Proving AI Honesty: A New Era of Verifiable Inference

Author: Denis Avetisyan

Researchers have developed a system to cryptographically verify that large language models are producing correct and trustworthy outputs.

The DeepSeek inference pipeline anticipates eventual fragility through its layered architecture, acknowledging that each component introduced increases the surface area for future, inevitable failure.

This work presents a framework for zero-knowledge proof-based verification of large language model inference, demonstrated with a fully verifiable version of DeepSeek-V3.

Despite the increasing prevalence of deep learning, verifying the correctness of AI inference remains challenging due to the proprietary nature of model parameters. This paper introduces a novel framework for Zero-Knowledge Proof Based Verifiable Inference of Models, enabling verification without revealing those sensitive internals. By leveraging recursively composed zero-knowledge proofs and constructing succinct non-interactive arguments of knowledge (zkSNARKs), we demonstrate a fully SNARK-verifiable version of the DeepSeek model-ZK-DeepSeek-supporting both linear and nonlinear layers. Could this approach unlock a new era of trustworthy and transparent AI systems, particularly for large language models?

The Inevitable Plateau: Scaling Beyond Capacity

Recent advancements in large language models, exemplified by models like DeepSeek-V3, have showcased an impressive capacity for generating human-quality text and performing various language-based tasks. However, simply increasing the number of parameters – a strategy known as scaling – is yielding progressively smaller gains when confronted with genuinely complex reasoning challenges. While larger models often exhibit improved performance on benchmark datasets, these improvements frequently plateau, indicating that scale alone cannot unlock true intelligence. The models struggle with tasks requiring abstract thought, common sense, or the ability to generalize knowledge to novel situations, suggesting a fundamental limitation in their current architecture and training methodologies. This diminishing return on investment highlights the necessity for innovative approaches beyond mere parameter expansion to achieve more robust and adaptable artificial intelligence.

The very mechanism that empowers large language models – the attention mechanism within transformer networks – is increasingly becoming a computational bottleneck. While enabling the model to weigh the importance of different input tokens, attention’s demand for resources grows quadratically with sequence length, meaning doubling the input text more than quadruples the processing required. This poses a substantial hurdle to analyzing lengthy documents or engaging in extended dialogues, limiting the “context window” and hindering deeper reasoning. Researchers are actively exploring methods to approximate attention, employ sparse attention patterns, or develop entirely new architectures that can process information more efficiently, as simply adding more computing power will not sustainably address this fundamental limitation in scaling intelligence.

The pursuit of artificial general intelligence necessitates a shift beyond simply increasing the scale of current large language models. While adding more parameters – the trainable variables within a neural network – initially improves performance, this approach quickly encounters diminishing returns when tackling complex reasoning and nuanced understanding. The limitations stem not from a lack of data or computational power, but from the inherent inefficiencies in how these models process information and represent knowledge. Truly intelligent systems will likely require architectural innovations that move beyond the transformer’s reliance on attention mechanisms, exploring alternative approaches to computation – such as state-space models or neuromorphic computing – and developing more compact, symbolic, or hierarchical methods for knowledge representation, allowing for reasoning and generalization beyond pattern matching. This focus on efficiency and representation promises a path toward artificial intelligence that is not merely larger, but genuinely more intelligent.

The Cryptographic Seal: Verifiable Computation with Zero-Knowledge Proofs

Zero-Knowledge Proofs (ZKPs) represent a fundamental shift in computational verification by decoupling the process of proving knowledge from revealing the knowledge itself. Traditionally, proving the validity of a computation requires disclosing all input data and the computational steps taken. ZKPs, however, allow a ‘prover’ to convince a ‘verifier’ that a statement is true without conveying any information beyond the truth of the statement. This is achieved through cryptographic protocols where the prover demonstrates possession of a solution without revealing the solution itself. The core principle relies on probabilistic verification; the verifier performs a series of tests, and the probability of a dishonest prover successfully convincing the verifier decreases exponentially with each test. This allows for verification of complex computations – such as those found in machine learning or blockchain applications – while preserving data privacy and computational integrity, as only the validity of the result is confirmed, not the underlying data or process.

Succinct Non-interactive ARguments of Knowledge (SNARKs) are a class of zero-knowledge proofs distinguished by their small proof size and rapid verification times. Unlike traditional proofs which grow linearly with the complexity of the computation, SNARKs utilize cryptographic techniques to compress the proof into a constant size, typically a few hundred bytes, regardless of the underlying computational task. Verification can then be completed in milliseconds, even for extremely complex computations. This efficiency is achieved through a process of transforming the computation into a mathematical circuit and employing techniques like quadratic arithmetic programs (QAPs) and pairing-based cryptography. Consequently, SNARKs are particularly well-suited for scaling machine learning workloads by reducing the communication and computational burden associated with verifying model integrity and inference results, especially in distributed or outsourced computing environments.

The integration of Zero-Knowledge Proofs (ZKPs) with large language models (LLMs) enables the outsourcing of computationally intensive tasks to external, potentially untrusted, parties while maintaining data privacy and ensuring computational integrity. This is achieved by having the LLM perform computations off-chain and then generating a ZKP that verifies the correctness of the result without revealing the input data or the computational steps. The ZKP, typically much smaller than the original computation and data, is then submitted for verification. Successful verification guarantees that the outsourced computation was performed correctly, even if the computing party is malicious or compromised. This approach facilitates distributed AI systems, reduces computational burdens on individual machines, and allows for privacy-preserving machine learning applications where sensitive data cannot be directly shared with a computing service.

Efficiency Through Constraint: Optimizing Models for ZKP Verification

zkVC, or Zero-Knowledge Vector Commitment, optimizes matrix multiplication within Zero-Knowledge Proof (ZKP) circuits by decomposing the operation into a series of smaller, verifiable commitments. Traditional matrix multiplication involves a substantial number of multiplications and additions, all of which require cryptographic operations within the ZKP context. zkVC reduces this complexity by representing matrix elements as commitments to vectors, enabling verification of the multiplication result through commitment openings and range proofs instead of directly proving each individual multiplication. This approach significantly lowers the number of constraints required in the ZKP circuit, resulting in faster proof generation and verification times, particularly for large matrices commonly found in machine learning models. The computational savings stem from replacing complex arithmetic with commitment and opening operations, which are inherently more efficient within the ZKP framework.

Employing integer arithmetic and quantization within machine learning models designed for Zero-Knowledge Proofs (ZKPs) reduces computational complexity and associated costs. Floating-point operations, while standard in many models, are significantly more expensive to execute within ZKP circuits than integer operations. Quantization, the process of reducing the precision of numerical values, further simplifies these calculations by limiting the range of possible values. This reduction in computational load directly translates to decreased proof generation and verification times, and lowers the resource requirements-such as circuit size and number of constraints-necessary for successful ZKP implementation. Specifically, representing weights and activations with lower-precision integers, such as 8-bit or 16-bit integers, can yield substantial performance gains without significant loss of model accuracy.

Efficient lookup tables and hashing algorithms are critical for reducing computational cost within Zero-Knowledge Proof (ZKP) circuits. Traditional arithmetic operations on large datasets can be replaced with table lookups, which have a fixed, lower cost. Specifically, implementing functions as lookup tables allows the ZKP circuit to replace complex calculations with simple memory accesses. Hashing algorithms, particularly those optimized for ZKP-SNARKs, enable efficient constraint evaluation by reducing the number of gates required for computations like equality checks. The use of techniques such as range proofs, implemented with efficient hashing, significantly reduces the size of the circuit and thus lowers both proof generation and verification times, minimizing overall overhead and improving scalability.

Kimchi is a modern proving system designed for efficient Zero-Knowledge Proof (ZKP) generation, built as an implementation of the PLONK universal setup. It leverages techniques such as FFT-based polynomial commitment and utilizes a streamlined proving process, reducing both proof generation and verification times. A key benefit of Kimchi is its compatibility with Recursive Proof Composition, allowing multiple computations to be proven within a single, aggregated proof. This recursive capability significantly reduces proof size and improves scalability by amortizing the cost of the initial setup across numerous computations, resulting in a logarithmic increase in efficiency as the number of recursive steps increases. Furthermore, Kimchi’s design focuses on minimizing the trusted setup requirements, enhancing its security profile and usability in practical applications.

The image illustrates the multiplication operation within the context of the Constrained Roto-Translation Policy Component (CRPC).

The Emerging Ecosystem: DeepSeek-V3 and the Promise of Efficient Verification

DeepSeek-V3 achieves substantial gains in model capacity through the implementation of a Mixture-of-Experts (MoE) architecture. Unlike traditional dense models where every parameter is engaged for every input, MoE strategically activates only a subset of parameters – the “experts” – based on the specific input. This selective activation dramatically reduces the computational burden; while the total number of parameters can be significantly increased, the actual computation required for each forward pass remains manageable. Essentially, the model expands its potential knowledge base without experiencing a corresponding increase in processing demands, enabling the creation of larger, more capable models with improved efficiency and scalability. This approach allows DeepSeek-V3 to perform complex tasks with greater nuance and accuracy compared to models of similar computational cost.

The architecture of DeepSeek-V3 doesn’t simply rely on scaling model size; it actively addresses the challenges that arise with increased complexity. Integrating Mixture-of-Experts (MoE) – a technique that selectively activates parts of the network for each input – can introduce instability during training. To counteract this, the model employs RMSNorm, a normalization layer proven to stabilize learning by controlling the variance of activations. Simultaneously, RoPE – Rotary Positional Embeddings – enhance the model’s ability to understand the order of elements in sequential data, improving performance on tasks requiring contextual awareness. This combination effectively tames the inherent complexities of MoE, allowing DeepSeek-V3 to benefit from increased capacity without sacrificing training stability or overall performance, and leading to a more robust and capable large language model.

The practical implementation of large-scale models hinges on computational efficiency, and DeepSeek-V3 significantly benefits from the strategic use of BF16 precision and GPU acceleration. By employing BF16, a 16-bit floating-point format, the model reduces memory footprint and accelerates matrix operations compared to traditional 32-bit floating-point representations, without substantial loss of accuracy. This, combined with the inherent parallelism of modern GPUs, dramatically speeds up both the computationally intensive training phase and the subsequent inference process. The result is a system capable of handling models with billions of parameters, making previously impractical research and applications-such as advanced natural language processing and complex data analysis-increasingly feasible and accessible for a wider range of users and organizations.

The integration of architectural optimizations with a Zero-Knowledge Proof (ZKP) framework has enabled the creation of a fully SNARK-verifiable large language model, opening doors to applications demanding enhanced privacy and security. This process, exemplified by DeepSeek-V3, necessitated a significant increase in model size-reaching 2.5 terabytes compared to the original 680 gigabytes-primarily due to the quantization required for efficient SNARK verification. While increasing storage demands, this quantization is crucial for compressing the computational graph, allowing it to be succinctly proven and verified without revealing the underlying data or model parameters. Consequently, this technology facilitates secure computation and inference, enabling applications like privacy-preserving machine learning, verifiable AI services, and trusted execution of complex models in sensitive domains without compromising confidentiality or integrity.

The diagram illustrates the dataflow within the Mixture of Experts (MoE) model.

Beyond Trust, Towards Accountability: The Future of Verifiable AI

A transformative shift in artificial intelligence is underway, driven by the convergence of powerful large language models with the cryptographic assurance of zero-knowledge proofs and advancements in computational efficiency. This synergy allows for the creation of AI systems capable of not only performing complex tasks but also demonstrably proving the correctness of their outputs without revealing the underlying data or model parameters. Such a capability is achieved by leveraging ZKPs to verify computations performed by the language model, effectively creating a ‘seal of approval’ for each result. The integration of efficient computational techniques is essential to make this verification practical, addressing the significant processing demands inherent in both large models and cryptographic protocols. This new generation of AI promises to unlock applications requiring heightened trust and privacy, spanning from secure financial transactions and confidential healthcare diagnostics to robust cybersecurity systems and beyond.

The advent of verifiable artificial intelligence promises a paradigm shift in how complex computations are handled, particularly within sensitive domains. These emerging systems leverage cryptographic techniques to guarantee not only the accuracy of results but also the privacy of the underlying data used to achieve them. In finance, this means fraud detection and algorithmic trading could be executed with provable integrity, safeguarding assets and building trust. Healthcare applications benefit from secure analysis of patient data without compromising confidentiality, enabling personalized medicine and improved diagnostics. Furthermore, in cybersecurity, verifiable AI can enhance threat detection and response systems, ensuring the reliability of defenses against malicious actors. This convergence of guaranteed correctness and data privacy unlocks previously unattainable levels of security and reliability, fostering broader adoption and responsible innovation across critical infrastructure and data-driven industries.

Advancing verifiable artificial intelligence beyond its current capabilities necessitates dedicated investigation into architectural designs specifically optimized for zero-knowledge proofs (ZKPs). Current computational bottlenecks, particularly within components like wkv_a1, RoPE1, and softmax_qk, highlight the need for streamlined operations and reduced computational overhead during the verification process. Researchers are focusing on developing ZKP-friendly building blocks – neural network layers and activation functions engineered for efficient proof generation and verification – alongside exploring techniques like proof aggregation and partitioning to manage the increasing complexity of larger models. Successfully scaling these systems requires not only algorithmic improvements but also hardware acceleration and novel data structures tailored for ZKP computations, ultimately paving the way for trustworthy and efficient AI applications capable of handling real-world challenges.

Current efforts to verify the integrity of large language models reveal substantial computational hurdles. Analysis of a recent implementation demonstrates that establishing proof of correctness is not a trivial undertaking; the $wkv\_a1$ component alone requires over 204,138 seconds for verification, significantly exceeding the time needed for other key operations like RoPE1 at 19,275 seconds and softmax_qk at 39,456 seconds. These figures underscore the demanding nature of verifiable AI, highlighting the need for innovative techniques to reduce proving times and enable practical, trustworthy deployment of increasingly complex models.

The pursuit of verifiable artificial intelligence promises a fundamental shift in how society interacts with and relies upon these powerful technologies. By enabling rigorous, cryptographic proof of an AI’s computations and outputs, verifiable AI systems address critical concerns surrounding trust and accountability. This isn’t merely about confirming that an AI reached a conclusion, but demonstrating how it arrived at that result, ensuring adherence to specified parameters and preventing manipulation or unintended biases. Such transparency isn’t simply a technical achievement; it’s a prerequisite for widespread adoption across sensitive sectors like finance and healthcare, where verifiable correctness is paramount. Ultimately, the ability to confidently validate AI’s reasoning will unlock its full potential, fostering public trust and paving the way for beneficial societal integration, while mitigating the risks associated with opaque ‘black box’ algorithms.

The pursuit of verifiable inference, as demonstrated by this framework utilizing zero-knowledge proofs, inherently acknowledges the limitations of absolute certainty. The system doesn’t prevent errors-it merely provides cryptographic evidence of their absence, or presence, at a specific point in computation. This mirrors a fundamental truth about complex systems: stability is merely an illusion that caches well. Donald Davies observed, “A system’s value lies not in its perfection, but in its resilience.” This paper’s exploration of recursive proof composition to manage constraint complexity isn’t about achieving flawless AI, but about building a system capable of gracefully handling inevitable imperfections-a system that reveals its failures rather than concealing them. The framework accepts chaos-it doesn’t attempt to eliminate it-and turns it into demonstrable, verifiable data.

What Lies Ahead?

The pursuit of verifiable computation for large language models feels less like engineering and more like an exercise in applied regret. This work, demonstrating verification via zero-knowledge proofs, merely clarifies the scale of the compromises already embedded within these systems. Each constraint formalized, each recursion composed, is a prediction of future brittleness. The elegance of SNARKs should not be mistaken for resilience; it simply relocates the points of failure, rendering them more difficult, not impossible, to diagnose.

The true challenge isn’t scaling the proofs – though that remains a considerable hurdle – but accepting the inherent limitations of formal verification. Technologies change, dependencies remain. A verified DeepSeek-V3 today offers no guarantee against the emergent behaviors of its successor. The focus will inevitably shift from proving what a model does to understanding how it fails, and anticipating those failures before they manifest as widespread consequences.

One anticipates a future where “trustworthy AI” isn’t about mathematical certainty, but about auditable lineage and graceful degradation. The architecture isn’t structure – it’s a compromise frozen in time. The field will need to embrace methods for continuous monitoring, runtime anomaly detection, and, ultimately, accepting that complete control over these complex systems is a comforting illusion.

Original article: https://arxiv.org/pdf/2511.19902.pdf

Contact the author: https://www.linkedin.com/in/avetisyan/