Papers · Alternatives to ZK · Lightweight Sampling Proofs of Inference

Lightweight Sampling Proofs of Inference

Towards Verifiable AI with Lightweight Cryptographic Proofs of Inference

Pranay Anchuri, Matteo Campanelli, Paul Cesaretti, Rosario Gennaro, Tushar M. Jois, Hasan S. Kayman, Tugce Ozdemir

Venue
IACR ePrint 2026/541
Date
2026-03-17
Numbers from
primary
Paper
https://eprint.iacr.org/2026/541
PDF
https://eprint.iacr.org/2026/541.pdf

Reported benchmarks

modelnoteparams
ResNet-18Adversarial evasion (gradient-descent reconstruction, inverse transforms, logit swapping) failed to escape detection.
Llama-2 7BSame adversarial strategies tested; detection held.7B

Approach

Prover commits to the inference execution trace via Merkle-tree vector commitments, then reveals only sampled entries along random paths from output back to input. No full proof is generated.

Notes

The first trace-sampling scheme aimed at LLM/DNN inference. Positions itself against zkML's >1000x prover overhead. Because the security model is statistical, the interesting audit question is the concrete detection probability as a function of how many trace paths are opened, and how a rational prover optimizes against it -- neither of which is a cryptographic-soundness argument. Authors overlap the SNARK world (Campanelli, Gennaro), so the cryptographic framing is deliberate, not naive.

Our reading

Citation neighbourhood

Builds on
  • none recorded
Cited by, in this corpus
  • none recorded

Edges are a proxy: paper A's text mentions B anywhere (body or bibliography). See the full graph.

Discussed in

Other recorded fields
arxiv: https://arxiv.org/abs/2603.19025
objectives:
- inference
trust_assumption: Statistical + game-theoretic. Explicitly "trades soundness for efficiency."
  Security rests on trace separation between functionally dissimilar models plus a
  RATIONAL prover who faces penalties on detection. Detection probability amplifies
  under repeated queries. This is NOT cryptographic soundness.
security_model_flag: 'IMPORTANT: not comparable to the zkML sections'' soundness.
  A dishonest prover can pass with non-negligible probability on any single query;
  the guarantee is amortized over many queries plus economic penalty. Right fit for
  auditing / large-scale MLaaS, wrong fit for a one-shot on-chain settlement.'
performance:
  claim: Proving time from the order of MINUTES (zkML) to the order of MILLISECONDS.
  concrete_numbers: null
adversaries_tested:
- gradient-descent reconstruction
- inverse transforms
- logit swapping
related:
- veriml
- proof-of-sampling
- zkml-survey