From Workshop to Main Track: What Changed in NanoZK¶

NanoZK asks whether you can cryptographically prove that an outsourced LLM service actually ran the model it claims — without revealing the weights. It first appeared at the VerifAI workshop at ICLR 2026, then landed at ICICS 2026 main track.

The core idea did not change. Three other things did.

1. The bottleneck moved, so the work moved with it¶

The workshop version established that layerwise zero-knowledge proofs over transformer inference are possible: Halo2 with an IPA commitment, fixed-point lookup arguments for the non-linear pieces (softmax, GELU, RMSNorm) that polynomial constraints handle badly.

Possible is not the same as usable. Profiling said the prover spent most of its life in multi-scalar multiplication — not in any of the parts the workshop paper had been clever about. So the main-track work is largely a CUDA kernel:

7.6×    MSM speedup over the CPU prover
40,000× reduction in sumcheck constraints (best case)
620 ms  prove   ·  2.4 KB proof  ·  2 ms verify   (LLaMA-3-1B)

Released as the Rust crate hanfei-shu.

Lesson: a workshop paper is allowed to prove the concept. A main-track paper has to profile the concept and then attack whatever the profile actually says.

2. Zero accuracy loss became a hard requirement¶

Quantizing to make proving tractable, then reporting a small perplexity regression, is an easy trap. Reviewers correctly read that as "the thing you verified is not the thing you would deploy."

The fixed-point lookup design was reworked until the proven computation is bit-identical to the unproven one. Zero accuracy loss is not a bonus line in the results table — it is the property that makes the entire proof meaningful.

3. The threat model got specific¶

The workshop framing was "verifiable ML." Reviewers wanted to know verifiable against whom. The main-track version names it: a service provider with an economic incentive to silently substitute a cheaper model, in settings — regulated finance, healthcare, on-chain inference — where "trust us" is not an acceptable answer and the weights cannot be disclosed for auditing.

Naming the adversary changed which experiments mattered. Model-substitution detection became the headline result rather than an appendix.

The pattern¶

None of these three changes was a new idea. Each was the same idea, held to a higher standard: profile before optimizing, refuse to trade correctness for convenience, and say precisely who you are defending against.

Paper: arXiv:2603.18046v2 · Technical note: /notes/nanozk-layerwise-zk-proofs-llm/