cost-Efficient and Quality-Aware Query Routing](https://mlsanity.com/paper/2404.14618/) (2024)
- [zkLLM: Zero Knowledge Proofs for Large Language Models](https://mlsanity.com/paper/2404.16109/) (2024)
- [A Survey of Zero-Knowledge Proof Based Verifiable Machine Learning](https://mlsanity.com/paper/2502.18535/) (2025)
- [zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Training](https://mlsanity.com/paper/2307.16273/) (2023)
- [Zero-Knowledge Proof-based Verifiable Decentralized Machine Learning in Communication Network: A Comprehensive Survey](https://mlsanity.com/paper/2310.14848/) (2023)
- [GrOVe: Ownership Verification of Graph Neural Networks using Embeddings](https://mlsanity.com/paper/2304.08566/) (2023)
- [Verifiable evaluations of machine learning models using zkSNARKs](https://mlsanity.com/paper/2402.02675/) (2024)
- [Trustless Audits without Revealing Data or Models](https://mlsanity.com/paper/2404.04500/) (2024)
- [FairProof : Confidential and Certifiable Fairness for Neural Networks](https://mlsanity.com/paper/2402.12572/) (2024)
- [Cooperative AI via Decentralized Commitment Devices](https://mlsanity.com/paper/2311.07815/) (2023)
- [Optimistic Verifiable Training by Controlling Hardware Nondeterminism](https://mlsanity.com/paper/2403.09603/) (2024)
- [ExpProof : Operationalizing Explanations for Confidential Models with ZKPs](https://mlsanity.com/paper/2502.03773/) (2025)
- [A Framework for Cryptographic Verifiability of End-to-End AI Pipelines](https://mlsanity.com/paper/2503.22573/) (2025)
- [ZKPROV: A Zero-Knowledge Approach to Dataset Provenance for Large Language Models](https://mlsanity.com/paper/2506.20915/) (2025)
- [ZK-APEX: Zero-Knowledge Approximate Personalized Unlearning with Executable Proofs](https://mlsanity.com/paper/2512.09953/) (2025)
- [Zero knowledge verification for frontier AI training is possible](https://mlsanity.com/paper/2606.05433/) (2026)
- [Contextual Confidence and Generative AI](https://mlsanity.com/paper/2311.01193/) (2023)
- [Self-Supervised Inference of Agents in Trustless Environments](https://mlsanity.com/paper/2409.08386/) (2024)
- [VeriLoRA: Fine-Tuning Large Language Models with Verifiable Security via Zero-Knowledge Proofs](https://mlsanity.com/paper/2508.21393/) (2025)
- [PrivaDE: Privacy-preserving Data Evaluation for Blockchain-based Data Marketplaces](https://mlsanity.com/paper/2510.18109/) (2025)
- [Device-Native Autonomous Agents for Privacy-Preserving Negotiations](https://mlsanity.com/paper/2601.00911/) (2026)
- [VOW: Verifiable and Oblivious Watermark Detection for Large Language Models](https://mlsanity.com/paper/2604.27666/) (2026)
- [Verifiable Provenance and Watermarking for Generative AI: An Evidentiary Framework for International Operational Law and Domestic Courts](https://mlsanity.com/paper/2605.21002/) (2026)
- [Fortytwo: Swarm Inference with Peer-Ranked Consensus](https://mlsanity.com/paper/2510.24801/) (2025)
- [EigenAI: Deterministic Inference, Verifiable Results](https://mlsanity.com/paper/2602.00182/) (2026)
- [TensorCommitments: A Lightweight Verifiable Inference for Language Models](https://mlsanity.com/paper/2602.12630/) (2026)
- [Zero-Knowledge Federated Learning with Lattice-Based Hybrid Encryption for Quantum-Resilient Medical AI](https://mlsanity.com/paper/2603.03398/) (2026)
- [Towards Verifiable AI with Lightweight Cryptographic Proofs of Inference](https://mlsanity.com/paper/2603.19025/) (2026)
- [Integrity of peer-to-peer distributed LLM inference under malicious nodes](https://mlsanity.com/paper/2607.19490/) (2026)
- [Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification](https://mlsanity.com/paper/2607.21839/) (2026)

## Abstract (arXiv)

As ML models have increased in capabilities and accuracy, so has the complexity of their deployments. Increasingly, ML model consumers are turning to service providers to serve the ML models in the ML-as-a-service (MLaaS) paradigm. As MLaaS proliferates, a critical requirement emerges: how can model consumers verify that the correct predictions were served, in the face of malicious, lazy, or buggy service providers? In this work, we present the first practical ImageNet-scale method to verify ML model inference non-interactively, i.e., after the inference has been done. To do so, we leverage recent developments in ZK-SNARKs (zero-knowledge succinct non-interactive argument of knowledge), a form of zero-knowledge proofs. ZK-SNARKs allows us to verify ML model execution non-interactively and with only standard cryptographic hardness assumptions. In particular, we provide the first ZK-SNARK proof of valid inference for a full resolution ImageNet model, achieving 79% top-5 accuracy. We further use these ZK-SNARKs to design protocols to verify ML model execution in a variety of scenarios, including for verifying MLaaS predictions, verifying MLaaS model accuracy, and using ML models for trustless retrieval. Together, our results show that ZK-SNARKs have the promise to make verified ML model inference practical.