Everyone deserves verifiability · the missing half of proven inference
Which
model?
Zero-knowledge proofs of AI inference are arriving. They prove that a computation ran, faithfully, over committed weights. Read that sentence again, slowly · because it contains a hole big enough to serve you a different model through.
The hole.
A proof of inference certifies a relation over committed weights. It does not certify effort, and it does not certify a name. A provider can serve a small, cheap model, commit to its weights honestly, and emit entirely valid proofs · and the proof system has no opinion, because the proof was never about a named model. Only about whatever the prover committed to.
it is a public name for the weights.
Call the attack what it is: a hollow model behind an honest proof. Closing it requires a public weight registry · an artifact an open project can ship and a closed one structurally cannot, because a closed provider cannot publish the very names its proofs would be checked against.
The registry.
So the first artifact of this pillar is deliberately the one with no proof system in it at all: the published open-weight checkpoints now have publicly recomputable fingerprints. Computed without downloading the models · from each checkpoint's own index and ranged reads of its published files · with the tool and the format written down well enough that someone else gets the same number. A proof of inference can then bind to a fingerprint that has a public name attached, and "which model?" stops being a trust question.
What this deliberately does not claim:
that any model has been verified · a fingerprint is a name, not a verdict
that the committed bytes are "the real model" in any sense beyond being the published bytes
that anything about serving-time behavior follows yet · nothing consumes the registry so far
Exactness is the boundary.
The second commitment of this pillar: bit-exact proving of the model's native format, with no acceptance windows. Every deployed fidelity-carrying system hands the prover a per-element tolerance · and there's a theorem (Or Zamir, February 2026) showing a functionally identical adversarial network can steer any target output through windows at floating-point rounding scale. Every bit of tolerance granted the prover is a bit an adversary can steer. A slack-free specification gives it nothing to hide in. Bit-exactness is not pedantry; it is the security boundary.
The cost curve is a choice.
We sorted every speedup this research measured by size. Statement-level and protocol-level levers · proving the smallest true statement, committing everything and auditing a random sample · are worth 10–100×. Prover-level levers are worth 2–4×. The field spends nearly all its effort on the second kind. The industry's cost curve is shaped by proving a statement nobody asked for · and that is the opening. The sampling-audit theorem is machine-checked now: commit everything, prove a sample, and any prover becomes deployable at bounded, quantified leakage.
The stance, for the record: everyone deserves verifiability. The point of doing this in the open is that verifiable inference should not be an enterprise feature. When we surveyed the best-known "open" zkML projects in August, most were not actually open-source · evaluation-only licenses, no-use-rights clauses, missing licenses. The open position is vacant. We intend to occupy it, in public, and we regard the teams publishing production numbers and stating their limitations plainly as collaborators in a worldsystem · competitors in no sense that matters here.
Status, plainly: the registry fingerprints, tool, and format exist and are recomputable; nothing consumes them yet. The proving research is measurements and machine-checked theorems, not a product. The far shore · training runs where the weights stay encrypted end to end · is named so you can watch us walk toward it.