On 11 August Attestable announced a $20M seed round led by Altimeter Capital and TLV Partners. The launch post reads: “The core technical obstacle, practical zero-knowledge proofs, was considered impossible. We solved it.”
Whoever receives a model’s output has no way today to verify cryptographically that it was produced by that model, with those weights, on that input. Zero-knowledge proofs would solve it in principle, and the question is what they cost.
What the company’s technical post states
Attestable’s blog declares two temporary limitations the launch post does not carry: “We support up to 16K tokens in the context window” and “Though we prove all non-linear operations in floating points, we quantize all matrix multiplications to integers”. Further down the same page reads “Our only current limitation is dynamically quantizing the linear operations to 8-bit integers”, which is a different statement from the first, and at a third point “we use floating points for almost all of the operations during inference”.
The benchmarks carry an explicit qualification: “These are alpha results. There is still substantial optimization ahead of us.” The stated hardware is a single H100. On a single 16K sequence the post reports 53 tokens per second, on a batch of four 4K sequences 77 tokens per second, with proofs of 4.35 to 7.92 MiB and verification of 157 to 648 ms on a reference CPU verifier. The post publishes neither wall-clock proving time nor the prover’s memory requirement.
The case study is Gemma 4 31B, which Google’s published model card lists with a native window of 256K tokens. The 16K declared as the prover’s limit is one sixteenth of that, a ratio we derive from the two figures.
On the cryptographic side the post does not name the proof system and publishes no field, FRI query count, grinding parameters or soundness analysis. The claims about post-quantum security and 100 bits of security cannot be inspected from outside.
The numbers in the literature
IACR ePrint 2025/535, by Xie, Lu, Fang, Wang and colleagues, reports in its single performance table, headed “Single-Core Performance”: VGG-16, 15.2 million parameters, 2.2 seconds per CIFAR-10 image, and Llama-3, 8 billion parameters, 150 seconds per token. The paper describes no experimental setup and does not appear in a peer-reviewed venue, so the figure stands as stated by the authors.
Multiplying those 150 seconds by a thousand, our own arithmetic, puts a thousand-token answer above forty-one hours of proving on one core. The extrapolation assumes the per-token cost stays constant, which the preprint does not measure.
arXiv 2603.18046, NanoZK, measures per sub-circuit: an MLP costs about 6.3 seconds of proving alone, roughly 43 including setup, with verification around 22 milliseconds. Attention goes from 0.9 seconds at d=16 to 184 seconds at d=256. Full-block end-to-end proofs are measured up to d=128, and the figure of about 68 seconds per block at d=768 is stated by the authors as a projection on GPU, derived from measured scaling and an estimated speedup range. The authors add that “full soundness still requires verifying every layer”.
The 1000x ratio stated in The Cost of Intelligence
IACR ePrint 2026/1063, The Cost of Intelligence, reports about 0.008 seconds for the forward pass of a small MLP, whose dimensions it does not state, and 0.6 seconds to prove the same pass with zkCNN’s approach. The paper comments “on the order of a 1000x compute blowup”.
The two figures preceding that comment give a ratio of 75, that is 0.6 divided by 0.008, our own calculation, against the 1000x stated. The same ratio follows from the paper’s cost equations, where recomputing them returns absolute values differing by a factor of ten.
Hardware attestation, already in production
Hardware attestation solves a different problem with a different trust model: instead of proving the computation mathematically, it proves the computation happened inside a measured environment.
Google’s Private AI Compute technical brief, of November 2025, describes AMD SEV-SNP enclaves for the frontend and a TPU platform called Titanium Intelligence Enclave for serving, under this rule: “Workload credentials are provisioned only upon successful validation of the node’s attestation against internal reference values”.
Anthropic published a scheme with Pattern Labs on 18 June 2025 in which a TPM measures every boot stage and a keyserver releases keys only when the measurement matches. The document qualifies itself: “This is just a sketch of our research to start a conversation; we’re still early in this work”.
The vendors state which attacks this guarantee does not cover. NVIDIA’s whitepaper on H100 Confidential Compute lists among out-of-scope vectors “Sophisticated Physical attacks” and “Denial of Service attacks”.
What a company can show an auditor today
The level of proof available in production is the log. On Amazon Bedrock, invocation logging is disabled by default, and once enabled the record holds metadata plus the input and output JSON bodies up to 100 KB, beyond which the content goes to S3 and the log keeps the reference.
A log proves the invocation happened, not which weights served it.
What we think
The launch post says the problem was considered impossible and has been solved. The same company’s blog states a context window of up to 16K tokens, matrix multiplications quantised to integers, alpha results and optimisation still to do. They are documents of two kinds: one announces a result, the other records the state of the prover.
The two sets of figures are not comparable with each other. Attestable reports 53 tokens per second on a single H100 for Gemma 4 31B, on a single 16K sequence, in benchmarks it labels alpha. IACR ePrint 2025/535 states 150 seconds per token for Llama-3 8B on a single core. Hardware, model and conditions all differ, so the ratio between the two figures measures no progress.
As of 12 August no public artefact lets a third party re-run those benchmarks, and with no declared proof system the soundness analysis cannot be reviewed.
For anyone deciding today the criterion is which guarantee is needed. To show an auditor that an inference happened in a controlled environment, hardware attestation is available now, within the threat perimeter the vendor declares, which for the H100 leaves sophisticated physical attacks and denial of service out of scope. For a cryptographic proof requiring trust in no hardware, the only proving-to-inference ratio available in the cited work is the 75 we derive from the two timings in IACR ePrint 2026/1063 on a small MLP, and NanoZK’s end-to-end measurements stop at d=128. Comparing the two approaches means comparing the conditions stated next to the numbers: model, hardware, context length and batch size, plus an artefact that allows the measurement to be re-run.
Sources
- Attestable, Proving LLMs at Scale
- Attestable, Company
- IACR ePrint 2025/535, Xie, Lu, Fang, Wang and colleagues
- arXiv 2603.18046, NanoZK: Privacy-Preserving Verifiable Inference for LLM
- IACR ePrint 2026/1063, The Cost of Intelligence
- NVIDIA, Confidential Compute on NVIDIA Hopper H100 (WP-11459-001)
- Google, Private AI Compute technical brief
- Anthropic, Confidential Inference via Trusted Virtual Machines
- AWS, Monitor model invocation using CloudWatch Logs and Amazon S3