ZK proofs and their applications: SNARKs, STARKs, rollups, and private computation.
Training Llama-3.1-8B costs ~$6M. The weights are free to clone. Perinucleus sampling embeds 24,576 distinct fingerprints per model with no quality loss — and a Poseidon ZK commitment registers ownership on-chain for $0.017, enforceable by smart contract.
Every zkSNARK bottoms out in a pairing check. Before Pectra you had BN254 at ~100-bit security. EIP-2537 added BLS12-381 at 128 bits, and its pairings are cheaper: 32,600k+37,700 vs 34,000k+45,000 gas. G2 MUL dropped from millions to 22,500 gas.
Nova replaces expensive SNARK-in-SNARK recursion with a random linear combination that folds two R1CS instances into one — 10× less overhead per step. For N-step AI inference: O(N) prover work, one constant-size final proof. NANOZK delivers this at GPT-2 scale: 6.9 KB, 23 ms verify.
DiFR's seed-commitment round-trip is the last synchronization barrier to async verifiable inference. TOPLOC removes it: a locality-sensitive hash of intermediate activations compresses to 258 bytes per 32 tokens — 1,000× smaller than raw embeddings — and validates faster than inference ran.
AI agents need real-world data. zkTLS closes the oracle gap: TLSNotary's MPC-TLS costs 30 MB of garbled circuits at 5 Mbps; its April 2026 Proxy mode cuts that to 4 seconds. Here is the trust model, the benchmarks, and what agents can prove today.
A single cryptographic primitive — the KZG polynomial commitment — quietly powers EIP-4844 blobs, zkEVM proof systems, and on-chain verifiable AI. You can verify one on Ethereum for 50,000 gas ($0.067 today). Here's the math, the ceremony, and why every zkML system depends on it.
An SP1 proof costs 327k gas on Ethereum mainnet. At a 30M-gas block target, a naive AI inference market maxes out at 91 verifications per block. SnarkPack's O(log N) aggregation collapses 1,000 proofs to a single 880k-gas verification — here's the mechanism, the math, and the latency tradeoffs.
Every EIP-4844 blob is secured by a KZG polynomial commitment — 48 bytes committing to 128 KB, verifiable in 50,000 gas. That efficiency required 140,416 people to collectively bury a secret for 69 days. Here's the math, the ceremony, and why Ethereum chose a different scheme for state.
FRI-STARKs are fast and trustless, but their proofs are megabytes wide. Groth16 is 256 bytes but needs a ceremony. STARK→SNARK wrapping resolves the tension — and it's why SP1 and RISC Zero can settle any ML inference on L1 for under 300k gas.
Bitcoin burns ~150 TWh/yr on SHA-256 nonces that prove nothing. Komargodski & Weinstein showed a Freivalds randomisation check turns any matmul into a valid proof-of-work at only 3/(2N) overhead — the same GPU seconds train your model and mine the block.
Softmax costs 275 ZK constraints per element vs 4 for MatMul. ZK-DeepSeek proved Transformer inference is expressible in SNARKs. Lookup arguments (Lasso, LogUp) explain how — replacing in-circuit transcendental approximations with pre-committed tables cuts nonlinear costs 10–20×.
DeepSeek-R1 emits 8,400 thinking tokens before a 341-token answer on hard math. Every existing on-chain verification scheme — TEE, optimistic, ZK, sampling — was designed when computation and output were proportional. They aren't anymore.