Pith. sign in

REVIEW 2 major objections 7 minor 70 references

zkComposer cuts zkML prover time by up to 6.84× by replacing one monolithic proof with parallel sub-proofs linked only by shared masked boundary commitments.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-10 13:09 UTC pith:AVPVRC3C

load-bearing objection Clean systems win: shared masked boundary commitments give real parallel prover speedups on zkCNN/zkGPT without extra linking SNARKs, and the security reductions hold. the 2 major comments →

arxiv 2607.08095 v1 pith:AVPVRC3C submitted 2026-07-09 cs.CR

zkComposer: Decomposing Proof Construction to Scale zkML

Pawan Kumar Sanjaya , Christina Giannoula , Valdy Oktavian , Mehdi Saeedi , Gabor Sines , Gururaj Saileshwar , Nandita Vijaykumar This is my paper
classification cs.CR
keywords zkMLzero-knowledge proofsGKR protocolproof compositionpolynomial commitmentsparallel proof generationGPT-2CNNs
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Zero-knowledge machine learning lets a server prove that an inference used a claimed model without revealing weights, but today’s systems build one giant proof for the whole network. That design saturates quickly: extra cores barely help, and peak memory grows with model and input size. zkComposer splits the inference circuit into partitions—contiguous layers, and for transformers also contiguous input tokens—and generates an independent sub-proof for each partition. Adjacent partitions are forced to agree on the activations at their cut by reusing a single cryptographic commitment to those activations; the commitment is masked so intermediate values stay hidden. No extra linking proof and no change to the underlying commitment scheme are required. On three CNNs the method reduces prover and response time by as much as 3.25×; on GPT-2 the gains reach 4.83× with layer partitions and 6.84× when layers and sequence are partitioned together. Running the same sub-proofs one after another also shrinks peak memory by up to 8.1×, so larger proofs can fit on memory-limited accelerators.

Core claim

A zkML proof of correct inference can be replaced by independent sub-proofs, each covering only a subset of layers or tokens, whose boundary activations are equated by reusing one masked polynomial commitment. The construction preserves the completeness, knowledge soundness and zero-knowledge of the original GKR-based system without modifying the commitment scheme or adding linking SNARKs, and the sub-proofs can be generated in parallel (or sequentially for lower memory).

What carries the argument

Shared masked boundary commitments: the prover commits once to a low-degree extension of the activations at each cut (masked by a random polynomial sized for every opening that will appear) and reuses that same commitment as the output of one sub-proof and as part of the input of the next. Binding equates the values; the mask preserves zero knowledge.

Load-bearing premise

Each sub-protocol must still meet the Fiat–Shamir depth condition after the cut, and the public model architecture must already tell the prover exactly how many times every boundary polynomial will be opened so a fixed mask can hide them all.

What would settle it

Re-run the GPT-2 layer-partition experiment (12 partitions, sequence length 64) on the same 192-core machine and check whether prover time falls from roughly 148 s to roughly 31 s and the composed proofs still verify; a speedup near 1× or rejected proofs would falsify the central claim.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • CNN inference proofs can be generated 2–3.25× faster on identical hardware.
  • GPT-2 inference proofs can be accelerated up to 4.83× with layer partitions and 6.84× with combined layer-and-sequence partitions.
  • Sequential sub-proof generation reduces peak prover memory by up to 8.1×, fitting larger models on memory-constrained GPUs.
  • Existing circuit-level optimizations such as circuit squashing remain usable inside each partition.
  • The same shared-commitment link works with lookup-based layers and extends recursively to any number of partitions.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Independent Fiat–Shamir transcripts per partition could let a client receive and verify partial results as soon as each sub-proof finishes, improving perceived latency even when total work is unchanged.
  • Skip connections force higher-degree masks as fan-out grows; that may limit how freely residual networks can be partitioned compared with the linear cuts evaluated here.
  • The offline partition profiling already used for CNNs could become an automatic compiler pass that balances thread count against commitment overhead for any new architecture.
  • Heterogeneous hardware (CPU plus GPU, or multiple machines) could each own a partition without redesigning the underlying SNARK.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 7 minor

Summary. The paper presents zkComposer, a modular proof-construction framework for zkML that decomposes a monolithic GKR-based inference proof into independent sub-proofs over model-layer (and, for GPT-2, sequence) partitions. Adjacent sub-proofs are linked by reusing a single PCS commitment to masked boundary activations, so equality of intermediate activations is enforced by PCS binding without extra linking proofs or changes to the underlying PCS/GKR primitives. The authors give a formal two-partition protocol (Protocol 1), prove completeness and knowledge soundness by reduction to the underlying CP-SNARKs and PCS binding (Theorem 1), and prove zero-knowledge via a hybrid argument that the shared boundary openings remain statistically independent of the true activations when the mask degree matches the public opening multiplicity (Theorem 2 / §B.4). Implemented on zkCNN and zkGPT, zkComposer reports up to 3.25× prover/response-time speedup on three CNNs and up to 6.84× on GPT-2 (layer+sequence partitioning), plus up to 8.1× peak-memory reduction in sequential sub-proof mode.

Significance. If the security reductions and empirical claims hold, this is a practically important systems contribution to zkML: it unlocks a new axis of parallelism (across sub-proofs) that existing kernel-level and circuit-squashing optimizations do not provide, and it does so while remaining compatible with current GKR-based stacks. The shared-commitment linking idea is cleaner than generic LegoSNARK-style equality gadgets for the masked multivariate LDE setting used in zkML, and the evaluation covers both CNNs and GPT-2 under identical hardware budgets. Explicit reductions to standard PCS/GKR assumptions, a fully specified protocol, and head-to-head wall-clock tables are real strengths. The sequential memory reduction also makes GPU/accelerator deployment more plausible. Overall significance is high for the zkML systems community.

major comments (2)
  1. [§4, Fiat–Shamir; Theorems 1–2] §4 (Fiat–Shamir paragraph) and the security claims in Theorems 1–2: soundness of the non-interactive protocol is conditioned on each sub-protocol satisfying the circuit-depth restriction from [39] relative to the hash and PCS. The manuscript states that partitions are unchanged from the already-analyzed underlying CP-SNARKs and that the condition applies independently, but it does not verify or bound depth for the concrete zkCNN/zkGPT circuits (or for the finer sequence partitions in Table 4). Because [39] is cited as showing practical Fiat–Shamir failures when the condition fails, a short explicit argument—or a check that every evaluated partition depth is strictly below the relevant bound—should be added so the non-interactive security claim is not left as an unvalidated assumption.
  2. [§1 Goal; Table 1; §6.3.3 / Table 5] Introduction Goal and §6.2/Table 1 vs §6.3.3/Table 5: one stated goal is reducing peak prover memory for large inputs / memory-constrained accelerators, yet under parallel execution on CNNs peak memory increases (e.g., AlexNet 4.14 GB → 11.32 GB at K=5; similar for AlexNet-Wide and VGG16). Memory reduction is demonstrated only in sequential GPT-2 mode (up to 8.1×). The contribution list already distinguishes sequential memory reduction, but the goal framing and abstract-level claims should be tightened so readers do not infer that parallel sub-proofs always lower peak memory. Clarify when memory rises (replicated precomputation / concurrent witnesses) versus when sequential mode yields the reported reductions.
minor comments (7)
  1. [§1, Figure 2] Figure 2 and the memory-bound saturation claim would be stronger with a brief bandwidth or cache-miss measurement (or a citation to prior profiling of the same kernels) rather than thread-scaling alone.
  2. [§3.1, Eq. (5)–(6)] Eq. (5)–(6) and Protocol 1: the selector-variable chunking for combining activations and weights is clear, but a one-line note on how padding is handled when |act_bj| ≠ |θ_j| would help implementers.
  3. [§6.3.2, Table 4] Table 4: verifier time and proof size grow sharply under 2D partitioning (e.g., seq. 256, K=48: verifier 2.888 s, proof ~2 MB). The text correctly notes transmission is still small at 100 MBps; a short discussion of when verifier cost becomes the bottleneck (e.g., many clients, constrained verifiers) would round out the trade-off analysis.
  4. [§4.1] §4.1: CNN partition selection via exhaustive offline profiling is practical; stating the profiling cost once (wall-clock or number of configurations) would make reproducibility clearer.
  5. [§2–§3] Notation: ˜V vs ˙V vs eVb appear in the main text and appendix; a short notation table early in §2 would reduce friction.
  6. [§8] Related work on Hydra [59] correctly notes the lack of zero-knowledge; a sentence on how zkComposer’s mask-degree rule differs from Hydra’s linking would help readers place the novelty.
  7. [Abstract; §4.1; Fig. 3] Minor typos / polish: “e.g.,each” spacing (Abstract); “we evaluation” → “we evaluate” (§4.1); “m0” / message indexing in Fig. 3 caption could match Protocol 1 terminology more closely.

Circularity Check

0 steps flagged

No significant circularity: security claims reduce to standard external PCS/GKR properties via explicit hybrid arguments, and speedups are direct wall-clock measurements against unmodified baselines.

full rationale

The paper's central claims are (1) that shared masked boundary commitments yield a knowledge argument and zero-knowledge for the end-to-end relation R_zkml (Theorems 1–2, Protocol 1, hybrid argument in §5/B.4) and (2) measured prover/response-time reductions versus zkCNN and zkGPT under identical hardware (Tables 1–4). Completeness and knowledge soundness are reduced by construction to the binding of the external PCS and the knowledge soundness of the underlying GKR-based CP-SNARKs (already proved in the cited literature, not by these authors). Zero-knowledge is shown by a standard hybrid that samples uniform boundary openings and invokes the simulators of the sub-protocols and PCS; the mask degree is chosen from the publicly known architecture, not fitted to data. Empirical numbers are raw timings of the same kernels run with K partitions versus K=1; no parameter is fitted and then re-presented as a prediction. Re-use of zkCNN/zkGPT arithmetization is openly credited and left unchanged, which is ordinary engineering, not a self-citation that forces the result. No self-definitional loop, fitted-input-as-prediction, uniqueness theorem imported from the authors, or renaming of a known pattern appears. The derivation chain is therefore self-contained against external cryptographic assumptions and external baselines.

Axiom & Free-Parameter Ledger

2 free parameters · 5 axioms · 1 invented entities

The paper rests on standard cryptographic assumptions (PCS binding/hiding, GKR knowledge soundness, Fiat–Shamir in the random-oracle model) plus the public-architecture assumption common to all zkML work. Partition count K and boundary locations are free engineering choices selected by offline profiling; they are not fitted to produce the security claims. No new physical or mathematical entities are postulated beyond the modular proof framework itself.

free parameters (2)
  • number of partitions K and boundary layer indices
    Chosen by exhaustive offline profiling of feasible cuts (Section 4.1) to minimize prover time under a fixed thread budget; different K values appear in every table and directly affect reported speed-ups.
  • degree and monomials of boundary masking polynomial R_b
    Set by the authors to the exact number of openings implied by the public architecture (Section 3.2, Appendix B.1); the concrete coefficients are random but the degree is an engineering parameter.
axioms (5)
  • domain assumption The underlying polynomial commitment scheme satisfies completeness, binding and hiding (Definition 2).
    Invoked throughout Theorems 1–2 and Protocol 1; taken from Hyrax/Spartan literature.
  • domain assumption The GKR-based CP-SNARKs for each sub-relation satisfy completeness, knowledge soundness and zero-knowledge (Definition 1).
    Stated as hypothesis of Theorems 1–2; inherited from Libra/zkCNN/zkGPT.
  • domain assumption Fiat–Shamir compilation remains sound for each sub-protocol provided circuit depth is below the hash+PCS depth bound.
    Section 4 explicitly assumes the underlying systems already satisfy the condition of Khovratovich et al. 2025.
  • domain assumption Model architecture (layer types, dimensions, skip connections) is public and known to both prover and verifier.
    Standard zkML premise restated in the introduction and used to fix the number of openings of each boundary polynomial.
  • standard math Multilinear extensions and low-degree extensions agree on the Boolean hypercube (Eq. 3).
    Used to substitute masked polynomials into the GKR sumcheck without changing correctness.
invented entities (1)
  • zkComposer shared-boundary commitment construction independent evidence
    purpose: Enforce equality of activations across independent sub-proofs while preserving zero-knowledge without an extra linking SNARK.
    The concrete combination of chunked input polynomials (Eq. 5–6) and multi-opening masks is introduced by the paper; independent evidence is the security reduction and the empirical speed-ups.

pith-pipeline@v1.1.0-grok45 · 34846 in / 3046 out tokens · 32464 ms · 2026-07-10T13:09:07.553358+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of zkComposer: Decomposing Proof Construction to Scale zkML." pith.science (2026). https://pith.science/paper/AVPVRC3C

@misc{pith2026260708095,
  author       = {Pith},
  title        = {Pith review of: zkComposer: Decomposing Proof Construction to Scale zkML},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AVPVRC3C}},
  note         = {Machine review of arXiv:2607.08095}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Zero-knowledge machine learning (zkML) enables a server to perform verifiable inference while keeping model parameters private from the client. However, existing zkML systems incur prohibitive proof-generation costs. We observe that proof generation exhibits limited parallelism; that is, prover time does not decrease significantly as the number of threads increases. This limitation is because existing systems rely on monolithic proof computation, constructing a single proof for the entire machine learning model. We introduce zkComposer, a modular proof-construction framework that unlocks an additional dimension of parallelism, in addition to the parallelism in existing proof kernels. zkComposer decomposes the zkML proof of correct inference into independent sub-proofs, each covering a subset of the computation for inference e.g., each independent sub-proof can cover a subset of contiguous layers in the ML model. Adjacent sub-proofs are cryptographically linked through shared commitments to the activations from the boundary layer. zkComposer provides the same guarantees as the monolithic proof without requiring additional linking proofs or changes to the underlying cryptographic primitives. We implement zkComposer and evaluate it on three CNNs and GPT-2. We show that, on CNN workloads, zkComposer reduces prover time and response time by up to 3.25x relative to zkCNN [1]. On GPT-2, zkComposer reduces these times by up to 4.83x relative to zkGPT [2], when partitioning along the model layers. When partitioning across both model layers and input sequences in GPT-2, we show that zkComposer reduces prover time and response time by up to 6.84x relative to zkGPT [2].

Figures

Figures reproduced from arXiv: 2607.08095 by Christina Giannoula, Gabor Sines, Gururaj Saileshwar, Mehdi Saeedi, Nandita Vijaykumar, Pawan Kumar Sanjaya, Valdy Oktavian.

Figure 1
Figure 1. Figure 1: Overview of a zkML system: service provider [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Prover time of zkGPT [2] does not decrease [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Transforming an interactive public coin protocol [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Arithmetic circuit for zkComposer with n parti￾tions. We accelerate zkML proof generation by exploiting the parallelism across independent sub-proofs. We divide the neural network into multiple partitions and generate a sub￾proof for each. We describe our approach for partitioning along model layers; other schemes appear in §4.1. Each partition (indexed from output to input) consists of a subset of contigu… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

70 extracted references · 70 canonical work pages · 4 internal anchors

  1. [1]

    zkCNN: Zero knowledge proofs for convolutional neural network predictions and accuracy,

    T. Liu, X. Xie, and Y . Zhang, “zkCNN: Zero knowledge proofs for convolutional neural network predictions and accuracy,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’21, 2021, pp. 2968–2985. [Online]. Available: https://eprint.iacr.org/2021/673

    work page 2021

  2. [2]

    zkGPT: An efficient non-interactive zero-knowledge proof framework for LLM inference,

    W. Qu, Y . Sun, X. Liu, T. Lu, Y . Guo, K. Chen, and J. Zhang, “zkGPT: An efficient non-interactive zero-knowledge proof framework for LLM inference,” in34th USENIX Security Symposium (USENIX Security 25), 2025. [Online]. Available: https: //www.usenix.org/conference/usenixsecurity25/presentation/qu-zkgpt

    work page 2025

  3. [3]

    Deep learning based recom- mender system: A survey and new perspectives,

    S. Zhang, L. Yao, A. Sun, and Y . Tay, “Deep learning based recom- mender system: A survey and new perspectives,”ACM Computing Surveys, vol. 52, no. 1, pp. 1–38, 2019

    work page 2019

  4. [4]

    Fraud detection system: A survey,

    A. Abdallah, M. A. Maarof, and A. Zainal, “Fraud detection system: A survey,”Journal of Network and Computer Applications, vol. 68, pp. 90–113, 2016

    work page 2016

  5. [5]

    Deeptriangle: A deep learning approach to loss reserving,

    K. Kuo, “Deeptriangle: A deep learning approach to loss reserving,” Risks, vol. 7, no. 3, p. 97, 2019

    work page 2019

  6. [6]

    A guide to deep learning in healthcare,

    A. Esteva, A. Robicquet, B. Ramsundar, V . Kuleshov, M. DePristo, K. Chou, C. Cui, G. Corrado, S. Thrun, and J. Dean, “A guide to deep learning in healthcare,”Nature Medicine, vol. 25, no. 1, pp. 24–29, 2019

    work page 2019

  7. [7]

    Critical appraisal of fairness metrics for artificial intelligence- based clinical prediction models: a scoping review,

    J. Matos, B. Van Calster, L. A. Celi, P. Dhiman, J. W. Gichoya, R. D. Riley, C. Russell, S. Khalid, and G. S. Collins, “Critical appraisal of fairness metrics for artificial intelligence- based clinical prediction models: a scoping review,”The Lancet Digital Health, p. 101001, 2026. [Online]. Available: https: //www.sciencedirect.com/science/article/pii/S...

    work page 2026

  8. [8]

    Are you getting what you pay for? auditing model substitution in llm apis,

    W. Cai, T. Shi, X. Zhao, and D. Song, “Are you getting what you pay for? auditing model substitution in llm apis,” 2025. [Online]. Available: https://arxiv.org/abs/2504.04715

    work page arXiv 2025

  9. [9]

    The rising costs of training frontier AI models

    B. Cottier, R. Rahman, L. Fattorini, N. Maslej, T. Besiroglu, and D. Owen, “The rising costs of training frontier ai models,” 2025. [Online]. Available: https://arxiv.org/abs/2405.21015

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  10. [10]

    ZKML: An optimizing system for ML inference in zero-knowledge proofs,

    D. Kang, T. Hashimoto, I. Stoica, and Y . Sun, “ZKML: An optimizing system for ML inference in zero-knowledge proofs,” inProceedings of the Nineteenth European Conference on Computer Systems, ser. EuroSys ’24, Apr. 2024, pp. 622–636

    work page 2024

  11. [11]

    VerITAS: Verifying Image Transformations at Scale,

    T. Datta, B. Chen, and D. Boneh, “VerITAS: Verifying Image Transformations at Scale,” in2025 IEEE Symposium on Security and Privacy (SP). Los Alamitos, CA, USA: IEEE Computer Society, May 2025, pp. 4606–4623. [Online]. Available: https: //doi.ieeecomputersociety.org/10.1109/SP61157.2025.00097

    work page doi:10.1109/sp61157.2025.00097 2025

  12. [12]

    Libra: Succinct zero-knowledge proofs with optimal prover computation,

    T. Xie, J. Zhang, Y . Zhang, C. Papamanthou, and D. Song, “Libra: Succinct zero-knowledge proofs with optimal prover computation,” inAdvances in Cryptology – CRYPTO 2019, ser. Lecture Notes in Computer Science, vol. 11694. Springer, 2019, pp. 733–764

    work page 2019

  13. [13]

    Unlocking the lookup singularity with lasso,

    S. Setty, J. Thaler, and R. Wahby, “Unlocking the lookup singularity with lasso,” inAdvances in Cryptology – EUROCRYPT 2024. Cham: Springer, 2024

    work page 2024

  14. [14]

    The knowledge com- plexity of interactive proof systems,

    S. Goldwasser, S. Micali, and C. Rackoff, “The knowledge com- plexity of interactive proof systems,”SIAM Journal on Computing, vol. 18, no. 1, pp. 186–208, 1989

    work page 1989

  15. [15]

    vCNN: Verifiable convolutional neural network based on zk-SNARKs,

    S. Lee, H. Ko, J. Kim, and H. Oh, “vCNN: Verifiable convolutional neural network based on zk-SNARKs,”IEEE Transactions on De- pendable and Secure Computing, vol. 21, no. 4, pp. 4254–4270, 2024

    work page 2024

  16. [16]

    VerfCNN, Optimal Complexity zkSNARK for Convolutional Neural Networks,

    W. Qu, Y . Guo, Y . Ying, and J. Zhang, “VerfCNN, Optimal Complexity zkSNARK for Convolutional Neural Networks,” 2025, publication info: Published elsewhere. Minor revision. IEEE S&P

    work page 2025

  17. [17]

    Available: https://eprint.iacr.org/2025/2020

    [Online]. Available: https://eprint.iacr.org/2025/2020

    work page 2025

  18. [18]

    Safetynets: Verifiable execution of deep neural networks on an untrusted cloud,

    Z. Ghodsi, T. Gu, and S. Garg, “Safetynets: Verifiable execution of deep neural networks on an untrusted cloud,” inAdvances in Neural Information Processing Systems, vol. 30, 2017, pp. 4672–4681

    work page 2017

  19. [19]

    Zero-knowledge proofs of training for deep neural networks,

    K. Abbaszadeh, C. Pappas, J. Katz, and D. Papadopoulos, “Zero-knowledge proofs of training for deep neural networks,” Cryptology ePrint Archive, Paper 2024/162, 2024. [Online]. Available: https://eprint.iacr.org/2024/162

    work page 2024

  20. [20]

    zkllm: Zero knowledge proofs for large language models,

    H. Sun, J. Li, and H. Zhang, “zkllm: Zero knowledge proofs for large language models,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’24. New York, NY , USA: Association for Computing Machinery, 2024, p. 4405–4419. [Online]. Available: https://doi.org/10.1145/3658644.3670334

    work page doi:10.1145/3658644.3670334 2024

  21. [21]

    Artemis: Efficient Commit-and-Prove SNARKs for zkML

    H. Lycklama, A. Viand, N. Avramov, N. K ¨uchler, and A. Hithnawi, “Artemis: Efficient commit-and-prove snarks for zkml,” 2025. [Online]. Available: https://arxiv.org/abs/2409.12055

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  22. [22]

    Zen: Efficient zero-knowledge proofs for neural networks,

    B. Feng, L. Qin, Z. Zhang, Y . Ding, and S. Chu, “Zen: Efficient zero-knowledge proofs for neural networks,” Cryptology ePrint Archive, Paper 2021/087, 2021. [Online]. Available: https: //eprint.iacr.org/2021/087

    work page 2021

  23. [23]

    Zeno: A type- based optimization framework for zero-knowledge neural network inference,

    B. Feng, Z. Wang, Y . Wang, S. Yang, and Y . Ding, “Zeno: A type- based optimization framework for zero-knowledge neural network inference,” inProceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’24). ACM, 2024, pp. 450–464

    work page 2024

  24. [24]

    zkonduit/ezkl,

    “zkonduit/ezkl,” Jan. 2026, original-date: 2022-07-05T19:54:03Z. [Online]. Available: https://github.com/zkonduit/ezkl

    work page 2026

  25. [25]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, “Language models are unsupervised multitask learners,”OpenAI blog, vol. 1, no. 8, p. 9, 2019

    work page 2019

  26. [26]

    Delegating compu- tation: Interactive proofs for muggles,

    S. Goldwasser, Y . T. Kalai, and G. N. Rothblum, “Delegating compu- tation: Interactive proofs for muggles,”Journal of the ACM, vol. 62, no. 4, pp. 27:1–27:64, 2015

    work page 2015

  27. [27]

    Doubly efficient interactive proofs for general arithmetic circuits with linear prover time,

    J. Zhang, T. Liu, W. Wang, Y . Zhang, D. Song, X. Xie, and Y . Zhang, “Doubly efficient interactive proofs for general arithmetic circuits with linear prover time,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 159–177. [Online]. Avai...

    work page doi:10.1145/3460120.3484767 2021

  28. [28]

    Algebraic methods for interactive proof systems,

    C. Lund, L. Fortnow, H. Karloff, and N. Nisan, “Algebraic methods for interactive proof systems,”Journal of the ACM, vol. 39, no. 4, pp. 859–868, October 1992

    work page 1992

  29. [29]

    A zero knowledge sumcheck and its applications,

    A. Chiesa, M. A. Forbes, and N. Spooner, “A zero knowledge sumcheck and its applications,” Cryptology ePrint Archive, Paper 2017/305, 2017. [Online]. Available: https://eprint.iacr.org/2017/305

    work page 2017

  30. [30]

    Doubly-efficient zksnarks without trusted setup,

    R. S. Wahby, I. Tzialla, abhi shelat, J. Thaler, and M. Walfish, “Doubly-efficient zksnarks without trusted setup,” in2018 IEEE Symposium on Security and Privacy (SP), 2018, pp. 926–943

    work page 2018

  31. [31]

    Spartan: Efficient and general-purpose zksnarks with- out trusted setup,

    S. T. V . Setty, “Spartan: Efficient and general-purpose zksnarks with- out trusted setup,” inAdvances in Cryptology – CRYPTO 2020, ser. Lecture Notes in Computer Science, vol. 12172. Springer, 2020, pp. 704–737

    work page 2020

  32. [32]

    Marlin: Preprocessing zksnarks with universal and updatable srs,

    A. Chiesa, Y . Hu, M. Maller, P. Mishra, N. Vesely, and N. Ward, “Marlin: Preprocessing zksnarks with universal and updatable srs,” inAdvances in Cryptology–EUROCRYPT 2020: 39th Annual Inter- national Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10–14, 2020, Proceedings, Part I

    work page 2020

  33. [33]

    Springer, 2020, pp. 738–768

    work page 2020

  34. [34]

    On the size of pairing-based non-interactive arguments,

    J. Groth, “On the size of pairing-based non-interactive arguments,” inAdvances in Cryptology – EUROCRYPT 2016, ser. Lecture Notes in Computer Science, vol. 9666. Springer, 2016, pp. 305–326

    work page 2016

  35. [35]

    Legosnark: Modular design and composition of succinct zero-knowledge proofs,

    M. Campanelli, D. Fiore, and A. Querol, “Legosnark: Modular design and composition of succinct zero-knowledge proofs,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communi- cations Security (CCS), 2019, pp. 2075–2092

    work page 2019

  36. [36]

    How to prove yourself: Practical solutions to identification and signature problems,

    A. Fiat and A. Shamir, “How to prove yourself: Practical solutions to identification and signature problems,” inConference on the Theory and Application of Cryptographic Techniques. Springer, 1986, pp. 186–194

    work page 1986

  37. [37]

    SHA-3 standard : permutation-based hash and extendable-output functions,

    National Institute of Standards and Technology (US), “SHA-3 standard : permutation-based hash and extendable-output functions,” National Institute of Standards and Technology (U.S.), Tech. Rep., 2015. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/ FIPS/NIST.FIPS.202.pdf

    work page 2015

  38. [38]

    Proofs, arguments, and zero-knowledge,

    J. Thaler, “Proofs, arguments, and zero-knowledge,”Foundations and Trends® in Privacy and Security, vol. 4, no. 2–4, pp. 117–660,

    work page

  39. [39]

    Available: http://dx.doi.org/10.1561/3300000030

    [Online]. Available: http://dx.doi.org/10.1561/3300000030

    work page doi:10.1561/3300000030

  40. [40]

    Lunar: A toolbox for more efficient universal and updatable zksnarks and commit-and-prove extensions,

    M. Campanelli, A. Faonio, D. Fiore, A. Querol, and H. Rodr ´ıguez, “Lunar: A toolbox for more efficient universal and updatable zksnarks and commit-and-prove extensions,” inAdvances in Cryptology – ASIACRYPT 2021: 27th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, December 6–10, 2021, Proceedings...

    work page doi:10.1007/978-3-030-92078-4 2021

  41. [41]

    (n.d.) GKR input layer chunks

    Polyhedra Network. (n.d.) GKR input layer chunks. Polyhedra Network Documentation. [Online]. Available: https://docs.polyhedra. network/expander/prover internals/input chunks/

    work page

  42. [42]

    How to prove false statements: Practical attacks on fiat-shamir,

    D. Khovratovich, R. D. Rothblum, and L. Soukhanov, “How to prove false statements: Practical attacks on fiat-shamir,” inAdvances in Cryptology – CRYPTO 2025, Y . Tauman Kalai and S. F. Kamara, Eds. Cham: Springer Nature Switzerland, 2025, pp. 3–26

    work page 2025

  43. [43]

    On the evaluation of powers and related problems,

    N. Pippenger, “On the evaluation of powers and related problems,” in 17th Annual Symposium on Foundations of Computer Science (SFCS 1976). IEEE, 1976, pp. 258–263

    work page 1976

  44. [44]

    herumi/mcl,

    M. Shigeo, “herumi/mcl,” Dec. 2025, original-date: 2015-05- 05T00:18:39Z. [Online]. Available: https://github.com/herumi/mcl

    work page 2025

  45. [45]

    BLS12-381: New zk-SNARK elliptic curve construction,

    S. Bowe, “BLS12-381: New zk-SNARK elliptic curve construction,” Zcash Blog, Mar. 2017. [Online]. Available: https://electriccoin.co/ blog/new-snark-curve/

    work page 2017

  46. [46]

    Pairing-friendly elliptic curves of prime order,

    P. S. L. M. Barreto and M. Naehrig, “Pairing-friendly elliptic curves of prime order,” inSelected Areas in Cryptography, B. Preneel and S. Tavares, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 319–331

    work page 2006

  47. [47]

    Imagenet classifica- tion with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classifica- tion with deep convolutional neural networks,” inAdvances in Neural Information Processing Systems, vol. 25, 2012, pp. 1097–1105

    work page 2012

  48. [48]

    Very Deep Convolutional Networks for Large-Scale Image Recognition

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” 2015. [Online]. Available: https://arxiv.org/abs/1409.1556

    work page internal anchor Pith review Pith/arXiv arXiv 2015

  49. [49]

    Scalable zero-knowledge proofs for non-linear functions in machine learning,

    M. Hao, H. Chen, H. Li, C. Weng, Y . Zhang, H. Yang, and T. Zhang, “Scalable zero-knowledge proofs for non-linear functions in machine learning,” in33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 3819–3836. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity24/presentation/hao-me...

    work page 2024

  50. [50]

    ZKTorch: Compiling ML Inference to Zero-Knowledge Proofs via Parallel Proof Accumulation

    B.-J. Chen, L. Tang, and D. Kang, “Zktorch: Compiling ml inference to zero-knowledge proofs via parallel proof accumulation,” 2025. [Online]. Available: https://arxiv.org/abs/2507.07031

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  51. [51]

    zkPyTorch: A Hierarchical Optimized Compiler for Zero-Knowledge Machine Learning,

    T. Xie, T. Lu, Z. Fang, S. Wang, Z. Zhang, Y . Jia, D. Song, and J. Zhang, “zkPyTorch: A Hierarchical Optimized Compiler for Zero-Knowledge Machine Learning,” 2025, publication info: Preprint. [Online]. Available: https://eprint.iacr.org/2025/535

    work page 2025

  52. [52]

    Modular sumcheck proofs with applications to machine learning and image processing,

    D. Balb ´as, D. Fiore, M. I. Gonz ´alez Vasco, D. Robissout, and C. Soriente, “Modular sumcheck proofs with applications to machine learning and image processing,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 1437–1451. [Online]. Ava...

    work page doi:10.1145/3576915.3623160 2023

  53. [53]

    Gzkp: A gpu accelerated zero-knowledge proof system,

    W. Ma, Q. Xiong, X. Shi, X. Ma, H. Jin, H. Kuang, M. Gao, Y . Zhang, H. Shen, and W. Hu, “Gzkp: A gpu accelerated zero-knowledge proof system,” inProceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2, ser. ASPLOS 2023. New York, NY , USA: Association for Computing Machinery,...

    work page doi:10.1145/3575693.3575711 2023

  54. [54]

    ZKPoG: Accelerating WitGen-incorporated end-to-end zero-knowledge proof on GPU,

    M. Li, Y . Yu, B. Wang, X. Fan, and S. Deng, “ZKPoG: Accelerating WitGen-incorporated end-to-end zero-knowledge proof on GPU,” Cryptology ePrint Archive, Paper 2025/765, 2025. [Online]. Available: https://eprint.iacr.org/2025/765

    work page 2025

  55. [55]

    Pipelonk: Accelerating end-to-end zero-knowledge proof generation on gpus for plonk-based protocols,

    Z. Zhang, Y . Cai, W. Yin, X. Wu, Y . Wang, L. Ju, and Z. Ji, “Pipelonk: Accelerating end-to-end zero-knowledge proof generation on gpus for plonk-based protocols,” inProceedings of the 31st ACM SIGPLAN Annual Symposium on Principles and Practice of Parallel Programming, ser. PPoPP ’26. New York, NY , USA: Association for Computing Machinery, 2026, p. 439...

    work page doi:10.1145/3774934.3786448 2026

  56. [56]

    Benchmarking gpu acceleration for zk-snarks with icicle,

    M. Kthiri, “Benchmarking gpu acceleration for zk-snarks with icicle,” https://www.maya-zk.com/blog/gpu-acceleration, 2024, ac- cessed: 2025-08-30

    work page 2024

  57. [57]

    Accelerat- ing zero-knowledge proofs through hardware-algorithm co-design,

    N. Samardzic, S. Langowski, S. Devadas, and D. Sanchez, “Accelerat- ing zero-knowledge proofs through hardware-algorithm co-design,” in 2024 57th IEEE/ACM International Symposium on Microarchitecture (MICRO), 2024, pp. 366–379

    work page 2024

  58. [58]

    Szkp: A scalable accelerator architecture for zero-knowledge proofs,

    A. Daftardar, S. Kumar, Y . Li, B. Reagen, and S. Garg, “Szkp: A scalable accelerator architecture for zero-knowledge proofs,” in Proceedings of the 33rd International Conference on Parallel Archi- tectures and Compilation Techniques (PACT ’24). ACM, 2024, pp. 271–283

    work page 2024

  59. [59]

    Unizk: Accelerating zero-knowledge proof with unified hardware and flexible kernel mapping,

    C. Wang and M. Gao, “Unizk: Accelerating zero-knowledge proof with unified hardware and flexible kernel mapping,” inProceedings of the 30th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’25). ACM, 2025

    work page 2025

  60. [60]

    Need for zkspeed: Accelerating hyperplonk for zero- knowledge proofs,

    A. Daftardar, J. Mo, J. Ah-kiow, B. B ¨unz, R. Karri, S. Garg, and B. Reagen, “Need for zkspeed: Accelerating hyperplonk for zero- knowledge proofs,” inProceedings of the 52nd Annual International Symposium on Computer Architecture (ISCA ’25). ACM, 2025, pp. 1986–2001

    work page 2025

  61. [61]

    Speeding up sum-check proving,

    S. Bagad, Q. Dao, Y . Domb, and J. Thaler, “Speeding up sum-check proving,” Cryptology ePrint Archive, Paper 2025/1117,

    work page 2025

  62. [62]

    Available: https://eprint.iacr.org/2025/1117

    [Online]. Available: https://eprint.iacr.org/2025/1117

    work page 2025

  63. [63]

    Hydra: Succinct fully pipelineable interactive arguments of knowledge,

    W. Zhang and Y . Xia, “Hydra: Succinct fully pipelineable interactive arguments of knowledge,” Cryptology ePrint Archive, Paper 2021/641, 2021. [Online]. Available: https://eprint.iacr.org/2021/641

    work page 2021

  64. [64]

    Full accounting for verifiable outsourcing,

    R. S. Wahby, Y . Ji, A. J. Blumberg, A. Shelat, J. Thaler, M. Walfish, and T. Wies, “Full accounting for verifiable outsourcing,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’17. New York, NY , USA: Association for Computing Machinery, 2017, p. 2071–2086. [Online]. Available: https://doi.org/10.1145/3...

    work page doi:10.1145/3133956.3133984 2017

  65. [65]

    A Hybrid Architecture for Interactive Verifiable Computation,

    V . Vu, S. Setty, A. J. Blumberg, and M. Walfish, “A Hybrid Architecture for Interactive Verifiable Computation,” in2013 IEEE Symposium on Security and Privacy. Berkeley, CA: IEEE, May 2013, pp. 223–237. [Online]. Available: http://ieeexplore.ieee.org/ document/6547112/

    work page arXiv 2013

  66. [66]

    Practical verified computation with streaming interactive proofs,

    G. Cormode, M. Mitzenmacher, and J. Thaler, “Practical verified computation with streaming interactive proofs,” inProceedings of the 3rd Innovations in Theoretical Computer Science Conference. Cambridge Massachusetts: ACM, Jan. 2012, pp. 90–112. [Online]. Available: https://dl.acm.org/doi/10.1145/2090236.2090245

    work page doi:10.1145/2090236.2090245 2012

  67. [67]

    Sparrow: Space-efficient zksnark for data-parallel circuits and applications to zero-knowledge decision trees,

    C. Pappas and D. Papadopoulos, “Sparrow: Space-efficient zksnark for data-parallel circuits and applications to zero-knowledge decision trees,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’24. New York, NY , USA: Association for Computing Machinery, 2024, p. 3110–3124. [Online]. Available: https://d...

    work page doi:10.1145/3658644 2024

  68. [68]

    Time-space trade-offs for sumcheck,

    A. Baweja, A. Chiesa, E. Fedele, G. Fenzi, P. Mishra, T. Mopuri, and A. Zitek-Estrada, “Time-space trade-offs for sumcheck,” inTheory of Cryptography: 23rd International Conference, TCC 2025, Aarhus, Denmark, December 1–5, 2025, Proceedings, Part IV. Berlin, Heidelberg: Springer-Verlag, 2025, p. 37–70. [Online]. Available: https://doi.org/10.1007/978-3-03...

    work page doi:10.1007/978-3-032-12290-2 2025

  69. [69]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778

    work page 2016

  70. [70]

    Plonk: Permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge,

    A. Gabizon, Z. J. Williamson, and O.-M. Ciobotaru, “Plonk: Permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge,”IACR Cryptol. ePrint Arch., vol. 2019, p. 953, 2019. [Online]. Available: https://api.semanticscholar.org/ CorpusID:201685538 Appendix A. Background Definitions A.1. Zero-Knowledge Sumcheck To preventVfrom reco...

    work page 2019