Zero-knowledge and non-interactive — Hyrax commitments hide the weights, and Fiat–Shamir makes the proof a downloadable 101 kB object anyone can check offline.

• Like zkLLM, zkGPT is genuinely zero-knowledge (Hyrax over BN254 hides the model parameters) — the motivating threat model is a regulator who anonymously queries a provider and demands a proof without seeing the trade-secret weights.
• Its distinguishing property here is being non-interactive: the Fiat–Shamir transform turns the GKR + Lasso protocol into a 101 kB proof that is publicly verifiable offline. This is the sharp contrast with the VOLE systems (Mystique, Hao et al.), which are interactive and designated-verifier and move gigabytes of transcript.
• So among the indexed sum-check systems, DeepProve is not ZK, Jolt Atlas bolts it on with BlindFold, and zkLLM and zkGPT get it for free from Hyrax — with zkGPT additionally publicly verifiable.

Zero-knowledge by construction. Hyrax commitments hide the weights; a zk-sumcheck hides the transcript. This is zkLLM's whole motivation — the weights are the prover's IP.

The resulting proof, compactly sized at less than 200 kB, is designed to uphold the privacy of the model parameters, ensuring no inadvertent information leakage.

zkLLM · Abstract

• Commitments are Hyrax (Pedersen-based): transparent (no trusted setup), homomorphic, and hiding. The proof leaks nothing about the model.
• The sumcheck is a zero-knowledge variant, so the transcript reveals nothing beyond the claimed evaluation. The whole proof is <200 kB and hides the weights end-to-end.
• This is the design goal, not an afterthought: prover = an AI company, weights = its IP, verifier = a regulator. DeepProve offers no hiding; Jolt Atlas adds it separately with BlindFold.

BlindFold, and it is real, implemented code: every round polynomial and claim is Pedersen-committed, and one aggregate relaxed-R1CS of all the sumcheck checks is proved via Nova folding + Spartan. But the ZK path is younger than the clear path, and several bindings are not yet R1CS constraints.

Jolt Atlas' prover executes multiple sumcheck stages, each producing a transcript of polynomial coefficients and verifier challenges. These transcripts are not zero-knowledge, since they reveal the witness. BlindFold retrofits zero-knowledge onto these proofs by encoding the sumcheck verifier as an R1CS circuit and applying Nova-style folding with a random satisfying pair.

Jolt Atlas · §3

Since the number of sumcheck rounds is logarithmic in the original computation size (each round halves the domain), the BlindFold circuit is logarithmic in the size of the computation being proven.

Jolt Atlas · §3.2

The verifier never sees the polynomial coefficients, Horner intermediates, or evaluation values, only their commitments. BlindFold guarantees that these hidden values satisfy the sumcheck verification equations, completing the zero-knowledge property.

Jolt Atlas · §3.3

• 1. Hide the messages. All prover messages — round polynomial coefficients, claimed evaluations — are sent as Pedersen commitments rather than plaintext.
• 2. Encode the verifier. Each sumcheck round contributes one sumcheck-identity constraint $2c_0 + c_1 + \cdots + c_{d_s} = \sigma_j$ and $d_s$ Horner-evaluation constraints implementing $\sigma_{j+1} = g_j(r_j)$ through auxiliary variables $t_0,\dots,t_{d_s-2}$.
• 3. Fold. Relaxed R1CS $(AZ)\circ(BZ) = u(CZ) + E$ folds cleanly under Nova; the real instance $(u=1, E=0)$ is folded with a randomly sampled satisfying instance, so $W_{\text{folded}} = W + r\cdot W_{\text{rand}}$ reveals nothing.
• Circuit size. $O\!\left(\sum_s n_s d_s\right) = O(N\cdot d_{\max})$. Since sumcheck rounds are logarithmic in the computation size, the BlindFold circuit is logarithmic in the size of the computation being proven.
• One extra constraint binds the sumcheck reductions to the PCS: $y_{\text{joint}} = \sum_i \beta_i y_{\omega_i}$, with the evaluation commitment $\bar V = y_{\text{joint}}G + bH$ in the instance. Without it, a prover could satisfy every sumcheck constraint using evaluation values inconsistent with the committed polynomials.

let blinding = F::random(rng);
let commitment = pedersen_gens.commit(&batched_univariate_poly.coeffs, &blinding);
transcript.append_serializable(&commitment);
let r_j = transcript.challenge_scalar_optimized::<F>();

// NOTE: operand_link (X(r2) == max_k - z_c - sat_diff ...) is intentionally skipped here.
//
// In the ZK pipeline all four openings are private and surface to the
// verifier as the zk_mode placeholder zero, while max_k is non-zero,
// so a direct verifier-side check would always fail.

Genuinely and unconditionally zero-knowledge -- it hides the model, which is the whole point -- but designated-verifier. The proof convinces exactly one party, who had to be online to produce it, and it cannot be shown to anyone else.

In particular, our ZK protocol can only prove to one verifier at a time, and the communication cost is fairly high compared to succinct ZK proofs like zk-SNARKs.

Mystique · §8

• The witness is authenticated with information-theoretic MACs held pairwise between prover and verifier, so hiding is not retrofitted -- it is what the substrate does natively. Contrast DeepProve, which never constructs a hiding argument at all, and Jolt Atlas, which rebuilds hiding on top of sum-check with BlindFold.
• But the proof is not an artifact. Soundness rests on the verifier's secret MAC key, so anyone holding that key could have forged the transcript. It cannot be published, posted on-chain, cached, or checked by a second customer. It is a conversation, not a proof.
• The C2A conversion is what makes the interesting claim possible: a model can be publicly committed in advance, then pulled into privately authenticated values for the proof, so the verifier learns the prover used the model everyone already saw a commitment to -- without learning the weights.
• The economic sting is that authenticated values are bound to one verifier's key. In the MLaaS setting the paper motivates, the expensive commitment pull is therefore per client, not amortised once across all of them.

Inherited from Mystique, unchanged: VOLE-based, interactive, designated-verifier. The paper chooses this substrate deliberately, for prover speed and small memory -- and accepts that the output convinces exactly one party.

in our implementation, we use the recent VOLE-based interactive designated-verifier ZK proofs [56–59] due to their fast prover time and small memory footprint.

Hao et al. · §3.3

• The model is hidden -- that is the stated MLaaS goal, protecting the provider's intellectual property -- and hiding comes free with the IT-MAC substrate rather than being retrofitted.
• But there is still no proof object. Everything the Mystique entry says applies verbatim: the transcript is bound to one verifier's key, cannot be published or re-verified, and its size is interactive communication rather than a proof size.
• This is the axis on which the VOLE lineage wins outright and is still not adopted: it is genuinely zero-knowledge today, where DeepProve is not zero-knowledge at all and Jolt Atlas's BlindFold path is young and incompletely constrained. The reason nobody adopts it is public verifiability, not privacy.