Zator
Zator: Verified inference of a 512-layer neural network using recursive SNARKs
Reported benchmarks
| model | layers | recursive steps | constraints | proving time s | verification time s | note |
|---|---|---|---|---|---|---|
| 510-layer conv backbone (MNIST), 1 layer/step | 510 | 510 | 2500000000 | 26966.8 | 24.4 | — |
| 510-layer conv backbone (MNIST), 2 layers/step | 510 | 255 | — | 29082 | 47.7 | — |
| 510-layer conv backbone (MNIST), 3 layers/step | 510 | 170 | — | 30226.8 | 62.7 | Fewer folds, more proving time, and 2.6x the verifier time. The folding overhead is not what you are paying for. |
constraints_note: 2.5B total constraints is the README's figure for the full 512-layer network.
Notes
THE FIRST FOLDING-FOR-ML SYSTEM, and the ancestor of the accumulation line that zktorch now occupies. April 2023, a week-long Hack Lodge project, no paper. It is in this file because it is the cleanest natural experiment in the corpus on a question the later folding papers assume away: what does it cost to make a neural network HOMOGENEOUS enough to fold? The answer is: you have to design the network around the prover, and Zator does it openly. Nova can only fold a repeated step, so the backbone is 510 IDENTICAL convolution layers -- convolutions and not dense layers, because a 784x784 dense weight matrix costs ~350M constraints just to HASH it (MiMC, 220 rotations) before you have proven a single multiplication. That is the homogeneity tax, quantified, and it is why the backbone of the deepest network anyone had snarked was a stack of clones. Even then it does not fully close: head and tail cannot be parameterized like the backbone, so the system emits THREE proofs and the verifier must chain them through their public outputs. SuperNova (heterogeneous steps) was unimplemented at the time; Mira-style accumulation, which is what zktorch uses to fold a real model graph, is the descendant that fixes this. WHAT THE BENCHMARK ACTUALLY SHOWS, AND IT IS NOT WHAT THE HEADLINE SAYS. The headline is depth: 512 layers, "as deep or deeper than the majority of production AI models", 2.5B total constraints. The table underneath it is 7.5 hours of proving for MNIST. Read the two together and the lesson is that DEPTH WAS NEVER THE BINDING CONSTRAINT -- recursion does dissolve it, exactly as advertised, and the field still could not prove a real model afterwards, because the cost lives in the WIDTH of each layer and folding does nothing about that. A 2023 project proving a deeper network than anything in this file, on a dataset nobody has cared about since 2012, is the whole point. THE FOLD IS NOT THE COST. Going from 1 layer/step to 3 layers/step -- i.e. cutting the number of folds by 3x -- makes proving SLOWER (26,967s -> 30,227s), while verification degrades from 24.4s to 62.7s because the final Spartan proof is over a 3x bigger step circuit. The ~10k-constraint folding overhead really is negligible against the per-layer circuit; there is no win available on that axis. Also worth stating plainly: 24 seconds to verify. Nothing here settles on-chain.
Quantization, in full
| bits | None |
|---|---|
| scheme | Scale factors and floor division applied to weights and activations during training. Negative numbers handled by splitting the field at floor(p/2). Bit width never stated. |
| accuracy_retention | None |
| note | The README calls the quantization error "a significant limitation of the network we snarked" and reports no accuracy at all -- not a delta, not an absolute. The model is trained on MNIST. Take the correctness claim as "the circuit proves what the quantized network computed", with no evidence offered about what that network is worth. |
Our reading
What is new
Everything else in this section fits the whole computation trace into one circuit and then fights the size of it. Zator asks the other question: fold the network one layer at a time. It is the first system in this file to prove a neural network with an incrementally verifiable computation scheme rather than a monolithic one, Nova folds a per-layer R1CS step circuit N times into a single relaxed instance, and only that one instance is handed to Spartan and actually proven. Two years before ZKTorch made accumulation respectable with a paper, a week-long hackathon project made the argument with a running system.
It is worth being precise about what "first" means here, because Zator is not a paper, was not reviewed, and does not claim to be a research contribution. It is an existence proof, and the thing it proves the existence of is the design pattern the accumulation line is built on.
What it actually proves
One forward pass of a 512-layer convolutional network on one MNIST digit, quantized, against weights the proof commits to, in three proofs, not one.
The commitment structure is the part worth studying, and it is genuinely nice. Each backbone step takes the previous layer's activation hash as a public input, re-hashes the activations it was handed, and checks the two agree, so the chain of steps cannot be spliced. Alongside it runs a running hash of the weights, $p_n = H(p_{n-1} \| H(W_n) \| H(b_n))$, which means the final folded instance is bound to one specific model and not merely to some model of the right shape. That is the model-substitution defence, built directly into the step circuit, and it is the reason the weight hashing, not the weight arithmetic, ends up driving the design.
The three proofs are the tell. Nova can only fold a step function that is the same every time, and a network's first and last layers are not the same as its middle: the head has to project the image into the working space, the tail has to produce output probabilities. So the system emits one proof for the head, one folded proof for the 510-layer backbone, and one for the tail, and the verifier has to check all three and trace the public outputs across them to confirm they came from the same execution. The README is candid that this is a workaround, and names SuperNova as the fix, with a footnote that SuperNova was not implemented yet.
What the benchmark shows, which is not what the headline says
The headline is depth, a network "as deep or deeper than the majority of production AI models today", roughly two and a half billion constraints. The table above it is MNIST, and the better part of a working day of proving.
Read the two together and the lesson is that depth was never the binding constraint. Nova does dissolve it, exactly as advertised: the recursive overhead really is about ten thousand constraints per step, negligible against the layer being proven. And the field still could not prove a useful model afterwards, because the cost was never in the number of layers, it was in the width of each one, and folding does nothing whatsoever about width. Zator is the clean experiment that shows this, and it shows it by winning: it went deeper than anything else in this file, and arrived at a handwritten-digit classifier.
The sweep across layers-per-step makes the same point from the other side. Cutting the number of folds by folding three layers at a time makes proving slower, not faster, and it makes verification substantially worse, because the final Spartan proof is now over a step circuit three times the size. There is no win hiding on the folding axis. The fold was never the expensive part.
Zator's backbone is 510 identical convolution layers, and the network was designed that way because the prover demanded it. Convolutions rather than dense layers for the same reason: the step circuit must hash its weights to bind them to the running commitment, and the README prices a single 784×784 dense layer at "~350M constraints to hash when using 220 rotations on MiMC", before proving one multiplication.
So the deepest network anyone had snarked is a stack of clones with no dense layer in it, and this is not an incidental choice. It is what folding costs when the step function has to be uniform. Every later folding system inherits this bill and pays it somewhere: ZKTorch pays it in a compiler that decomposes a heterogeneous model graph into basic blocks, and in the seven of those blocks that have no accumulation support and must be steered around.
What to distrust
No accuracy number exists. Not a delta, not an absolute. The model is quantized with scale factors and floor division, the bit width is never stated, and the README volunteers that the resulting error is "a significant limitation of the network we snarked". A proof that a quantized network computed what it computed is worth exactly as much as the network, and we have no evidence about the network. This is not a hidden flaw, it is disclosed, and the project explicitly defers performance and compilation quality to ezkl, but it does mean no correctness claim here transfers to anything.
The benchmark is the backbone, not the system. The table measures 510 folded layers. Head and tail are proven separately and their costs are never reported, so there is no end-to-end number for the 512-layer network the title advertises. The gap is small in relative terms and large in principle: the advertised artifact and the measured artifact are not the same artifact.
Verification is not succinct in any useful sense. The folded instance is checked in tens of seconds, and it degrades as the step circuit grows. Nothing here settles on-chain, which is the motivation usually offered for proving inference at all.
No paper, no review, no author list. The repository states no authors; the acknowledgements
name advisors, not contributors. We record the attribution as unverified in papers.yml and you
should cite the project, not a person, unless you can confirm it independently. Treat every
figure on this page the way you would treat a benchmark in a blog post, because that is what it
is.
Citation neighbourhood
Edges are a proxy: paper A's text mentions B anywhere (body or bibliography). See the full graph.
Discussed in
Other recorded fields
authors_note: 'No paper and no author list in the repository. The GitHub org is lyronctk; the example proofs are hosted in a gist owned by varunshenoy; the README acknowledges Dan Boneh (advising), Nalin Bhardwaj (Nova-Scotia), Srinath Setty (Nova) and Cathie So (circuit library) as advisors, NOT as authors. Recorded as unverified: attribute the work to the project, not to a name, unless you can confirm it.' numbers_note: Every figure comes from the project README (there is no paper and no peer review). The benchmark table is the BACKBONE ONLY -- 510 folded convolution layers. The head and tail layers are proven separately and their proving times are never reported, so no number here is an end-to-end cost for the advertised 512-layer network. objectives: - inference