Verifiable ML & ZK-Inference

What you'll learn

• The Problem: Did That Output Really Come From That Model?
• How zkML Actually Works
• EZKL, Modulus Labs, Giza
• opML: The Optimistic Alternative
• Real Use Cases for Verifiable ML
• Where This Is Going

Key terms

Verifiable ML

A class of techniques that cryptographically or game-theoretically certify a specific ML output was produced by a specific model running on specific inputs. Includes zkML and opML.

zkML

Zero-knowledge ML. Compiles a model into an arithmetic circuit and generates a SNARK or STARK proof that the model produced the output. Cryptographically rigorous but slow — 1000x-10000x performance overhead vs. native inference as of 2024-2026.

opML

Optimistic ML. Outputs are treated as honest unless challenged with a fraud proof within a window. Cheaper and faster than zkML; requires an honest-watcher assumption. Ora Protocol is the leading platform.

EZKL

Open-source toolkit that compiles ONNX-format ML models into Halo2-based zk circuits and generates proofs. The most widely used zkML stack in 2024-2026.

Modulus Labs

Team behind the Leela vs Leela onchain chess demo (Halloween 2023) — a landmark proof that non-trivial neural network execution could be cryptographically verified onchain.

Giza Tech

zkML stack built on StarkNet using Cairo and STARK proofs, leveraging StarkNet's asymptotic proof efficiency.

Ora Protocol

The leading opML platform. Uses interactive bisection fraud proofs (similar to Arbitrum) to make challenges cheap, supports settlement of arbitrary-size model outputs with a challenge window.

Halo2

A SNARK proving system originally developed by the Electric Coin Company (Zcash team) that supports lookup arguments and recursive proofs. The basis for EZKL's zkML circuits.

TEE (Trusted Execution Environment)

Hardware-backed sealed execution environments (Intel SGX, AMD SEV) that attest a specific computation ran inside a trusted boundary. Used as a practical complement to zkML and opML in production verifiable-ML systems.

Model commitment

A cryptographic hash of a model's weights, used as a public identifier so verifiers can check that a proof or attestation refers to the agreed model rather than a substituted one.