You press "submit" on a loan application at a Vietnamese fintech app, and a machine learning model decides your credit score in minutes. That decision shapes whether you can borrow — yet nobody outside the company can check whether the model that judged you is the same model the bank's compliance team approved, whether it ran honestly, or whether someone quietly swapped it for a cheaper approximation. This is the "black box" trust problem, and it is exactly what zkml (zero-knowledge machine learning) was built to solve.
ZKML is the field where machine learning meets zero-knowledge proofs. A provider runs an AI model behind a closed API, then attaches a cryptographic proof that the inference was computed honestly — without revealing the model's weights, and often without revealing the input data either. The word "zkml" packs three ideas: zero-knowledge (the verifier learns only that the computation is correct), machine learning (the computation being verified is a neural network or statistical model), and a proof that costs milliseconds to check no matter how big the model.
Think about the last time a bank, a hospital, or a social-media feed made a decision with AI that affected you. You could not open the engine and look inside. Zk machine learning changes the contract: instead of "trust us, the model ran correctly," the provider says "here is a mathematical receipt — check it yourself." This article explains how zkml works, why it matters for AI you use every day, why the weight — the trained model — stays secret, and what it means for Vietnam's booming AI-driven finance sector.
Figure 1: The AI Black Box vs a ZKML Receipt — same model, same score, the difference is a proof anyone can check
The trust gap: what you can't see inside a closed AI
Machine learning now powers decisions that touch real money and real lives. Social-media algorithms decide what millions see. Credit models decide who borrows and at what rate. Medical models flag risk. In Vietnam, MoMo's AI credit scoring model already serves millions of previously unbanked users — tiểu thương, freelance workers, students — disbursing loans in minutes using alternative data like bill-payment history instead of collateral or income documents. The model behind such a decision is a trade secret, trained on private data, and worth enormous money to protect.
The tension is obvious: society increasingly demands transparency from AI, while providers have every legitimate reason to keep their models closed. Publishing weights would leak training data and hand competitors the crown jewels — GPT-4 reportedly cost over $100 million to train. So we are stuck in a world where the user must simply trust the box.
This is not merely theoretical. When you pay for a frontier AI API, the provider could serve you a smaller, cheaper model, apply aggressive quantization, or return a cached response — and you would never know. When a fintech computes your credit score, the model deployed in production could differ from the model the regulator approved. These are not attacks in a lab; they are the structural temptation of any closed AI. Zk machine learning removes the temptation by making the honesty of the computation cryptographically verifiable — no trust required.
The core idea: prove the recipe without showing it
The intuition for zkml is best captured by a Vietnamese kitchen analogy: a famous noodle soup recipe (hủ tiếu) is a trade secret. A restaurant cannot hand the recipe to every customer to prove the broth is genuine — but the customer still wants assurance they are eating the real dish, not instant noodles. Zero-knowledge proofs let the restaurant say: "Here is a certificate proving my broth was made with the authentic recipe and the correct process — check the certificate, learn nothing about the recipe."
Now replace "recipe" with model weights. A neural network is, at its core, a very long series of multiply-and-add operations followed by non-linear activations (ReLU, softmax, sigmoid). The weights are the constants in those operations. To prove an inference was computed correctly, the provider expresses the whole model as a circuit — a list of mathematical constraints — then runs a proving algorithm that produces a short proof. The verifier checks the proof against the public input (your features) and the public output (the score). Crucially, the weights are the private witness: they participate in the computation of the proof but are never revealed to the verifier.
The magic property: the verifier's work is tiny and does not grow with the model. A proof that verifies in milliseconds can attest to a model with billions of parameters. That asymmetry — expensive to prove, cheap to verify — is what makes zkml viable.
How the zkml pipeline works
The journey from a trained model to a verified inference has a clear pipeline:
- Model → standard format. The trained model is exported to an open format such as ONNX, which describes the computation as a graph of tensor operations.
- Compile to a circuit. A compiler such as EZKL (the most popular zkml toolkit) converts the ONNX model into a zero-knowledge circuit, quantizing floating-point numbers into integers that live in a finite prime field. This step also calibrates scale and lookup tables so the circuit's accuracy matches the original model.
- Set up keys. The system generates a proving key (held by the provider) and a verification key (public).
- Prove. During inference, the provider runs the model on your input and runs the proving algorithm, producing a proof — typically a few kilobytes.
- Verify. Anyone with the verification key checks the proof in milliseconds. On blockchain, an EZKL verify() costs roughly 200k–500k gas; a smart contract can check the proof and then execute.
Figure 2: The ZKML Pipeline — model → circuit → proof → verification; weights stay private the whole way
The design choices matter enormously. How the compiler lays out the circuit changes proof speed by up to 24×. Non-linear operations like softmax cannot be expressed directly as arithmetic constraints, so systems use lookup tables, piecewise-linear approximations, or polynomial fits. Some of the newest systems (NanoZK) show lookup-table approximations with zero measurable accuracy loss, and decompose large transformers into independent per-layer proofs that run in parallel — a GPT-2-scale block can be proven in ~43 seconds with a 6.9KB proof and 23ms verification.
Why the weights stay secret
The entire point of zkml is that the weights — the trained model — never leave the provider. This is achieved through the zero-knowledge property: the proof convinces the verifier that a valid witness exists (some set of weights that, applied to this input, produced this output) without transmitting the witness.
Two subtleties matter for real deployments. First, a proof on its own does not tell the verifier which model ran — only that some model matching the circuit produced this output. To bind the proof to a specific model, providers publish a model commitment (a hash-like fingerprint of the weights) in the public input. The prover must then demonstrate the weights inside the circuit match that commitment. Dedicated protocols called Commit-and-Prove SNARKs (CP-SNARKs) make this efficient.
Second, most systems reveal the model architecture (number of layers, operation types) while hiding only the weights. That is usually an acceptable trade: open-weight models like Llama variants are common, and the architecture alone rarely reveals the training data or the tuned parameters.
The honest tradeoffs: proving is still expensive
Zkml is not a free lunch. The three costs to know:
- Prover time and memory. Running a GPU inference may take 5 milliseconds; generating the proof can take 5 seconds, 5 minutes, or longer depending on model size and proof system. This makes zkml unsuitable for high-frequency trading or real-time chat at scale today, but perfect for periodic compliance reports, high-value asynchronous decisions, or auditable credit decisions. The field's frontier (DeepProve, Lagrange, 2026) now proves full GPT-2 and Gemma 3 inference at ~86–174 tokens per minute, with verification in 1–3.7 seconds and distributed proving scaling past 1,800 tokens per minute — end-to-end LLM verification is arriving.
- Quantization accuracy. Circuit-friendly integer arithmetic can drift from the original float model. Careful calibration and lookup tables keep the drift at zero in modern systems, but a careless compilation silently degrades the model.
- Circuit correctness. A proof demonstrates the circuit was executed honestly. It does not, by itself, prove the circuit faithfully represents the intended model — a separate equivalence audit is needed. And many proof systems (Groth16) require a trusted-setup ceremony; transparent systems like Halo2 avoid this at the cost of larger proofs.
Zkml AI inference in the real world
These are not laboratory toys. Production use is spreading:
- On-chain finance (DeFi). Decentralized lending protocols like Sentiment use EZKL-compiled GARCH models to compute loan-to-value ratios with cryptographic proof that the risk calculation followed the intended model. On-chain verifiers enforce it; if the proof fails, the transaction is rejected. Credit-scoring pilots (e.g., Obsqra's zkdefi) compile scoring models through EZKL to Groth16 proofs verified on-chain.
- Trustless audits. Researchers (ZkAudit, ICML 2024) show a model provider can publish a commitment of weights and training data, then answer audit queries — "does the dataset contain copyrighted material?", "is the model biased?" — with ZKPs, revealing nothing else.
- Privacy-preserving biometrics. EZKL positions itself as a general, programmable extension of Apple Face ID: verify identity with a model, prove the check ran correctly, and never expose the facial data.
- Verifiable LLM APIs. As DeepProve and NanoZK mature, premium AI APIs can prove they returned genuine output from the claimed model — users gain cryptographic certainty, providers keep their weights.
- Regulated industries. In finance, healthcare, and legal tech, regulators increasingly want to know the model deployed is the exact model approved. A zk proof makes the audit instant and non-invasive.
Figure 3: ZKML Use Cases — one proof core serving DeFi, regulated finance, audits, biometrics and LLM APIs
Zkml in Vietnam: from credit scores to trust
Vietnam is a surprisingly natural home for zkml, because the pieces are already in place. MoMo's AI credit scoring serves millions who lacked credit history, and CIC (the national credit information center) is rebuilding its scoring model around AI with explicit principles of explainability, stability, and regulatory compliance. Nghị định 94/2025/NĐ-CP — effective 1 July 2025 — created a State Bank of Vietnam regulatory sandbox for fintech credit scoring, opening a legal path for innovative models.
Here is the connection: zkml ai inference is what lets an AI-driven lender prove to a regulator — and to a skeptical borrower — that the model in production is the exact model that was validated, that the score was computed with that model, and that no manual override slipped into the pipeline. When a borrower disputes a score, the bank can present a proof rather than an explanation; when CIC audits a partner bank, it can check proofs instead of trusting screenshots. Cryptographic integrity turns "trust the black box" into "check the receipt."
For Vietnamese developers, the barrier to entry is dropping. EZKL is open-source and scriptable from Python; you can compile a small ONNX scoring model to a circuit and verify on-chain today. The recommended first experiment mirrors what most teams actually do: pick a model, quantize it to fixed-point, measure proving time against your latency budget, and confirm the accuracy holds. The gap between "AI works" and "AI can be trusted" is exactly where zkml sits.
Frequently asked questions
What is zkml in simple terms?
Zkml (zero-knowledge machine learning) is a way to prove that an AI model produced a particular output on a particular input — without revealing the model's weights or the input data. Think of it as a tamper-proof receipt for AI computation.How is zkml different from homomorphic encryption or TEEs?
Homomorphic encryption lets you compute on encrypted data (protecting the input, but hiding the computation from the provider). Trusted execution environments (TEEs like SGX) protect both but need special hardware and a trust assumption in the chip vendor. Zk machine learning protects the model and the input while adding a publicly verifiable proof — no special hardware required, and anyone can check the result.Is zkml ready for production?
For structured models (credit scoring, LTV, small neural nets) yes — EZKL already powers on-chain verifiers. For frontier LLMs, it is arriving: end-to-end LLM inference proofs now run at ~86–174 tokens per minute, fast enough for many async use cases. The main limit is prover time and memory, not verification.Do I need a blockchain to use zkml?
No. A verifier can be a phone app, a web server, or a regulator's laptop. Blockchain is attractive because it gives everyone a public, tamper-proof verification point and lets smart contracts react to proof results — but it is an option, not a requirement.What does zkml mean for Vietnamese fintech and AI startups?
It means a lender, insurer, or credit bureau can prove its AI model was executed faithfully to users and to regulators — turning AI transparency from a promise into a mathematical guarantee. With Nghị định 94/2025/NĐ-CP's sandbox for credit scoring and CIC's AI modernization, the regulatory interest is real.Can zkml prove a model was trained correctly?
Proofs of training (showing a model was trained honestly on a given dataset) are the hardest sub-field; ZkAudit has demonstrated trustless audits of training on ImageNet-scale models. Proving inference — the topic of this article — is dramatically cheaper and is the production-ready half of the field.Conclusion
Every day, closed AI systems make decisions about your money, your health, and your information — and ask you to trust the box. Zkml replaces that trust with cryptography: a provider runs the model once, produces a proof anyone can check, and never hands over the weights that make the model valuable. The tradeoff is honest — proving is still expensive, quantization must be handled carefully, and the circuit itself needs auditing — but the direction is unambiguous. The AI industry is moving from "trust us" to "verify it yourself," and zero-knowledge machine learning is the engine of that move.
For Vietnam, the timing is perfect. The country has millions of newly served borrowers, an AI-driven credit bureau modernizing itself, a regulator opening sandboxes, and a developer community that already exports world-class AI talent. The question is no longer whether Vietnamese AI will make decisions — it already does. The question is whether those decisions can be proven. Zkml ai inference is the answer, and the receipt is a few kilobytes long.
Quick Reference
| Property | ZKML (Zero-Knowledge Machine Learning) |
|---|---|
| Purpose | Prove AI inference ran correctly without revealing model weights |
| Core primitive | zk-SNARKs (Groth16, Halo2, Plonky2, GKR, sumcheck) |
| Pipeline | ONNX model → compile to circuit → prove → verify |
| Main toolkits | EZKL, zkml (UIUC), ZKTorch, zkLLM, Jolt Atlas |
| Prover cost | Seconds to minutes (GPU), falls fast each year |
| Verifier cost | Milliseconds; ~200–500k gas on-chain |
| What stays private | Model weights (witness); often input data too |
| What is public | Model commitment, input/output, proof, verification key |
| Real uses | DeFi LTV, credit scoring, trustless audits, biometrics, verifiable LLM APIs |
| Vietnam angle | MoMo AI credit scoring, CIC modernization, Nghị định 94/2025/NĐ-CP sandbox |
| Main limits | Prover time/memory, quantization drift, circuit-equivalence audit |