EZKL

EZKL is a library and command-line tool, developed by the company Zkonduit, for proving neural-network inference in zero knowledge. It compiles a model exported in the ONNX format into a halo2 circuit, quantizing its values, so a prover can show that a model produced an output without revealing whichever of the model or the data is private. Its source code is public. A Trail of Bits audit in 2025 found proof-forgery bugs in its circuits and smart contracts, and all the high-severity ones were fixed. Trail of Bits reports that other projects use its verifier contracts in production. Its main limit for AI verification is scale: the largest language model in South et al.'s published results is a 250,000-parameter nanoGPT, which took 46 minutes to prove with a 219 GB proving key. Quantization also leaves a gap between the proven circuit and the full-precision model.

Public, independently audited code proves small models against a cheating prover, but its published results stop far below the size of the language models that verification claims concern.

• R1 met: the claim is that a stated model produced an output from a stated input, with either kept private S-1806. South et al. set out its use for verifiable evaluations of models with private weights S-0024.
• R2 met: the code is public S-1806. The stated adversary is a prover who tries to convince a verifier of an incorrect result, and an independent audit tested for exactly that S-0070. South et al. report end-to-end proofs for models of up to about a million parameters S-0024.
• R3 not met for this use, which is checking that a served language model is the declared one. The library is public and versioned S-1806, and Trail of Bits reports that other projects use its attestation and verifier contracts in production S-0070. No source says what those projects prove, and no party is documented relying on EZKL to verify a language model's outputs. The largest language model South et al. prove with it has 250,000 parameters S-0024, far below the models that claims about served AI concern. This matches the assessment of Zero-knowledge proofs of inference.
• R4 not met, because R3 is not. Trail of Bits' 2025 audit would otherwise count: at its fix review no high-severity finding remained unresolved S-0070.