The mathematical foundations: signatures, commitments, MPC, FHE, and beyond.
Training Llama-3.1-8B costs ~$6M. The weights are free to clone. Perinucleus sampling embeds 24,576 distinct fingerprints per model with no quality loss — and a Poseidon ZK commitment registers ownership on-chain for $0.017, enforceable by smart contract.
Every zkSNARK bottoms out in a pairing check. Before Pectra you had BN254 at ~100-bit security. EIP-2537 added BLS12-381 at 128 bits, and its pairings are cheaper: 32,600k+37,700 vs 34,000k+45,000 gas. G2 MUL dropped from millions to 22,500 gas.
Nova replaces expensive SNARK-in-SNARK recursion with a random linear combination that folds two R1CS instances into one — 10× less overhead per step. For N-step AI inference: O(N) prover work, one constant-size final proof. NANOZK delivers this at GPT-2 scale: 6.9 KB, 23 ms verify.
BERT-base under FHE takes 149 seconds, needs 112 GB, and sustains 0.007 samples/sec. Best-case MPC takes 2.3 seconds and 4 GB. The gap traces to one operation: bootstrapping — the noise-refresh that makes FHE theoretically unlimited but practically expensive.
LLM non-determinism has been the blocker for output-based verification. DiFR commits to a random seed before inference — and activation fingerprints built from random orthogonal projections detect 4-bit quantization in just 2 tokens at AUC > 0.999.
A single cryptographic primitive — the KZG polynomial commitment — quietly powers EIP-4844 blobs, zkEVM proof systems, and on-chain verifiable AI. You can verify one on Ethereum for 50,000 gas ($0.067 today). Here's the math, the ceremony, and why every zkML system depends on it.
Every EIP-4844 blob is secured by a KZG polynomial commitment — 48 bytes committing to 128 KB, verifiable in 50,000 gas. That efficiency required 140,416 people to collectively bury a secret for 69 days. Here's the math, the ceremony, and why Ethereum chose a different scheme for state.
An AI agent holding a raw ECDSA key is one model compromise from total loss. FROST's two-round DKG means the full private key never exists anywhere — not during setup, not during signing. Here's the mechanism, the Ethereum gap, and how Lit Protocol PKPs deploy it today.
FRI-STARKs are fast and trustless, but their proofs are megabytes wide. Groth16 is 256 bytes but needs a ceremony. STARK→SNARK wrapping resolves the tension — and it's why SP1 and RISC Zero can settle any ML inference on L1 for under 300k gas.
Bitcoin burns ~150 TWh/yr on SHA-256 nonces that prove nothing. Komargodski & Weinstein showed a Freivalds randomisation check turns any matmul into a valid proof-of-work at only 3/(2N) overhead — the same GPU seconds train your model and mine the block.
Softmax costs 275 ZK constraints per element vs 4 for MatMul. ZK-DeepSeek proved Transformer inference is expressible in SNARKs. Lookup arguments (Lasso, LogUp) explain how — replacing in-circuit transcendental approximations with pre-committed tables cuts nonlinear costs 10–20×.
Every ECDSA signature broadcasts the wallet's public key. A March 2026 Google/EF paper tightens the quantum break estimate to ~500k physical qubits — here's what that means for autonomous AI agent wallets.