Verifiable ML & ZK-Inference

EZKL's Halo2-based proofs, Modulus Labs and the Leela chess demo, Giza on StarkNet, Ora's opML, and the brutal performance trade-off between cryptographic correctness (zkML) and optimistic trust (opML).

30 min · expert · part of AI × Crypto: The Convergence

The Problem: Did That Output Really Come From That Model?

Imagine you ask an oracle: "given current market conditions, what is the probability that BTC closes above $200,000 on December 31?" The oracle replies "0.42." You decide whether to take a position based on that number. Now ask yourself: how do you know the oracle actually ran a sophisticated model? How do you know it did not just return a constant value, or run a smaller model than advertised, or even read the answer from a colluding human? In normal centralized AI services, you trust the operator. They have a reputation, a Terms of Service, a brand to protect. That works for ChatGPT and Claude. It works less well when the AI output is supposed to drive multi-million-dollar onchain settlements. **Verifiable ML** is the class of techniques that cryptographically certify the relationship between a model, its inputs, and its outputs. The goal: anyone can verify that a specific output was produced by a specific model running on specific inputs, without needing to trust the operator. The two main approaches are **zkML** (zero-knowledge machine learning, using SNARKs or STARKs) and **opML** (optimistic machine learning, using challenge windows similar to optimistic rollups). Each has a sharp trade-off between cryptographic strength and performance. This lesson covers both, the leading projects in each, and the realistic places where verifiable ML is being used today. The honest framing up front: verifiable ML is one of the most technically beautiful corners of crypto research, and it has limited but real production use. The performance overhead of zkML remains the binding constraint, and opML's "fast but trust-assumed" model fits more deployments today.

Also in this lesson

How zkML Actually Works
EZKL, Modulus Labs, Giza
opML: The Optimistic Alternative
Real Use Cases for Verifiable ML
Where This Is Going

Key terms

Verifiable ML: A class of techniques that cryptographically or game-theoretically certify a specific ML output was produced by a specific model running on specific inputs. Includes zkML and opML.
zkML: Zero-knowledge ML. Compiles a model into an arithmetic circuit and generates a SNARK or STARK proof that the model produced the output. Cryptographically rigorous but slow — 1000x-10000x performance overhead vs. native inference as of 2024-2026.
opML: Optimistic ML. Outputs are treated as honest unless challenged with a fraud proof within a window. Cheaper and faster than zkML; requires an honest-watcher assumption. Ora Protocol is the leading platform.
EZKL: Open-source toolkit that compiles ONNX-format ML models into Halo2-based zk circuits and generates proofs. The most widely used zkML stack in 2024-2026.
Modulus Labs: Team behind the Leela vs Leela onchain chess demo (Halloween 2023) — a landmark proof that non-trivial neural network execution could be cryptographically verified onchain.
Giza Tech: zkML stack built on StarkNet using Cairo and STARK proofs, leveraging StarkNet's asymptotic proof efficiency.
Ora Protocol: The leading opML platform. Uses interactive bisection fraud proofs (similar to Arbitrum) to make challenges cheap, supports settlement of arbitrary-size model outputs with a challenge window.
Halo2: A SNARK proving system originally developed by the Electric Coin Company (Zcash team) that supports lookup arguments and recursive proofs. The basis for EZKL's zkML circuits.
TEE (Trusted Execution Environment): Hardware-backed sealed execution environments (Intel SGX, AMD SEV) that attest a specific computation ran inside a trusted boundary. Used as a practical complement to zkML and opML in production verifiable-ML systems.
Model commitment: A cryptographic hash of a model's weights, used as a public identifier so verifiers can check that a proof or attestation refers to the agreed model rather than a substituted one.

Continue this lesson — 5 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.