Take the throughput column of the inference table. It is the number that gets screenshotted, and it is the number this page exists to break.

A tokens-per-minute figure is a rate: proven tokens over wall-clock minutes. The denominator is at least honest. The numerator is not a single quantity. Across the systems in this section, "a token" silently means at least four different things.

Four different claims

1. All the tokens the model generated. DeepProve is explicit that this is its contribution, and it is the strongest claim anyone makes:

In this work, we present DeepProve, the first system to enable efficient end-to-end verification of full LLM inference (i.e., for all generated tokens of a prompt) on untrusted cloud servers using zero-knowledge proofs (ZKPs). In contrast, prior work either provides only a proof-of-concept partial implementation for a single token (zkGPT, USENIX'25), or focuses exclusively on specific components of the inference pipeline, such as Softmax (zkLLM, CCS'24).

DeepProve · Abstract

Its throughput figure is therefore the only one in the table that covers a whole generation rather than a single pass. But look at the numerator. DeepProve's tokens-per-minute is the benchmark sequence length divided by proving time, and a sequence is prompt plus completion, the paper's own plaintext comparison is run on "prompts with 128 input and 128 output tokens (sequence length 256)". Half of that numerator was never decoded. It is a proven-tokens-per-minute rate over a certified sequence, which is a stronger claim than anyone else in the table makes, and still not the decode rate a casual reader assumes.

Note carefully how it gets there. DeepProve does not put the autoregressive loop in a circuit, it "achieves end-to-end verification by certifying the correctness of the output sequence rather than encoding the expensive inference computation in-circuit," which it says would force circuit size quadratic in the sequence length or in-circuit RAM. That is a design decision with a cost profile, not a free lunch: among the succinct provers in the table, DeepProve's proofs are orders of magnitude larger than zkGPT's. That is not, however, the price of the sequence: DeepProve's proof size barely moves as its benchmark sequence length grows, while swapping its polynomial commitment scheme moves it a great deal. The proof-size gap is a commitment-scheme choice, BaseFold/HyperKZG against zkGPT's Hyrax, which is one more axis on which these two systems are not comparable.

2. Exactly one forward pass. zkGPT proves a single token. So, in effect, do ZKML, Artemis / Apollo, Lu et al. and ZKTorch, their reported quantity is seconds to produce one proof of one pass. Where papers.yml carries a tokens-per-minute entry for them at all it is tagged derived, we computed it, by dividing sixty by their proving time; that is where zkGPT's and ZKML's figures come from. For Artemis / Apollo and Lu et al. we record no rate at all, and for ZKTorch the field is deliberately null: the paper reports no throughput, and its LLM benchmarks are forward passes over one- or two-token inputs, so deriving a decode rate from them would be a category error rather than a conservative estimate. Nobody in those papers claims a decode rate, and nobody should. (DeepProve characterises ZKTorch the same way, "proofs of correctness for one output token at a time".)

The derivation is not merely conservative, it is generous to the wrong system. Sustained generation is not one forward pass repeated. It has a growing KV cache, growing attention cost per step, and a batching structure that a one-shot prover never has to confront. A single-pass prover extrapolated to a rate is being credited with solving a problem it never faced.

3. A batched circuit over a sequence, with the loop decoupled. zkPyTorch does something more interesting than either, and it is routinely missed because the paper is filed as "a compiler". At its model level it observes that a proof only verifies the output, it does not compute it, so the token-by-token dependency can be broken and all tokens proven in a single batched circuit, turning many small matmuls into one large one. That is the same insight DeepProve builds a whole system around, published earlier, in a paper whose headline number is a per-token cost on a single CPU core.

4. Nobody knows. Jolt Atlas reports an end-to-end proving time for GPT-2 and states neither the sequence length nor the token count. It never discusses autoregression or KV caching anywhere in the paper. Its GPT-2 result cannot be converted into a rate, cannot be placed on the throughput axis, and cannot be compared to anything above, not because the number is bad, but because the unit is unknown. papers.yml records its tokens_per_minute as null and its context_window as null, and that is the honest entry.

And a fifth, off the axis entirely: Hao et al. and NANOZK prove pieces. Hao et al. prove individual non-linear operators; NANOZK proves a transformer block. Neither has proven a model. They belong in an operator comparison, not a system one.

And sometimes, a different model

There is a further degree of freedom, and it is the one most likely to invalidate a comparison outright: the network in the circuit may not be the network in the model zoo.

DeepProve's related-work section makes a specific and checkable accusation against zkGPT, that it proves a modified GPT-2 which "doesn't contain residual connections, attention masks, and the final projection layer," and that these relaxations "significantly circumvent the outlier issues" that make quantization hard. It levels a second one at ZKML, calling its GPT-2 "slightly modified" too.

We cannot confirm the implementation from the outside. What we can confirm is the paper: the strings "residual", "attention mask" and "projection layer" do not appear anywhere in zkGPT's text, a full-text search of the PDF returns nothing. That is not proof of the accusation, but for a paper whose central claim is proving GPT-2, the silence is conspicuous. A GPT-2 without residual connections is a different function, and residual paths are precisely where the large-magnitude activations that make quantization hard tend to live.

The confounders stack, and they all point the same way

Set aside what is proven for a moment and suppose every system reported the same claim. The comparison would still be broken, because at least four variables move at once between the two systems at the top of the table:

Variable	Effect on the comparison
What is proven	A full generation versus a single forward pass. Not the same numerator.
Which model	A GPT-2 with residual connections and attention masks, versus one possibly without. Not the same function.
Context window	The systems' benchmark sequence lengths differ by more than an order of magnitude. Attention is quadratic in it.
Bit width	The faster system runs at the lower precision. Lookup-table cost scales with bit width. See Quantization.
Hardware	CPU core counts, clock speeds and memory differ across every row. zkGPT says it "mainly" attributes its deficit against zkLLM to CPU-versus-GPU rather than to protocol — while claiming a protocol win on top of it.

Every one of those pushes in the same direction, they all flatter the same system. That does not make its result wrong. DeepProve is, by a wide margin, the fastest reported LLM prover, and its lead is large enough to survive a lot of normalization. But the headline ratio between it and zkGPT, the one people quote, is not a protocol comparison, and nobody has isolated the protocol contribution. The honest statement is that the two systems are far apart on a rate whose definition differs between them, and that the gap is not bit-width-normalised, not context-normalised, and not a protocol measurement.

Hardware is not held constant either

zkGPT is CPU-only. Jolt Atlas deliberately runs on a laptop with consumer memory, its entire thesis is on-device proving, and its numbers should be read as what a laptop can do, which is a far more impressive framing than the row it occupies in the table. zkLLM is a datacenter GPU. ZKML and Artemis / Apollo use very large multi-core machines. zkPyTorch's headline is a single core, which makes it the most sandbagged entry in the table and the one most likely to be misread as slow.

A cross-system throughput comparison across that hardware spread is, at best, indicative of which engineering effort is furthest along. It is not a measurement of which protocol is better.

What a paper in this field should report

None of the systems here report all five of these. Most report one or two.

1. The sequence length used in the benchmark, and the number of tokens the proof covers. Without these the throughput figure has no unit.
2. The bit width, and the accuracy delta it costs on a named metric and dataset. A throughput number with unbounded accuracy loss is not a result, any system can go arbitrarily fast by quantizing to garbage.
3. The hardware, including thread count, and which machine the headline figure came from when several were used. (DeepProve is exemplary here and it still takes care: its headline throughput comes from its secondary machine, not its primary one.)
4. Whether the proof covers a generation or a pass, stated in one sentence, in the abstract.
5. Every layer of the reference architecture the circuit does not implement. If the residuals or the attention mask were dropped to make quantization tractable, that is a result about a different network and it belongs in the abstract, not in a competitor's related-work section.