Zero-knowledge proofs let one party prove a computation was carried out correctly without revealing the data or model behind it, and the 2026 state of the art shows this is now cheap to verify but still expensive to prove, which is why the technology keeps finding niches rather than becoming default infrastructure.
Summary
A zero-knowledge proof (ZKP) is a cryptographic protocol in which a prover convinces a verifier that a statement about some hidden data is true, while revealing nothing beyond the truth of the statement. The practical version used today compiles a computation into an arithmetic circuit, then produces a short proof that the circuit was executed on committed inputs. The verifier checks the proof rather than re-running the work. That gives two distinct products from one primitive: privacy (the inputs stay hidden) and verifiability (the computation is auditable by someone who never sees it).
ZKPs sit inside the broader family of privacy-enhancing technologies alongside secure multi-party computation, homomorphic encryption, verifiable computation and trusted execution environments. The framing used across the State of the Future material is that data is already encrypted at rest and in transit, but not during processing, and PETs are the set of techniques attacking that third gap, opening up confidential data collaboration as a market ref. The same body of work is candid that MPC, ZKP and FHE have all struggled for adoption in practice ref, with hardware-based trusted execution environments treated as the more likely near-term route to confidential cloud computing ref.
The parameters that decide whether a ZKP deployment is worth it are prover time, proof size, verification time, setup cost, and how awkward the target computation is to express as a circuit. The clearest recent datapoint is NanoZK, a system for verifiable large language model inference in which clients or third-party auditors check that a provider ran the advertised model on a committed input without learning weights or activations. It decomposes transformer inference into independently provable layers linked by a SHA-256 commitment chain, giving constant-size sub-circuit proofs of 3.5 to 3.7 KB and about 83 KB in total at twelve layers, against 101 to 126 KB for prior monolithic ZKML proofs, with the layerwise structure being substantially more parallelisable. Non-linear operations that circuits handle badly (softmax, GELU, normalisation) are replaced with 16-bit lookup-table approximations, with measured perplexity degradation below 1e-4 across six model and dataset combinations. On CPU the MLP sub-circuit proves in about 6.3 seconds prove-only, about 43 seconds including setup, with about 22 ms verification at any width, and attention proving starts from about 0.9 seconds. Verification is trivially cheap; proving is seconds per layer per token-batch, which is the whole economic story.
A second parameter is the assumption base. Most deployed proof systems rest on hardness assumptions that a large quantum computer would break, and standardisation to date has concentrated on basic encryption and signatures rather than advanced functionalities. NSF is funding work explicitly on post-quantum protocols with advanced features for decentralised and privacy-preserving applications, built on lattices and error-correcting codes.
Evidence base
- 21 July 2026: NanoZK decomposes transformer inference into independently provable layers linked by a SHA-256 commitment chain, giving constant-size 3.5 to 3.7 KB sub-circuit proofs and about 83 KB total at twelve layers, against 101 to 126 KB for prior monolithic ZKML proofs.
- 21 July 2026: 16-bit lookup-table approximations for softmax, GELU and normalisation show measured perplexity degradation below 1e-4 across six model and dataset combinations.
- 21 July 2026: on CPU the MLP sub-circuit proves in about 6.3 seconds prove-only (about 43 seconds with setup) with about 22 ms verification at any width, and attention proving starts from about 0.9 seconds; the authors state that full soundness still requires verifying every layer.
- 1 May 2026: NSF awarded $399,964 and $200,002 to two collaborative projects on post-quantum cryptographic protocols with advanced functionalities, noting that standardisation so far has focused on basic encryption and signatures while decentralised and privacy-preserving applications need more.
- 19 October 2023: MPC, ZKP and FHE are described as struggling for adoption, with selective encryption offered as the more tractable path ref.
- 13 October 2023: trusted execution environments are argued to be a significant part of the future confidential cloud, positioning hardware trust as ZKP’s main competitor for processing-time protection ref.
- 5 May 2023: machine learning is identified as the main driver of data-sharing tool adoption, with healthcare likely to need its own data infrastructure ref.
Open questions
- How does NanoZK’s roughly 6.3 second per-MLP-sub-circuit CPU prove time change on GPU or dedicated proving hardware, and does the layerwise parallelism deliver near-linear speedup in practice?
- Will any regulator or large buyer actually require cryptographic proof of model execution, rather than accepting hardware attestation from a trusted execution environment ref?
- How much soundness is lost in practice under Fisher-information-guided audit-budget triage compared with verifying every layer, and would a court or auditor accept sampled verification?
- Do post-quantum proof systems with advanced functionalities, built on lattices or codes, reach comparable proof sizes and prover costs, or does quantum resistance cost an order of magnitude?
Assessment drafted 2026-08-31 from up to 10 KB sources using the technology-scorecard framework; scores are a draft read pending review.