using agents to monitor proving training and inference techniques
See the codeA systematization of knowledge on making AI trustworthy, from zkSecurity. The "zk" is historical: zero-knowledge proofs are one technique here, not the scope.
The full SoK is a generated site, one page per approach and one per paper, with every number rendered from the data and carrying its provenance.
The field is a 2×2: what phase of the model's life you protect, and what property you want. Each cell is served by several cryptographic (and non-cryptographic) approaches.
| Verifiability (prove it was done right) | Privacy (hide the data/model during compute) | |
|---|---|---|
| Inference | Proving inference: zkML. DeepProve, Jolt Atlas, zkPyTorch, zkGPT, zkLLM. | Private inference: 2PC/MPC/FHE. Iron, BOLT, CipherGPT, Nimbus. |
| Training | Proving training: zkPoT. Kaizen, zkDL, Optimum Vicinity, ZKBoost. | Private training: MPC/HE. PriFT, and verifiable-FL hybrids. |
The technique is not the axis. A cell can be filled by ZK proofs, MPC, FHE, trusted hardware (TEEs), optimistic fraud proofs, or trace sampling, at very different cost/trust trade-offs. Verifiability buys correctness (a third party can trust the result) at ~1000× compute. Privacy buys confidentiality from a counterparty (usually only a semi-honest one) at the price of heavy communication or homomorphic compute. They are different guarantees, and most systems give one, not both.
Within the verifiability column, the ZKP-VML survey splits what is being proven three ways, and we add a fourth.
| Objective | Claim being proven | Cost |
|---|---|---|
| Inference | "This model produced this output on this input." | Cheapest |
| Testing | "This model achieves this accuracy on this dataset." | Middle |
| Training | "This model is the result of correctly training on this data." | Hardest |
| Properties | "This model is fair / uncensored / trained on licensed data." | Varies |
Properties (fairness, provenance, licensing) prove a claim about a model, not a computation, so they do not fit the other three.
The org-level cut of the same field, which companies and research teams work each cell, lives on the site as The landscape. The genuinely focused, independent "zkML company" set is small (under ~15). The rest of the field is general-purpose ZK infrastructure adding an ML path, FHE companies adding encrypted inference, MPC networks adding "private AI," and decentralized-AI projects using "verifiable AI" as language. The clusters worth watching:
See the site page for the full org tables, the privacy legend, and the audit-firm "who to watch" read.
using agents to monitor proving training and inference techniques
See the codeA systematization of knowledge on making AI trustworthy, from zkSecurity. The "zk" is historical: zero-knowledge proofs are one technique here, not the scope.
The full SoK is a generated site, one page per approach and one per paper, with every number rendered from the data and carrying its provenance.
The field is a 2×2: what phase of the model's life you protect, and what property you want. Each cell is served by several cryptographic (and non-cryptographic) approaches.
| Verifiability (prove it was done right) | Privacy (hide the data/model during compute) | |
|---|---|---|
| Inference | Proving inference: zkML. DeepProve, Jolt Atlas, zkPyTorch, zkGPT, zkLLM. | Private inference: 2PC/MPC/FHE. Iron, BOLT, CipherGPT, Nimbus. |
| Training | Proving training: zkPoT. Kaizen, zkDL, Optimum Vicinity, ZKBoost. | Private training: MPC/HE. PriFT, and verifiable-FL hybrids. |
The technique is not the axis. A cell can be filled by ZK proofs, MPC, FHE, trusted hardware (TEEs), optimistic fraud proofs, or trace sampling, at very different cost/trust trade-offs. Verifiability buys correctness (a third party can trust the result) at ~1000× compute. Privacy buys confidentiality from a counterparty (usually only a semi-honest one) at the price of heavy communication or homomorphic compute. They are different guarantees, and most systems give one, not both.
Within the verifiability column, the ZKP-VML survey splits what is being proven three ways, and we add a fourth.
| Objective | Claim being proven | Cost |
|---|---|---|
| Inference | "This model produced this output on this input." | Cheapest |
| Testing | "This model achieves this accuracy on this dataset." | Middle |
| Training | "This model is the result of correctly training on this data." | Hardest |
| Properties | "This model is fair / uncensored / trained on licensed data." | Varies |
Properties (fairness, provenance, licensing) prove a claim about a model, not a computation, so they do not fit the other three.
The org-level cut of the same field, which companies and research teams work each cell, lives on the site as The landscape. The genuinely focused, independent "zkML company" set is small (under ~15). The rest of the field is general-purpose ZK infrastructure adding an ML path, FHE companies adding encrypted inference, MPC networks adding "private AI," and decentralized-AI projects using "verifiable AI" as language. The clusters worth watching:
See the site page for the full org tables, the privacy legend, and the audit-firm "who to watch" read.
