Inference Labs is a leader in verifiable oracles, running one of the largest decentralized zkML proving clusters in the world called DSperse (Bittensor Subnet 2).

Subnet 44 offers state of the art detection and tracking for a variety of vision applications. One of the largest use cases comes in the form of real time soccer (football) game predictions, where score acts as a high quality and near-instant source for the highest quality predictive data regarding player movements, team strategies and ball positioning.

The cost of failure

Generally speaking, computer vision based models are used to inform actions, taken either by humans or agents. Those actions are often high-stakes, such as adjusting open positions on prediction markets / sports betting in football applications, changing input parameters in the case of self-driving vehicles and even directing use of defense for airspace security. In virtually all use cases of vision models, failure has a high cost.

Inference Labs brings verification to AI models and other forms of computations through the use of zero knowledge cryptography. By converting AI models into verifiable “circuits”, cryptographic proofs can be generated for the model when it performs inference, these proofs prove mathematically that the inputs, model inference, and outputs completed in an untampered and fully secure manner. This means that actions performed based on vision outputs can be confident that they’re receiving correct and honest output, regardless of who conducted the inference.

The challenge

The largest constraint of zkML remains in the computational (and subsequent temporal) overhead incurred from proving large models. The relationship between the size of a model, the number of inputs and outputs the model has and the resulting circuit is not necessarily linear in nature as larger models balloon memory usage and overwhelm consumer hardware. To provide verifiable inference on a model as large as YoloV8X while retaining accuracy in it’s outputs was previously deemed too difficult for even cutting edge zkML systems.

Where we started

Inference Labs creates novel and innovative pioneering approaches to verifiable inference. Recently, we released two state of the art frameworks designed to accelerate our mission towards verification for all inferences.

DSperse — A framework for distributed, verifiable inference. DSperse (proprietary patent pending) analyzes AI models to determine optimal locations to create smaller, sub-models (slices) suitable for compilation into zero knowledge circuits. It then selects the best prover backend given the context around which operations each slice performs and creates an optimized chain of zero knowledge circuits to prove the model.

JSTprove — An in-house prover framework which translates AI operations into low-level zero knowledge circuit using sumcheck and GKR. This framework introduces novel and significant performance boosts both in terms of accuracy and resource usage, and expands our ability to support advanced AI models.

This combination of technologies places Inference Labs and Subnet 2 in the best place possible to tackle the problem of large vision model verification. Initial tests were promising. We were able to completely break apart the model into smaller slices and reconstruct identical outputs by running inference on each individual aspect. However a significant challenge was discovered: Despite slicing, each layer was too large to circuitize. Even with enterprise grade hardware, the memory constraints were far too high for feasible usage.

In order to further reduce the size of each individual slice, our first objective was to analyze the structure of the models themselves.

┌───────────┬───────┐
  │ Operator  │ Count │
  ├───────────┼───────┤
  │ Conv      │ 104   │
  ├───────────┼───────┤
  │ Mul       │ 100   │
  ├───────────┼───────┤
  │ Sigmoid   │ 98    │
  ├───────────┼───────┤
  │ Constant  │ 21    │
  ├───────────┼───────┤
  │ Add       │ 21    │
  ├───────────┼───────┤
  │ Concat    │ 19    │
  ├───────────┼───────┤
  │ Split     │ 9     │
  ├───────────┼───────┤
  │ Reshape   │ 5     │
  ├───────────┼───────┤
  │ MaxPool   │ 3     │
  ├───────────┼───────┤
  │ Resize    │ 2     │
  ├───────────┼───────┤
  │ Div       │ 2     │
  ├───────────┼───────┤
  │ Slice     │ 2     │
  ├───────────┼───────┤
  │ Sub       │ 2     │
  ├───────────┼───────┤
  │ Transpose │ 1     │
  ├───────────┼───────┤
  │ Softmax   │ 1     │
  ├───────────┼───────┤
  │ Shape     │ 1     │
  ├───────────┼───────┤
  │ Gather    │ 1     │
  └───────────┴───────┘

The most common operation in the model are convolutions. Based on this, our first task was to determine optimizations for conv operations.

Convolutions

To optimize convolutions we must first understand the fundamentals of what they are and what they do. Perhaps the easiest way to explain this is visually.

A convolution simply applies a weighted transformation to matrices. In the above illustration, we extract two dimensions from the image on the left hand side (height and width) to generate a matrix of pixels within the image. From there, we define a “kernel” which is displayed in the centre of the view. The kernel is usually a small grid, commonly 3x3 as shown above. This grid has numbers assigned to each of the positions. These numbers are called “weights”.

Convolutions work by passing the weighted kernel over top of the provided inputs, multiplying the values beneath (in the original image) with the values defined in the grid (the weights). This process leads to the creation of another image, shown on the right hand side. This convolved output image is referred to as a “feature map”. You may have seen something similar when applying photo filters in photoshop. Succinctly, a convolution applies a learnable weighted filter (kernel) at every spatial position of the input (usually with appropriate padding), producing a feature map through local weighted summation.

Now the question is: How can we optimize this operation such that it fits within a memory-constrained environment such as a zero knowledge circuit? Moreover, how can we better leverage distributed systems to conduct proving work on these operations?

The answer to that question lies in a feature used commonly by GPUs to accelerate graphics rendering: Tiling.

This method essentially entails breaking images or large pieces of data into smaller chunks called tiles. The key benefit of this approach in conventional graphics acceleration comes from improved cache locality and drastically reduced external memory bandwidth usage. In tile-based rendering (common in mobile and embedded GPUs like PowerVR or many ARM Mali designs), the framebuffer and associated data (depth, color, textures) are processed one small tile at a time — often 16×16 or 32×32 pixels — entirely within fast on-chip memory. This avoids repeated round-trips to slower off-chip DRAM for every pixel operation, as intermediate reads/writes (e.g., depth testing, blending, texture fetches) stay local. Spatial locality is exploited because neighboring pixels tend to access similar data, keeping more relevant information in cache and minimizing expensive memory transfers.

Analogously, in zero-knowledge circuits — where prover memory is often severely constrained (sometimes to just a few GB even for massive computations in zk-SNARKs or zk-STARKs), tiling offers a path to handle operations that would otherwise exceed available RAM during proving or polynomial commitment steps. This mirrors how tiled GPUs bin geometry per tile and defer full shading until the tile fits on-chip.

Why tiling works

Since convolutions require context about surrounding data to calculate individual points of data, a valid and reasonable question to ask would be “Can convolutions be divided in a lossless manner?”.

The answer to this question is yes with important constraints. Each tile must be slightly overlapped with other, nearby tiles in order to avoid scenarios where the kernel incorrectly factors the edges of the tiles into it’s calculation. In practise, this works by adding a number of pixels around each tile, performing the convolution, then discarding the outputs from the overlapped pixels. This process then allows the non-discarded portion to maintain 100% parity with a convolution performed over that region of pixels and thus can be stitched together with the results of the other tiled convolutions to form the final feature map without losing data. Technically, due to overlaps, the total size of the data convolved is larger than the original size of the image. However, due to the performance gains from parallel processing and reduction in individual input size per-tile versus the full image, the tradeoff is worth it.

Parallel Tiling

Now that we’ve successfully extracted tiles into their own respective zk circuits, near-real time proving can be conducted on each of the tiles in parallel across cores or nodes in distributed networks. This leads to a massive increase in the performance of the operation. Previously it was not possible to prove large vision models due to extreme circuit sizes, even with a vast expanse of compute. Through a thoughtful redesign of the process for generating proofs from a first-principles perspective, it’s now feasible and fast.

Next Steps

Though the above optimizations were a substantial unlock for proving efficiency, we’re not stopping there. Similar approaches are being explored and implemented with a variety of other operations within the model to provide the fastest and highest quality result for vision’s real time needs.

Inference Labs has deployed all three of score’s base models to our subnet, leveraging real, production grade proving of large vision models at scale with proof coverage in excess of 30% per model.

These advancements position Subnet 2 at the forefront of verifiable AI and computation more broadly. Our in-house DSperse and JSTprove frameworks, combined with novel methods for breaking up large computations in zero knowledge proving, mark the beginning of a new era for verifiable oracles.

In recent years, an ever-growing number of AI-focused cybersecurity vulnerabilities have become commonplace in the aviation industry. In fact, according to a recent Axis Intelligence article, aviation cyberattacks surged 131% between 2022 and 2023, often the result of third-party vendors being regularly exploited.

Unlike traditional IT systems, AI models introduce novel vulnerabilities such as prompt injection, data poisoning, impersonation, and excessive agency that can compromise flight safety, operational integrity, and passenger security. These emerging risks demand an urgent reevaluation of cybersecurity frameworks to address AI-specific threat vectors before they can be exploited on a larger scale.

The Transportation Security Administration (TSA) has explicitly warned that AI systems such as large language models (LLMs), biometric scanners, and operational chatbots have become new attack surfaces that are not safeguarded by current aviation cybersecurity standards. Without integrated, unalterable verification and accountability mechanisms, these vulnerabilities undermine the trustworthiness of AI systems critical to airport operations and passenger safety.

For reference, according to a May 2025 article by generative AI security enterprise NeuralTrust, “A malicious actor could craft specific inputs to manipulate passenger-facing chatbots, performing unintended actions, such as retrieving unauthorized information, executing commands on backend systems it has access to, or generating inappropriate or harmful content attributed to the airline.”

Challenges of this nature often result in conflicting commands notifying airport personnel of operational inconsistencies and safety breaches, highlighting the critical gap in integrated, tamper-proof verification mechanisms that ensure trust and accountability across AI-driven systems.

The Multi-Stakeholder Complexity Problem

Airports represent some of the most complex technical ecosystems on Earth, supported by hundreds of systems such as data pipelines, communication protocols, and more, that are inherently managed by dozens of stakeholders.

These include airline operators and aircrafts, technology vendors, maintenance providers, regulators, security agencies, and others, all of which deploy proprietary AI and autonomous systems to ensure that airports remain safe and efficient at all times no matter the circumstances.

This complexity creates several risk types in airport environments, including:

● Opaque vendor systems: Airport operators struggle to carry out adversarial testing or validate log authenticity when vendors provide closed-source, proprietary solutions.

● Compromised audit trails: Event logs can be manipulated or concealed within protected vendor firewalls, eliminating reliable traceability after incidents.

● Mixed equipment operations: Heterogeneous system variability (consisting of AI models, autonomy levels, and communication protocols) can lead to compatibility issues, limited interoperability, and unexpected challenges for equipment operations.

● Human-AI friction: Ground personnel may maliciously prevent, modify, or override automated systems due to fears of job security or operational performance challenges, introducing safety risks that existing systems cannot verify or detect.

Some analysts warn that airport vendor risk is so severe that continuous maturity assessment and real-time monitoring have become baseline requirements. However, even with the implementation of such practices and the fact that traditional airport infrastructure has improved the operations and monitoring of airport applications and systems, it has not yet delivered data verifiability.

Exploring the Aviation AI Standards Landscape

Understanding the Importance of ISO/IEC 42001

As a whole, the AI standards landscape continues to make meaningful progress but is still susceptible to critical gaps related to AI integrity and cybersecurity.

Introduced in December 2023 as the first certified framework for responsible AI management, ISO/IEC 42001 is specifically designed to standardize processes for governance, data quality, and risk management for AI applicability across industries. Nonetheless, it is not able to verify that AI outputs themselves are authentic and tamper proof.

In February 2025, Changi Airport Group became the world’s first airport to achieve ISO/IEC 42001 certification, covering five AI-driven commercial and passenger applications including customer lifetime value forecasting, product recommendations, propensity prediction, generative AI search, and passenger transfer estimation.

In addition to Changi Airport Group’s recent certification, KPMG Australia and others have already obtained ISO 42001 certification, positioning the compliance framework as the standard for global AI regulation, specifically as the go-to standard supporting the EU AI Act.

When asked about the impact of ISO 42001 certification in the airline industry, the CEO of the British Standards Institution (BSI), Susan Taylor Martin, noted that, “AI is a transformational technology. For it to be a powerful force for good, trust is critical. The publication of the first international AI management system standard is an important step in empowering organizations to responsibly manage the technology, which in turn offers the opportunity to harness AI to accelerate progress towards a better future and a sustainable world.”

Explaining the Impact of the SAE G-34 & EUROCAE WG-114 Standards

Aviation-specific work by SAE International’s G-34 committee and EUROCAE’s WG-114 task force consisting of more than 600 industry-specific participants including Airbus, Boeing, Federal Aviation Administration (FAA), European Union Aviation Safety Agency (EASA), National Aeronautics and Space Administration (NASA), Thales, Honeywell, and several major Original Equipment Manufacturers (OEMs) will soon produce ED-324, the first standard upholding the development, certification, and approval of AI solutions in the aeronautics industry.

Specifically, the ED-324 standard will be focused on Airborne and Air Traffic Management (ATM) domains, covering machine learning (ML) data management, implementation and verification, system safety, and human systems integration, among others.

Existing security and cybersecurity-threat standards have made it challenging to adhere to compliance and regulatory requirements for numerous application-specific vulnerabilities related to safety. The newly developed ED-324 framework will help address the industry’s lackluster standards that have increasingly been susceptible to AI- and ML-specific cybersecurity threats like adversarial attacks and breaches and data and model manipulation.

Regulatory Momentum for AI Verification Frameworks

In recent months, regulatory momentum in AI aviation has continued to gain traction towards the development of more responsible AI systems in the aviation industry.

For example, the July 2024 FAA Roadmap for AI Safety Assurance report emphasizes risk-based safety assurance, incremental deployment, and continuous monitoring of AI learning systems. While the EU AI Act, which was initiated as law in August of last year, categorizes aviation AI as a high risk sector in dire need of stringent oversight, transparency, and compliance with ISO risk management standards.

In addition, many recent International Civil Aviation Organization (ICAO) workshops on AI in safety data analysis signal a worldwide movement among regulators toward unified frameworks for verification and accountability.

The Cost of Failure: Why Airports Can’t Afford Unverifiable AI

According to a June 2025 Markets and Markets report, the AI aviation market is projected to reach $4.86 billion by 2030 (20–23% CAGR), with autonomous systems increasingly becoming pivotal to streamlining operational safety, route optimization, and sustainability.

As outlined in a recent Air52 aviation article, autonomous ground handling has the potential to reduce ground damage costs by ~42% and typically improves turnaround efficiency by ~15%, but only if safety and accountability can be rigorously verified.

To ensure the safety of passengers and airport and flight staff, it is critically important that airports operate as safely as possible. Unfortunately, algorithmic failures can

sometimes result in aircraft collisions, passenger injuries, regulatory fines, while significantly harming organizational standing.

Fortunately, AI-driven predictive maintenance minimizes aircraft downtown and potential failures before they occur. That said, if AI models are tampered with and deliver incorrect results (such as false positives/negatives), the consequences can be disastrous.

According to GlobalData enterprise practice director Rena Bhattacharya, “No business wants to make headlines because they have used or misused customer or employee information in a way that causes harm. Reputational damage is not the only potential outcome and hefty fines and legal action could ensue.”

Clearly, airports need a way to ensure data is not only correct, but cryptographically verifiable and automatically executed at the blink of an eye across a plethora of systems.

Real-World Use Case: Winter Operations & Deicing

The winter months pose significant challenges related to airport safety and efficiency. In most regions in the Northern Hemisphere, snow, ice, and poor visibility create complicated multi-party coordination issues spanning deicing, aircraft guidance, ground safety, and more.

Thankfully, computer vision AI systems (such as those developed by JCAII) now deliver improved guidance for aircrafts when deicing, helping increase both safety and workflow productivity.

As a whole, these systems leverage AI-enabled real-time monitoring to track and oversee deicing operations, optimize ground traffic, and prevent safety incidences. Additionally, AI-focused systems can improve decision times for aircrafts by ~1 minute per flight, saving more than 140 hours of ground time per year (and $1.2M), for example, at Montreal-Trudeau airport alone, while reducing glycol consumption by 3–10%.

Airport authorities, airline deicing operations, third-party service providers, pilot groups, aircraft guidance systems, and AI vendors all contribute to establishing and meeting deicing Service Legal Agreements (SLAs). That said, there is often a lack of clear, integrated responsibility and enforceability across these entities, leading to gaps in accountability amongst stakeholders.

In addition, various interferences are commonplace in the AI aviation sector and can include:

● Alteration of logs via service providers that mask SLA breaches

● AI recommendations are sometimes unverifiably overridden by ground personnel

● Competing vendors may challenge accountability related delays or safety-specific incidents

● Regulatory enquiries, insurance and business audits often lack tamper-poor forensic record-keeping processes that support fair investigations

An April 2025 article by Synaptic Aviation highlights the effectiveness of AI systems in supporting harsh winter weather operations at airports as follows, “By integrating AI technologies into the operation of Passenger Loading Bridges at airports, operators can improve visibility and enhance overall safety and efficiency. AI systems can offer real-time analysis of environmental conditions, optimize operations for better performance in snowy weather, and ensure safer interactions between the PLB, aircraft, and ground personnel.”

Although digital transformation improves visibility in winter airport operations and aircraft deicing processes, a critical challenge remains: the absence of cryptographic data verifiability.

Without immutable verification integrated into AI airport systems, there is no way to ensure that logs and record data accurately reflect what truly occurred in a given circumstance. This gap enables potential tampering, unverifiable overrides of AI recommendations, disputes over stakeholder accountability, ultimately undermining the safety and efficiency gains AI systems aim to provide during complex winter operations.

The solution: verifiable autonomy via zero knowledge and Proof of Inference (PoI).

The Solution: Auditable Autonomy via Proof of Inference™

In the real-world, humans increasingly rely on cryptographic signatures and biometric systems like Face ID and Touch AI to safeguard accessibility to identity authentication systems and a myriad of online systems, meaning autonomous systems must leverage cryptographic verification to ensure operations are trustworthy.

Zero-knowledge proofs (ZKPs) enable the creation of cryptographic records that verify the correctness of AI outputs without revealing any underlying sensitive data or proprietary model details. Combined with Proof of Inference, ZKPs offer a robust, privacy-preserving mechanism to confirm decisions are authentic and untampered.

Inference Labs’ Proof of Inference™ framework ensures AI aviation system integrity by following a distinct step-by-step process. These include the following in order:

1. An autonomous AI system generates a prediction or initiates an operational action.
2. Zero-knowledge cryptography is applied to create a targeted verification of the AI’s output without exposing underlying private data, proprietary models, or sensitive vendor infrastructure.
3. For each AI decision, such as a aircraft guidance, ground equipment position, movement, hand off signal, or safety assessment, a cryptographic proof is produced. The proof serves as a non-reputable attestation of the system’s intentions and performance.
4. Vendors then publish these proofs to an open and neutral data store. In essence, proofs offer tamper-evident forensic accountability, disclosing no intellectual model property or sensitive data, while ensuring all actions are independently audible.

Building on the principles of Audible Autonomy and Model Informatics (the study of AI models), this framework is ushering in a new era of verification infrastructure for autonomous systems. In the bigger picture, these technologies ensure transparency, security, and trust in AI-driven operations, representing the fundamental verification infrastructure of the autonomous era.

Our solution delivers several key advantages for airport authorities and their stakeholders, encompassing:

● Coordinated multi-vendor oversight: Establishes transparent, sequential timelines based on proof of actions data to navigate complex stakeholder interactions.

● Regulatory alignment: Future proofed compliance with ISO 42001, EU AI Act, and FAA AI Safety Assurance requirements via fully auditable AI operational lifecycles.

● Forensic accountability: Facilitates dispute resolution, insurance claims, and safety investigations through immutable, verifiable audit trails.

● Confidentiality protection: Authenticates vendor AI activities without exposing proprietary algorithms or sensitive passenger information.

● Reliable cross-system operation: Ensures autonomous systems interoperate safely across heterogeneous standardizations and platforms.

Ultimately, by employing systems like those detailed above, verification becomes a computing primitive, enabling AI agents and robots to operate across networks, enterprises, and borders with verifiable certainty.

Market Opportunity & Industry Implications

Auditable Autonomy and airport AI is not only a critical safety and operational necessity, but a major market opportunity. Some prognostications hypothesize that autonomous transportation and logistics could add more than $400 billion to global GDP by 2035, while the civil aviation AI market is forecasted to grow from $4.9 billion in 2030 to $44.7 billion by 2035.

Regularity frameworks are rapidly evolving to support this transformation and ISO 42001 and related standardizations (ISO/IEC 238944 etc.) are becoming essential for AI deployment in regulated sectors, while mandates like the EU AI Act and FAA safety guidelines require explainability, auditability, and continuous monitoring of high-risk AI systems.

In addition, aeronautics standards such as SAE/EUROCAE’s ED-324 and others will set necessary certification baselines, meaning organizations without AI verification capabilities will risk non-compliance risk delays.

Early adopters (like Changi Airport) gain a critical competitive edge as industry leaders by demonstrating responsible AI governance, signaling trustworthiness to customers, regulators, and partners. As one expert puts it, “Companies deploying best practice guidelines might find themselves ahead of the competition. If people don’t trust AI, they won’t use it, no matter how advanced or beneficial it might be.”

In totality, Audible Autonomy via Proof of Inference, ZKPs, and related systems represent essential systemization frameworks for building trust, safety, and efficiency in modern aviation, turning compliance into a strategic advantage in a rapidly evolving industry. The future belongs to those who can prove their AI systems are not only innovative, but transparent, secure, and cryptographically verifiable.

Introduction

Full zero-knowledge verification of large ML models is computationally expensive, memory-intensive, and slow to produce — it requires complex circuitization and heavy prover work that dramatically increases latency and hardware requirements compared to normal inference. In many real-world cases full end-to-end verification is overkill when only specific subcomputations (e.g., safety checks, IP-sensitive heads, or decision thresholds) actually require cryptographic guarantees.

This is why we engineered DSperse, a modular framework that addresses this by targeted verification: rather than circuitizing an entire model, DSperse lets you circuitize and prove high-value subcomputations — or “slices” — dramatically cutting memory and proof time while preserving verifiability where it matters. The architecture of DSperse is shown in Fig. 1.

Why DSperse?

Full-model zK inference is often impractical — circuitization cost, proof latency, and fidelity loss make many real-world models infeasible to verify end-to-end. Consider a financial fraud pipeline scenario where a large ML model, which is retrained weekly, scores transactions and an accompanying rule-based module decides whether to block a transaction:

• What you don’t prove: the whole ML model (would require repeated, costly recompilation whenever weights change).
• What do you prove: the anomaly-detection slice and the decision rule output. For each transaction, the pipeline produces: (a) the model’s score passed to the anomaly detector, (b) the anomaly detector’s output, and (c) the decision module’s output.

DSperse generates a per-slice proof that the anomaly detector and the decision rule were executed correctly on the provided inputs and that the decision follows the proven outputs.

Experiments and Results

To demonstrate this flexibility, we benchmark DSperse using a LeNet-5 style CNN adapted to CIFAR inputs (batch of 70 images) and two distinct proving systems: EZKL, a Halo2-based proving system with mature tooling, including a public CLI and support for ONNX model import and JSTProve, an internal, research-stage proving system built using Polyhedra Network’s Expander Compiler Collection. Slicing decomposed LeNet into five contiguous slices (two conv blocks + three FC blocks).

Core Technical Facts

Modularity:

• Prover-agnostic. support backends like EZKL, JSTProve (and future JOLT/Noir/JSTProve improvements) plug in per-slice.
• Interchangeable components: slicing module, circuit generation, backend adapter, proof orchestration.
• Supported models: Conv + FC networks (LeNet family). ResNet experiments in progress.

Memory usage results:

• In the sliced configuration, total memory usage for proof generation drops by approximately 38%.
• Mean memory usage during verification falls by roughly 45% under slicing.

We anticipate that the relative memory savings observed here may scale favorably with larger models, as the overhead associated with monolithic circuit construction and execution grows with network depth and width.

Timing results:

• Witness generation time drops by roughly 77% in the per-slice setting, while proof generation time decreases by approximately 66%.
• Verification time shows a more modest improvement, falling by about 38%.

These gains reflect the smaller circuit size and lower computational burden associated with proving just a portion of the model. The full result tables and repo links will be available in Part 2 follow up to this article.

Summary

DSperse enables strategic verifiability — prove the high-value parts and leave the rest as normal inference (or audited), reducing cost and preserving fidelity. The proofs are much smaller and faster to generate, don’t require re-circuitizing the entire model after retraining, and give auditable guarantees for the high-risk parts of the pipeline (the detector and the final decision in our scenario).

Full details in our new whitepaper: DSperse: A Framework for Targeted Verification in Zero-Knowledge Machine Learning.

Key Takeaways

• Decentralized AI Explained: AI models are deployed, trained, and inferred across distributed networks, increasing trust, resilience, privacy, and regulatory compliance compared to centralized providers.
• Failures of Centralized AI: Centralized AI faces issues with trust/verifiability, privacy/regulation, high costs/latency, and single points of failure, undermining security and flexibility.
• Verifiable Inference as a Solution: Zero-knowledge proofs (ZKPs) and modular protocols enable trustless, private, and verifiable AI inference, unlocking new markets and business models.
• Broad Industry Applications: AI inference supports hardware, enterprise AI, edge devices, generative AI, NLP, robotics, finance, telecom, supply chain, and more.
• Market Size and Growth: The global AI inference market is projected to reach $106B by 2025, with 5–10% expected to shift to verifiable, decentralized solutions, with a projected TAM of $10B — $15B annually in the near term.
• Inference Labs’ Position: Protocols like Subnet 2 and Sertn are pioneering practical, cost-effective decentralized AI compute and verifiable inference for enterprises, developers, governments, and others.

What is Decentralized AI?

Decentralized AI refers to the deployment, training, and inference of artificial intelligence (AI) models across distributed networks, rather than relying on a single centralized provider.

This paradigm shift in the way AI systems are built represents a model driven by the need for increased trust, resiliency, privacy, and regulatory compliance in an era where AI is increasingly embedded in critical infrastructure.

Through protocols such as Subnet 2 and Sertn, Inference Labs is pioneering the use of zero-knowledge cryptography via zero-knowledge proofs (ZKPs), zero-knowledge machine learning (zkML), and other technologies to deliver verifiable AI inference on decentralized networks.

In doing so, these platforms allow anyone to request, provide, and verify AI computations without relying on a single point of trust and exposing sensitive data or proprietary model weights.

Below we’ll break down the addressable AI inference market, highlight where centralized approaches fall short, and explain why verifiable, cost-efficient AI Inference as a Service (IaaS) is poised for exponential growth moving forward.

Where Centralized AI Infrastructure Fails

In many respects, centralized AI infrastructure faces a plethora of challenges, including:

• Trust and verifiability: Users must be able to trust that cloud providers execute models fairly without tampering or bias.
• Privacy and regulation: Sensitive data must be sent to third parties, raising compliance and security concerns, especially in regulated industries such as healthcare and finance.
• Cost and latency: Centralized infrastructure can be prohibitively expensive and slow for latency sensitive applications, particularity at the edge.
• Single points of failure: Outages, censorship, or policy changes by providers can disrupt mission-critical AI services.
• Decentralization: Centralized architectures limit user control and transparency, whereas decentralized systems distribute authority and decision-making across multiple nodes, reducing reliance on any single entity, enhancing resilience and fairness.

These challenges expose organizations to risk of data breaches, loss of control over proprietary information, and reduced flexibility in adapting to evolving regulatory landscapes

The above issues and others create a clear demand for decentralized, verifiable alternatives.

The Case for Verifiable Inference: Quantifying a New Market

Defining Verifiable Inference

Verifiable inference refers to the ability to cryptographically prove that an AI model produced a specific output from a given input without revealing the model itself or sensitive underlying data. Zero-knowledge proofs and modular architecture make this possible, enabling decentralized networks the ability to offer trust-minimized, privacy-preserving AI inference at scale.

The Centralized Baseline: Mapping the AI Inference Market

While not representing verifiable inference specifically, AWS, Google Cloud, and Microsoft collectively dominate the cloud AI market. This has led to an extremely centralized global cloud computing model that rarely supports the best interest of everyday users.

To help us better understand the global AI inference market, it’s important to highlight that the market is projected to reach $106.15 billion by 2025 and $254.98 billion by 2030, with a compound annual growth rate (CAGR) of 19.2%.

While there is no explicit direct market sizing published for verifiable inference per se, industry consensus and regulatory trends suggest 5% to 10% of the total inference market will require cryptographic or verifiable guarantees in the next three to five years.

If we consider the above figures, this 5% to 10% would equate to a decentralized verifiable inference market of $5.31 billion to $10.62 billion in 2025, with this figure expected to grow exponentially with strong growth potential as privacy, compliance, and decentralized AI adoption accelerates.

What’s more, Bloomberg projects the generative AI market could reach $1.3 trillion by 2032, while Gartner, estimates that generative AI (GenAI) spending (including hardware, software, services, and devices) is projected to surpass $644 billion by 2025, representing an increase of 76.4% from 2024.

In addition, global market research and consulting firm Precedence Research projects the total global AI market to reach 2.57 trillion by 2032. Additionally, the blockchain AI market is expected to hit $973.6 million by 2027, representing a strong proxy for decentralized AI infrastructure overall.

The Total Addressable Market (TAM) for Decentralized Inference

Synergies between zero-knowledge, inference verification, AI, and Web3 include applications such as hardware and infrastructure, enterprise AI, edge AI and edge devices, generative AI, machine learning, natural language processing (NLP), and autonomous systems and robotics,

In addition, AI inference, zkML, ZKPs, and the like can be used to support financial services, telecommunications, supply chain and logistics, and regulatory and compliance standards of all shapes and sizes.

By considering growing sector-specific adoption and the quantifiable metrics we discussed above, let’s build a bottom-up estimate for the Total Addressable Market (TAM) of decentralized inference:

• Cloud inference baseline: If the global cloud AI inference spend is $106 billion in 2025, and if 5% to 10% migrates to decentralized, verifiable alternatives in the next five years, it represents a $3.125 billion to $6.25 billion annual market by 2030.
• AI-as-a-Service and edge compute: The AIaaS market is projected to grow to $12.74 billion by 2024, while edge infrastructure spending is projected to grow from $25.3 billion in 2022 to $55.6 billion by 2027, at a CAGR of 17%. If we assume that 10% of these figures are addressable by decentralized solutions, that equates to about 6.8 billion total.

As decentralized edge architecture matures for latency-sensitive and privacy focused workloads, decentralized inference is poised to capture a rising share of edge AI spending, which is projected to surpass 424 billion by 2030.

Taking the above into consideration, if we add $3.125 billion to $6.25 billion from decentralized global cloud AI inference + $6 to $8 billion from AIaaS and edge computing, a conservative 2030 estimate of sector growth equates to a TAM of $10 to $15 billion annually.

The Bittensor ecosystem alone has also seen hundreds of millions (with 72.11% of all TAO staked in the network) in staked value and growing demand for decentralized inference. As DeFi, gaming, and decentralized social networks mature, demand for verifiable AI will only accelerate.

Why Zero-Knowledge and Modular Architectures Change Decentralized AI Economics

Zero-knowledge proofs and modular protocol design fundamentally alter the economics of AI inference:

• Trustless verification: Anyone can verify that an inference was performed correctly, without trusting the provider.
• Privacy by default: Sensitive data and proprietary models remain confidential.
• Composable infrastructure: Modular architectures allow inference, verification, and settlement to be handled by specified nodes, optimizing for cost and performance.
• Global liquidity: Decentralized networks can easily tap into global compute resources, driving down costs and enabling rapid scaling.

By solving the core trust and privacy issues of centralized AI, these technologies are able to unlock entirely new markets and business models.

This shift not only strengthens security and transparency but also democratizes access to AI compute, allowing organizations of all types to participate in advanced AI services. As a result, decentralized AI is positioned to foster innovations in regulated industries, edge deployments, and collaborative AI ecosystems where transparency and privacy are paramount.

The Future of Decentralized AI Inference

Inference Labs is uniquely positioned to capture the decentralized AI inference opportunity. Case and point, our Subnet 2 and Sertn protocols are designed exclusively for decentralized AI compute and verifiable inference and built to serve the needs of enterprises, developers, institutions, and governments alike. By leveraging zero-knowledge cryptography, zkML, and various designed characteristics, we make decentralized AI and inference verification both practical and cost-effective.

The decentralized AI market is not a distant vision, it’s a current rapidly growing opportunity for all market constituents, and it’s bigger than anyone realizes. By quantifying the addressable market for verifiable inference we see a clear path to a 10 to 15 billion market within the next five years, with enormous continued upside as new use cases and regulatory drivers emerge.

Inference Labs is one of the pioneers of decentralized Inference as a Service, ultimately representing a systematic framework built to power the next wave of trusted, decentralized AI services. For investors, partners, and builders, the message is clear: verifiable inference is in its earliest stage of growth and has massive potential.

About Inference Labs

Inference Labs is pioneering the development of blockchain-based decentralized AI through privacy-focused inference verification and zero-knowledge proving systems that leverage machine learning technology. By establishing robust cryptographic protocols, we enable off-chain AI outputs to be cryptographically verifiable, provably correct, private, and secure, ensuring AI models uphold the authenticity of critical data while remaining robust, open, and decentralized. To realize this broader mission, Inference Labs is powering the development of Sertn — an inference verification and zkML proving protocol built on EigenLayer — and Subnet 2, a decentralized inference verification subnet on Bittensor.

Background

The term “Yuma” is used throughout this document in reference to a specific and custom consensus mechanism called “Yuma Consensus” which serves as the heart of the Bittensor network today. Yuma Consensus is responsible for determining emission distribution (among other metric calculations) for each subnet running within the Bittensor network. There are three versions of Yuma which each provide key benefits and tradeoffs. Most commonly, subnets run on Yuma version 2 which is a great general purpose consensus mechanism for effective incentive distribution.

To begin, we’ll describe the latest iteration of Yuma - Yuma 3 and how it differs from it’s predecessor. The key change that Yuma 3 brings relates to how validation functions within the Bittensor network. On each subnet, validators score miners and submit their scores (called “weights”) to the blockchain. Then, every 361 blocks, Yuma Consensus determines how much incentive each miner should receive based on the stake-weighted scores. It also determines the share of dividends that should be allocated to each validator. To determine this, the following calculation is used in Yuma2.

dividends = matmul_transpose_sparse(&ema_bonds, &incentive);

In Yuma3, however, dividend calculations occur differently.

dividends = vec_mul(&total_bonds_per_validator, &active_stake);

In Yuma 2, clipped weights with EMA bonds can dampen early outliers; smaller validators that identify strong miners early may see dividends diluted until broader agreement.

In Yuma 3 with reduced clipping (bonds_penalty < 1), earlier correct discovery can retain more dividend share once others confirm, subject to parameters such as kappa, EMA smoothing, activity/registration masks, and stake distribution. This is an oversimplification of the true differences between the two implementations, but sufficiently explains the practical changes relevant to this article.

The Journey

As contributors to the Bittensor ecosystem through our development of Subnet 2 and active participation in the chain’s evolution via the Church of Rao initiative, we partnered with Rhef at Subnet 12 to integrate Yuma 3 into Subnet 2, marking it as the first subnet to adopt this feature, and to evaluate its effectiveness through a comprehensive analysis. Subnet 2, maintained by Inference Labs and fueled by Bittensor’s incentivization framework, enables ultra performant zero knowledge proving for AI models and acts as a testing ground for cutting edge proving frameworks.

Read more about Subnet 2 in our earlier article: Proof of Inference at the Speed of TAO

Hypothesizing

It all started out with a seemingly simple request from our team to Subnet 12, for assistance in combatting the increasingly concerning impact of weight copying in subnet 2. Despite leveraging commit reveal, weight copiers had amassed a stake weight of 1-kappa, which means consensus was being formed by non-productive validators.

For an overview and explanation of weight copying, existing countermeasures and our efforts to improve this, please see our analysis of weight copying mitigations.

“Rhef I need a hand if I could get a minute or two of your time”

Little did we know, “a minute or two” would turn into months of iteration, debugging and lead to 4 major security improvements in the depths of Bittensor.

After discussing the problem and overviewing potential solutions, it became clear that this situation required the use of Yuma3 and a feature called “Bonds Reset”. The reason being, with Yuma3 (which enables competitive validation) and Bonds Reset (which allows miners to set all validator’s bonds with them to zero), we could effectively take a minority set of honest validators and design the subnet logic in such a way that coordinates miners with those validators to drive their bonds up while causing the copier’s bonds to lag behind.

Rhef has thought deeply about this subject and invaluably recommended splitting the subnet into 8 groups of miners. During any given epoch, 1/8 of the miners would trigger bonds resets, breaking existing bonds validators had formed to them. At the same time, the subnet would dynamically ensure that the weights of those miners, when revealed, would differ significantly from the last weights that had been set. The theory behind this is, when paired with commit reveal which encrypts weights at the time of submission but reveals them in a later epoch, honest validators running application logic would always be one step ahead of the copiers in “discovering” 1/8th of the subnet as better performers.

Initial Release

Version 8.2.0 of Subnet 2 was deployed on June 9th, 2025 and enabled the logic outlined above. By letting miners know about the bonds reset well in advance of this release, we were able to achieve rapid adoption of the feature and eventually enable incentives towards miners that performed these resets on the correct cadence.

There was one critical issue, however. The bonds reset flag could not be enabled, and thus could not impact on-chain bonds. Upon discovering this, we immediately opened a PR to add this as a subnet-owner configurable hyperparameter. While we waited on a subtensor release including the new hyperparameter, monitoring took place to measure the impact of Yuma3 against the newly varied weights. Despite not having bonds reset, the combination of commit reveal and increased weight variability was expected to have a positive impact. Over the course of the next month, we iterated on the subnet’s weighting mechanisms frequently.

Despite the efforts, we were left with a chart that displayed weight copiers remaining at a triumphant position above the pack.

The second attempt

On July 7th (approximately one month after beginning this endeavor), the bonds reset flag was released, allowing us to enable it and collect new data to determine if the feature could be the silver bullet we needed.

Though not a silver bullet, with some tweaking this approach seemed effective for two of the copiers who dropped below the majority of honest validation. However, the top copier was managing to gain ground despite the lengths we had gone to to vary weights, implement bonds reset + Yuma3, and close off every possible avenue for leaking these weights. After reviewing days worth of weight changes, we decided to adjust to a pseudorandom block-hash based selection of miner groupings rather than a fixed uid % 8 strategy. The purpose of this change was to make it incredibly difficult for conventional copying models to predict which set of miners would be selected next without directly running the client code. If our suspicion was correct and the top performing copier was using an LSTM or similar model to predict weights, this would serve as a litmus test as pseudorandomness would render the model useless.

The quandary

This change alone brought us to the most significant and troubling finding thus far. Despite the fact that commit reveal was enabled and set to one interval (meaning weights are revealed one epoch after they’re set), one copier was still submitting perfect weights, regardless of how varied and how pseduorandom the weights were.

How could they do this? The first idea is that perhaps they’ve taken the previous weights and reverse engineered the EMA based pseudorandom algorithm implemented in the client code to replicate the results. However, due to the variability in miner weights and the fact that their values aligned so close with consensus, it was clear that there was a deeper issue at play. For context, it is known that this copier is not querying miners for zero knowledge proofs within subnet 2. Without performing this work, it is not possible to evaluate the response times and thus calculate correct weights for each miner; and weights change significantly between epochs as response times vary.

In any debugging situation that involves a runtime application and decently complex logic, the protocol is to develop a timeline of events, which Rhef suggested we do surrounding commits and reveals. We put together a script to track everything weight related going on in the subnet. At first, the results weren’t too clear. We could see the commit times, epoch times and the commits were revealing during the epoch as expected. However, things changed when we monitored drand pulses to determine when weights were actually decrypt-able. The findings were surprising.

6023261 (epoch 16684)
6023262 (epoch 16684)
6023263 (epoch 16684)
6023264 (epoch 16684)
6023265 (epoch 16684)
6023266 (epoch 16684)
6023267 (epoch 16684)
6023268 (epoch 16684) crv3 commits: [RoundTable21] --> Revealed at Friday, July 18, 2025 10:16:12 AM
6023269 (epoch 16684) crv3 commits: [Kraken]
6023270 (epoch 16684) crv3 commits: [Rizzo (Insured), Openτensor Foundaτion, Yuma, a DCG Company]
6023271 (epoch 16684) crv3 commits: [Owner2]
6023272 (epoch 16684)
6023273 (epoch 16684)
6023274 (epoch 16684) --> Jul 18, 2025 10:15:36 am
6023275 (epoch 16684) crv3 commits: [5G1NjW9YhXLadMWajvTkfcJy6up3yH2q1YzMXDTi6ijanChe, tao5]
6023276 (epoch 16684)
6023277 (epoch 16684) decryptions possible: [5G1NjW9YhXLadMWajvTkfcJy6up3yH2q1YzMXDTi6ijanChe in block 6023275]
6023278 (epoch 16684)
6023279 (epoch 16684) decryptions possible: [RoundTable21 in block 6023268; Kraken in block 6023269; Rizzo (Insured) in block 6023270; Openτensor Foundaτion in block 6023270; Yuma, a DCG Company in block 6023270; Owner2 in block 6023271; tao5 in block 6023275] --> Jul 18, 2025 10:16:36 am
6023280 (epoch 16684)
6023281 (epoch 16684) *epoch crv3 reveals: [RoundTable21, Kraken, Rizzo (Insured), Openτensor Foundaτion, Yuma, a DCG Company, Owner2, 5G1NjW9YhXLadMWajvTkfcJy6up3yH2q1YzMXDTi6ijanChe, tao5] new weights from: [RoundTable21, Owner2, Rizzo (Insured), Openτensor Foundaτion, Kraken, 5G1NjW9YhXLadMWajvTkfcJy6up3yH2q1YzMXDTi6ijanChe, tao5, Yuma, a DCG Company]
6023282 (epoch 16685)
6023283 (epoch 16685)
6023284 (epoch 16685)
6023285 (epoch 16685)

The Discovery

All of the weights committed within the epoch were revealed at least one block before each epoch. This means any weight copier could decrypt the weights before the epoch, calculate consensus and submit it between decryption time and epoch time, and receive full rewards for doing so. We noted two bugs at this point; first the bittensor-drand codebase incorrectly selected the reveal round making it too early, and another bug which revealed weights during the same epoch they were committed.

These findings, while interesting, were not the findings. Clearly, neither were being exploited, as no new commits were made between decryption time and epoch time.

Following this discovery, Rhef dove deep into the bittensor-drand codebase and reviewed its contents meticulously for anything unexpected. In fact, this was a crucial step in unlocking the full picture of this situation. He found that the encryption key charged with protecting weights payloads until revelation was not secure. This logically meant that all weights could be decrypted not just before the epoch, but even before the commit transaction was included in a block. While Rhef got some rest, we devised a decryption script based on his encryption key finding and tested it against weights that were too recent to be revealed.

 UIDs: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 125, 126, 127, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255]
  Values: [62907, 24951, 24673, 24997, 24874, 24623, 26585, 24621, 29177, 65320, 59598, 26826, 52945, 65393, 64772, 57126, 62424, 24643, 26175, 65149, 57901, 64938, 63053, 24631, 65521, 25375, 33853, 55405, 64974, 27723, 65507, 65069, 65524, 65436, 59285, 65360, 24841, 24646, 28088, 45995, 56717, 65403, 58960, 31187, 65479, 61437, 65533, 24735, 24703, 63444, 54460, 65347, 37202, 26086, 24718, 24754, 31879, 62594, 64372, 40540, 59897, 29427, 64860, 25846, 24764, 63190, 52415, 24696, 27239, 44766, 31526, 65513, 25209, 24628, 63673, 65450, 65098, 65457, 65039, 64563, 51874, 30250, 62246, 65504, 27553, 53968, 61209, 24610, 38825, 65474, 65371, 64673, 25423, 28493, 24654, 28710, 36684, 64900, 64439, 24690, 47823, 64503, 63778, 64620, 24799, 24636, 62755, 42324, 65519, 32626, 24650, 51322, 26001, 65510, 25922, 25584, 24619, 26269, 65290, 24626, 64817, 65007, 55856, 45381, 36179, 65530, 35207, 34291, 25049, 65463, 29689, 37731, 27094, 50187, 65305, 54939, 24910, 65484, 64225, 24615, 64724, 26702, 32246, 60458, 65273, 41128, 24684, 50759, 27392, 24663, 33430, 24617, 62058, 65237, 65488, 35686, 25775, 48424, 24726, 65469, 65532, 24891, 64061, 65497, 49019, 24668, 25078, 25527, 65528, 24613, 44152, 39959, 61654, 24930, 24658, 25473, 25287, 34742, 65493, 64301, 42930, 24710, 65412, 58268, 63972, 47217, 25644, 56293, 25708, 65500, 61861, 65124, 60970, 24974, 33021, 24744, 24640, 39387, 65255, 25173, 24813, 60720, 43540, 30549, 28938, 29963, 24678, 65429, 24633, 57520, 65526, 58621, 28286, 65217, 65444, 65173, 49607, 53463, 25108, 65516, 65421, 65382, 64145, 46607, 25330, 24827, 60183, 25023, 65535, 38273, 25139, 41723, 30862, 63562, 26474, 24787, 26369, 24612, 27901, 24775, 63878, 24857, 63321, 25247, 26957, 65196, 65334]
  Version Key: 9000000

This confirmed that, shockingly, weights could in fact be decrypted into plaintext immediately after encryption by validators. The next step was to backtest this discovery to determine if it was the discovery. We patched bittensor-drand with a custom version, using sufficiently randomized encryption and deployed it to the SN2 validator. As soon as it committed weights, we ran the decryption script against the commit.

AES-GCM decryption failed: Error

The implementation was confirmed to be applied correctly, meaning these weights should not be decryptable until the reveal period. Soon after, we received confirmation via empirical evidence that this was the discovery. By this point, the SN2 validator had amassed significant stake weight in the subnet. By securing the encryption of it’s weights alone, the leading copier was forced to fall back to the same conventional copying methods of the others, and lagged behind in terms of dividends as a result.

Disclosure and Resolution

These discoveries were disclosed to the Nucleus development team and a fixes were implemented, reviewed and deployed in Bittensor version 9.9.0 and Subtensor version 3.2.4. In total, four changes resulted from the discoveries made during this endeavor.

• Crucially, randomization of commit encryption keys was introduced to eliminate the potential for standard (non-timelock) decryption of commits.
• Modifications to epoch calculations used in commit reveal were made to ensure the earliest time a commit can be revealed must be within the target reveal epoch, to prevent early decryption.
• Commit messages were updated to include the hotkey of the validator submitting weights, which subtensor cross-checks against the caller of the extrinsic. This is to ensure actors cannot blindly copy their peers’ commits and submit them to the chain as their own.
• Adjustment of reveal buffer logic, again to limit early decryption risk.

Onwards

While this chapter has concluded, the mission to strengthen Bittensor persists. Inference Labs has proposed two Bittensor Improvement Tenets — BIT-0002 and BIT-0008 — to combat weight copying by enabling validators to run zero-knowledge circuits that attest to proper validation. As active contributors within the Church of Rao, Bittensor’s core development hub, we remain committed to advancing the network’s integrity and resilience.

Key Takeaways

• Combating deepfakes with ZKPs: Zero-knowledge proofs (ZKPs) improve the verifiability of media authenticity, ensuring content remains unaltered while preserving privacy.
• Privacy-preserving verification: Zero-knowledge proofs allow users to validate content authenticity without revealing unnecessary personal information, addressing deepfake challenges across media, governance, and compliance.
• Strengthening public trust in media: By integrating zero-knowledge frameworks into content verification systems to combat deepfakes and other related technologies, organizations can restore trust in digital media by ensuring its reliability and credibility.
• Scalable detection and verification: ZKPs support scalable solutions such as zk-Rollups, enabling large-volume and rapid verification of digital content with reduced computational overhead.

Examining Deepfakes and their Societal Impacts

For those unfamiliar, deepfakes make use of artificial intelligence (AI) and deep learning systems to create a representation of a human being that is completely fake. Deepfakes typically come in the form of AI-generated videos, images, or audio that are extremely difficult to distinguish from the real thing.

As ultra-realistic forms of simulated media, deepfakes are increasingly being used to create fabricated content that appears legitimate, making them an impactful tool used to manipulate narratives, carry out fraud and harassment, influence real-world events, and undermine societal cohesion.

Deepfakes are progressively being used as a mechanism to spread misinformation, exploit public trust, and manipulate public opinion. Sadly, deepfakes have gained significant attention in recent years due to their potential to impact various aspects of our society, including geopolitics, international relations, and others.

In particular, potential risks associated with deepfakes include:

• Political manipulation: Deepfakes can be used to fabricate speeches or endorsements by political figures, contributing to the amplification of extremist ideologies to create discord. In the 2024 U.S. elections for example, AI-generated videos falsely depicted candidates supporting radical policies, undermining democratic trust.
• Misinformation and fake news: In recent years, deepfakes have been used to mimic trusted media formats to spread misleading narratives, such as fabricated news reporting endorsing conspiracy theories. In many ways, AI-generated news anchors erode public trust in legitimate journalism by creating viral disinformation campaigns.
• Election interference: Deepfake audio alleging vote-rigging has been known to skew election results, swaying voter decisions hours before parliamentary elections are finalized. These tactics exploit AI’s speed to spread disinformation at critical moments when fact-checking capacity is insufficient.
• Protests and civil unrest: In some instances, deepfakes have been known to incite violence by depicting fabricated events, such as a police chief endorsing brutality against demonstrators. Unfortunately, clips of this nature exploit societal tensions, sparking riots and property damage before ultimately being debunked.
• Corporate fraud: It has become common for criminals to use AI voice cloning and video synthesis for impersonation. For example, businesses across various sectors have suffered significant financial losses after deepfake video calls successfully impersonated C-suite executives, manipulating employees into initiating unauthorized wire transfers.
• Exploitation: Deepfakes are sometimes weaponized to silence and harass individuals, frequently targeting activists, marginalized groups, and other communities. AI-generated content can manufacture compromising scenarios, enabling reputational harm, blackmail, and psychological abuse without explicit material.

The ZKP Solution: Alleviating the Impacts of Deepfakes

Some experts believe that by 2027, 90% of online content may be AI-generated, heightening misinformation concerns and their potential impacts, spanning news media, social networks, alternative forms of online media, IP protection, and others.

As AI-generated deepfakes become increasingly sophisticated, threatening sectors from politics to finance and more, it has become clear that traditional detection methods have progressively waned in efficiency.

Specifically, watermarking and centralized audits have struggled to keep pace as technology continues to accelerate at an exponential rate. In many respects, watermark degradation can occur when files (videos, images, various 3D formats, audio etc.) are reformatted, with many platforms often being susceptible to centralization and manipulation.

Thankfully, several technologies are emerging in recent years as critical tools focused on streamlining the verification and authentication of digital content while preserving privacy, ultimately supporting an internet that mitigates the effects of deepfakes on a grand-scale. These include:

• ZKPs: Zero-knowledge proofs (ZKPs) are a cryptographic primitive that allows one party to prove to another party that a statement is true without disclosing any information beyond the validity of the statement itself.
• zkML: Zero-knowledge machine learning (zkML) is a cryptographic protocol framework that combines machine learning (ML) with zero-knowledge proofs to verify model outputs and computations with revealing underlying sensitive algorithms or data.
• AI inference: AI inference is the process of leveraging trained AI models to generate predictions or decisions based on new data, a process upheld by combining zkML and ZKP to verify the authenticity and privacy of these models without exposing sensitive data.

If we consider the above, in recent years it has become clear that various platform types, institutions, and governments will greatly benefit by combining AI inference, ZKPs, and zkML, especially in the fight against deepfakes and other related fabricated media types.

Overall, by combining blockchain’s immutability with cryptographic verification, ZKPs provide a scalable, decentralized solution to combat misinformation and synthetic media, offering numerous advantages to help mitigate deepfake proliferation.

It should be expected that as AI-generated content increasingly proliferates, standardized protocols for ZKP-based verification will likely emerge, akin to SSL certificates for web security.

As a whole, deepfake solutions built on zkML and ZKPs dramatically improve:

Data integrity and Transparency

Zero-knowledge proofs support immutable, tamper-proof record-keeping, combating centralization and vulnerability to unwanted modification, dramatically improving data integrity of online systems. Additionally, ZKPs help ensure public auditability, eliminating reliance on opaque watermarks and inefficient AI models to improve online media transparency.

Decentralization and Privacy

ZKPs and zkML uphold network decentralization by distributing the verification of node systems in an equitable manner, combating centralized variations that are typically reliant on single entities. Furthermore, zero-knowledge validation helps improve privacy by eliminating the challenges posed by centralized infrastructure which often expose sensitive biometric data, training algorithms, metadata, watermarks, and more.

Scalability and Compliance

Zero-knowledge proofs enable transaction aggregation through zk-Rollups, allowing thousands of transactions to be bundled within a single proof to dramatically improve the scalability of Layer 2 systems, ultimately reducing computational load and on-chain data storage. Moreover, cryptographic proofs robustly support adherence to regulations such as GDPR and others by validating data authenticity without exposing sensitive details, ensuring regulatory compliance while maintaining user-friendly systems and workflows.

Summary

The unique strengths of ZKPs and zkML — spanning data integrity, transparency, decentralization, privacy, scalability, and compliance — position them as transformative tools in the fight against deepfakes. By providing immutable, tamper-proof verification and enabling privacy-preserving validation, these technologies address core vulnerabilities exploited by deepfakes, such as centralized control, opaque authentication, and exposure of sensitive data.

How ZKP-Enhanced Authentication Secures Online Systems

More specifically, the above improvements in ZK-focused authentication help provide the following benefits to a host of online systems:

1. Private deepfake detection via zkML: zkML facilitates media analysis through off-chain AI models and the generation of cryptographic proofs to confirm authenticity without exposing proprietary algorithms. For example, zk-SNARKs are often used to validate video integrity through zk-Proofs, allowing platforms to detect deepfakes while ensuring detection models remain private.
2. Immutable media provenance with ZKPs: Blockchain frameworks help anchor media file metadata (such as creation time, device ID etc.), while ZKPs cryptographically verify authenticity without revealing sensitive data. This technology helps decentralized networks ensure content remains unalterable, replacing fragile watermarks with tamper-proof cryptographic proofs.
3. Secure identity and biometric verification: By combining ZKPs and zkML, it’s possible to help validate age or citizenship via mobile driver’s licenses, online biometric systems, and other mediums, preventing deepfake-enabled fraud without exposing personal data to ultimately ensure sensitive biometrics remain private during verification.
4. Decentralized AI network validation: Cryptographic proofs and zkML decentralize trust by incentivizing nodes to operate in a balanced manner while validating media integrity. As an example, Ethereum validators risk losing staked ETH if caught submitting falsified metadata, representing a contrasting approach to centralized paradigms that are susceptible to breach and vulnerability.
5. Ethical AI training via zkML: Through on-chain data hashing frameworks, ZKPs help verify dataset integrity, while zkML ensures AI models are trained using unaltered data, ultimately providing a valuable framework for a host of industries that require strict compliance and ethical sourcing while preventing biased outputs.

Zero-Knowledge Proofs, Deepfakes, and Verification Moving Forward

As deepfakes continue to evolve and pose significant threats across political, social, and economic domains, traditional detection methods alone are no longer sufficient. The integration of zero-knowledge proofs and zkML offers a powerful, privacy-preserving, and scalable approach to verifying media authenticity and combating synthetic media manipulation.

By enhancing data integrity, decentralization, privacy, scalability, and more, the above cryptographic technologies will increasingly provide a robust framework to restore trust in digital content of all shapes and sizes. As the landscape of synthetic media threats evolves, leveraging ZKPs allows organizations and individuals to verify authenticity without sacrificing privacy or operational efficiency.

Here at Inference Labs, we’re building AI inference and zk-Proof technologies focused on propelling the adoption of ZKP-based verification protocols as a safeguard against misinformation and deepfake proliferation. As these solutions mature, we’ll continue to be part of the movement focused on the development of real-world solutions that empower platforms, institutions, and individuals to authenticate digital media, detect synthetic content, and secure AI systems without compromising sensitive information.

In the big picture, we can’t eliminate deepfakes altogether, but we can build an infrastructure that renders them ineffective, ultimately strengthening the resilience of online information ecosystems and protecting societal cohesion in an increasingly AI-driven world.

About Inference Labs

Inference Labs is pioneering the development of blockchain-based decentralized AI through privacy-focused inference verification and zero-knowledge proving systems that leverage machine learning technology. By establishing robust cryptographic protocols, we enable off-chain AI outputs to be cryptographically verifiable, provably correct, private, and secure, ensuring AI models uphold the authenticity of critical data while remaining robust, open, and decentralized. To realize this broader mission, Inference Labs is powering the development of Sertn — an inference verification and zkML proving protocol built on EigenLayer — and Subnet 2, a decentralized inference verification subnet on Bittensor.

Explore the tech → Dive into our code on GitHub , see what we’re building and fork it to experiment.

Join the conversation → Connect with us on Discord, ask questions, share ideas, and meet fellow contributors.

Stay informed
→ Follow us on Twitter for real-time updates and insights.
→ Read our Medium to learn how our infrastructure powers provable AI.

Key Takeaways

• $10 billion 2030 zk-Proof market: ZKPs exponentially improve the long term viability of AI and Web3, with the global zk-Proof market projected to reach more than $10 billion by 2030.
• Zero-knowledge proofs: Zero-knowledge proofs (ZKPs) are a privacy-focused cryptographic primitive designed to preserve underlying sensitive data.
• ZK-rollup throughput revolution: In this time, zk-Rollups will deliver 83,000 transactions per second (TPS) on Ethereum-compatible chains, surpassing Visa’s 65,000 TPS capacity and reducing fees by ~90%.
• Exponential Web3 demand: Web3 services will require 90 billion zk-Proofs annually, with advances in proof systems cutting cost per proof to ~$0.12.
• Enterprise adoption beyond crypto: Regulated industries such as healthcare, finance, and AI will increasingly use ZKPs to uphold compliance standards, with 40% of Fortune 500 companies expected to adopt ZK tech by 2030.

A Refresher on Web2 Privacy

In many ways, the internet’s second generation — Web2 — was driven by a fundamental technology: encryption.

Initially, the Secure Sockets Layer (SSL) — and later the Transport Layer Security (TLS) framework, cemented themselves as the underlying guardians of online commerce, facilitating everything from credit card transactions, network logins and sensitive file transfers, confidential email exchange, and beyond. If these cryptographic protocols hadn’t existed, it’s unlikely the digital economy as we know it would have materialized.

Today, with the continued emergence of of artificial intelligence (AI) and Web3 — as data breaches and unwarranted surveillance continue to erode digital trust — another cryptographic paradigm is poised to play an equally transformative role in the continued evolution of the internet by redefining online privacy and security: zero-knowledge proofs (ZKPs).

What are Zero Knowledge Proofs (ZKPs)?

As a refresher, zero-knowledge proofs are a cryptographic primitive that allows one party (the prover) to prove to another party (the verifier) that a specific statement is valid without unveiling underlying sensitive data.

Because of their privacy-centric design, ZKPs are reshaping the infrastructure of decentralized systems such as blockchains, AI platforms, and others. In recent years, zk-Proofs have been tasked with underpinning the financial infrastructure of a host of industries in Web3 and beyond.

These include: decentralized finance (DeFi), the Internet of Things (IoT), gaming and NFTs, identity verification, supply chain management, industrial automation, healthcare, banking and finance, logistics and transport, and a host of others.

Because of their many characteristics, ZKPs have the potential to realize a wide range of utilities in the above industries and others. Some of these include:

1. Enhanced privacy: As one of their defining attributes, zk-Proofs help ensure privacy because of their ability to enable statement verification (e.g., identity, transactions) without exposing sensitive information, protecting all-important personal data.
2. Improved security: By minimizing data exposure to unwarranted parties, ZKPs help eliminate data breaches, phishing attacks, identity theft, and more because of their ability to safeguard critical data, ultimately reducing the possibility of manipulation and theft.
3. Regulatory compliance: Through the usability of zk-Proofs, organizations of all shapes and sizes are more readily able to adhere to jurisdictional privacy laws (such as GDPR and HIPAA) without disclosing sensitive user data, resulting in more simplified compliance procedures in a plethora of industries.
4. Scalability: ZKPs allow for the compression of verification processes (such as blockchain transactions via zk-Rollups) to reduce computational load, enabling faster, cheaper transaction processing for a host of network types.
5. Decentralization: ZKPs help increase computing decentralization by supporting infrastructures such as self-sovereign identity (SSI) and others, resulting in the elimination of centralized authorities for credential issuance, credit validation, and other needs.
6. Data minimization: By leveraging zk-Proofs, data minimization allows users to share necessary information (i.e., the ability to verify an individual’s age without revealing their actual birthdate), to more stringently align with equitable privacy-by-design principles.
7. User-friendly authentication: ZKPs have the potential to help simplify a plethora of online authentication processes, replacing passwords with passwordless logins (e.g., SQRL, FIDO etc.), streamlining access to various online services while eliminating credential storage risks.

Zero-Knowledge Origins

Let’s look at a brief history of zero-knowledge technology:

• 1985: ZKPs are first formalized by Shafi Goldwasser, Silvio Micali, and Charles Rackof in the paper The Knowledge Complexity of Interactive Proof-Systems (first published in 1989), as the winners of the Gödel Prize.
• 1990s: Early zero-knowledge use cases focused on solving niche cryptographic puzzles, such as proving secret cave passwords without revealing them are realized (such as the Ali Baba Cave analogy).
• 2016: As a major pioneer in Web3 and crypto, Zcash launches the first ZKP-powered crypto and Web3 platform, enabling private transactions on a public blockchain for the first time.

Zero-Knowledge Proofs: Enhancing the AI Data Economy

All things considered, the economic impact of ZKPs in Web3 is analogous to the impact of encryption and SSL on Web2 by safeguarding a wave of online commerce and connectivity in the 2020’s, 2030’s, and beyond.

In today’s technological landscape, the intersection of zero-knowledge and artificial intelligence is playing an ever-increasing role in shaping critical decision-making processes across a wide range of industries. This will include zk-Proof generation APIs, hardware boxes for proof production, ZK-enabled compliance solutions, and much more.

Many experts feel that ZKP middleware product and service offerings will likely become the foundation of the privacy-focused AI and Web3 sectors. To realize this ultimate goal, it is necessary to leverage zero-knowledge (ZK) proving systems to verify AI inference in a trustless, decentralized, and scalable manner.

At this juncture, we have entered a multi-billion-dollar market where relying on trust is no longer enough — and verifiable and provably correct AI has become essential. In particular, it has become critical for AI systems to be able to prove the correctness of data through zero-knowledge machine learning (zkML) and other related technologies without exposing sensitive information to malicious parties.

For the most part, AI- and Web3-focused protocols that integrate zero-knowledge have a competitive advantage attracting users who value privacy and security. Furthermore, ZKPs are designed to help blockchains be regulatory compliant without sacrificing decentralization. As an example, they can help verify the integrity of computations performed without revealing sensitive user data, potentially bringing with it increased institutional participation.

At this time, ZK-rollup protocols that harness ZKPs — such as Starknet, zkSync, and Polygon zkEVM — are becoming increasingly integrated into the fabric of Web3 and AI infrastructure. These platforms and others, not only solve challenges related to rollup scaling and identity, but act as frameworks capable of spawning a vast range of newfound product and service offerings in market sectors within the Web3 and AI landscape.

Overall, zero-knowledge proofs provide a distinct technological differentiator for Web3 platforms: offering the sought after combination of scalability, privacy, and trustlessness in-one; while increasingly prevalent drivers of ZK expansion include enterprise demand for confidential compliance, AI serviceability and platform integration, Web3 scalability needs (Ethereum’s zk-Rollups), institutional crypto adoption, hardware innovation, and more.

The Economics of Proofs and Their 2030 Trajectory

Once confined to academic papers, rudimentary theoretical concepts, and basic working products, zero-knowledge proofs are now on the verge of catalyzing a multi-billion-dollar Web3 ecosystem.

Just as no progressive online business today operates without leveraging encryption, it’s clear that no serious Web3 venture in 2030 will operate without harnessing zero-knowledge cryptography in some form.

Ultimately, the result will be an internet where users and machines transact with one another in confidence — verifying what’s most important, while revealing only what’s necessary — to support the foundational building blocks of the next generation of the digital economy.

Quantifying the potential size of the ZKP market in the short to medium term is an important step in ensuring that investors appreciate the opportunity to invest in zero-knowledge architectures and hardware, thus ensuring the development of the paradigm for continued growth moving forward.

According to Aligned — a manufacturer of customizable GPU-powered platforms for AI and machine learning (ML) — by 2030, zero-knowledge proofs will underpin a new era of digital connectivity where privacy, scalability, and regulatory compliance coexist in a seamless and interconnected manner.

While conducting their research, Aligned created a framework that analyzes the potential market size and hardware requirements needed to scale zero-knowledge proof generation, beginning with the most prominent use of scaling the Ethereum blockchain and then estimating the market size by projecting the proportion of ZKPs which will be settled on other non-Ethereum L1s.

Ethereum as a Mechanism for an $87 Billion ZKP Market by 2030

The Ethereum blockchain is built to be as secure and decentralized as possible in return for sacrificing scalability. Therefore, Ethereum’s execution efficiency required dramatic improvements through numerous types of Layer 2 solutions — primarily via ZK-Rollups — typically representative as zkEVMs or zkVMs.

Importantly, Aligned notes that its prediction of 87 billion total zero-knowledge proofs by 2030 is based on several calculations related to the continued adoption of Ethereum zk-Rollup Layer 2 scaling solutions.

Consequently, Aligned derived their zk-proof market prediction predicated on the fact that Ethereum will continue to build almost exclusively zkEVMs and zkVMs L2s (via zk-proof settlement) to improve the network’s scalability. Their analysis highlights Ethereum as the cornerstone of their 87 billion total proofs prediction by 2030, while taking into consider several additional factors, including:

• Total number of Zk transactions per Ethereum block: In general, 15 million Gwei is the target gas fee limit per Ethereum block and each proof transaction requires 500,000 Gwei, while individual Ethereum blocks support an average of 30 ZKP transactions.
• Total zk-proofs generated per year on Ethereum: If we equate a total of 30 proofs per zk block to the approximately 7200 daily blocks that the Ethereum blockchain generates, it means that a maximum potential of 216,000 ZKPs are settled on Ethereum each day — or 78.84 million per year. The above totals are likely a starting point in the grand scheme of things, with 25% of Ethereum block space being used by zk-Proofs in 2024, this figure is projected to grow to 90% by 2030 (with 90% less fees per block). Overall, Ethereum Layer 2 scaling platforms will continue to see immense growth because they are able to divide individual gas fees among many zk-Proofs and transactions, making their business model more viable than other competing solutions.
• Increasing number of zk-proofs per block: Each individualized zk transaction within an Ethereum block has the potential to eventually become a rollup or numerous ZKPs with the network’s continued growth. In addition, the number of proofs per zk has the potential to increase as new zk-focused technologies improve and protocol types are developed and the Ethereum platform expands its overall functionality. Aligned’s analysis presumes that at outset, 15 ZKPs would be settled per zk block on L1, expanding to 810 ZKPs by 2027.
• Other non-Ethereum Layer 1 chains: Central to this analysis, we assume that numerous L2 rollup scaling protocols will select the Ethereum blockchain to facilitate the usability of zk-Proofs. Nonetheless, ZKPs will continue to launch on many additional L1s such as Bitcoin, Solana, Sui, NEAR, and others moving forward.

Overall, the above data suggested that at least 87 billion zero-knowledge proofs will be required to support the burgeoning Web3 application sector by 2030, encompassing more than 2.6 trillion total transactions — or 83 thousand transactions per second (TPS).

However, if we compare that to the Visa network, which has reached processing speeds of up to 65,000 transactions per second, and to the Alipay network, which has surpassed more than 250,000 transactions per second, it’s clear that the combination of zero-knowledge proofs and blockchain has vast potential long-term.

Further, if you consider that the above prediction does not consider zk-proof applicability for commercial applications such as supply chain, finance, healthcare, and other enterprise-focused utilities, this could be considered a relatively conservative prediction for the projected growth of zk proving as a whole.

The Digital Shift via ZKPs: Making Privacy the Internet’s Baseline

In a number of ways, zero-knowledge proofs represent more than a technical leap in how we verify data for AI and Web3 — they signal a philosophical shift in how the internet verifies trust. Similarly to how SSL helped facilitate the early functionality of the internet, ZKPs will embed privacy directly into the foundation of our digital interactions, resulting in:

• User empowerment: Users will achieve granular control over data exposure, allowing them to selectively share information, while keeping other sensitive details private.
• Institutional participation: Trillions in traditional assets will migrate to blockchain rails as the connectivity of mainstream finance increasingly integrates with Web3 and AI.
• Global collaboration: Cross-border systems where verification replaces surveillance will become the norm as users continue to realize the limitations of existing centralized infrastructure solutions.

As this reality unfolds, the emergence of increasingly complex zero-knowledge proof mathematics, increased scalability of zero-knowledge proofs within transaction blocks, and the growth of zero-knowledge proving beyond the Ethereum blockchain will become more pronounced.

To summarize the quantifiable metrics we touched on in the section above, Aligned hypothesizes that several key ZKP-focused milestones will be achieved by 2030. These include:

• $10.2 billion total ZKP market: Aligned expects that by 2030, $10.2 billion in revenue will be driven by ~87 billion zk-Proofs per year.
• 2.6 trillion ZKP-specific transactions: As 2030 approaches, Aligned forecasts that a total of 2.6 trillion Web3 application transactions will be secured by ZKPs, surpassing Visa’s peak capacity of 65,000 transactions per second.
• 90% reduction in network fees: By 2030, Aligned projects a 90% reduction in blockchain network fees through Ethereum-focused zk-Rollup scaling.
• Average proof cost of 12 cents: Aligned also anticipates zk-Proof costs to be reduced from an average proof cost of ~$0.21 in 2025 to an average of ~$0.12 per proof in 2030.

In a world where data breaches inflict billions in losses each year, zk-Proofs and other related Web3 and AI privacy frameworks pave the way for innovation to help ensure privacy continues to be a fundamental human right as the internet’s next generation evolves.

The above $10.2 billion ZKP market projection is driven by demand for Web3 and AI systems that verify truth without exposing sensitive data. In particular, ZKPs are focused on producing solutions for critical challenges in scalability, compliance, and data control, positioning them as the cornerstone of a privacy-first internet.

This prediction is more than just a revenue projection — it signals a pivotal shift in the evolution of the internet. It should be noted however, that a 2030 global zero-knowledge proof market of $10 billion is likely quite a conservative estimate and that it could grow to be much larger over the next 5 years.

About Inference Labs

Inference Labs is pioneering the development of blockchain-based decentralized AI through privacy-focused inference verification and zero-knowledge proving systems that leverage machine learning technology. By establishing robust cryptographic protocols, we enable off-chain AI outputs to be cryptographically verifiable, provably correct, private, and secure, ensuring AI models uphold the authenticity of critical data while remaining robust, open, and decentralized. To realize this broader mission, Inference Labs is powering the development of Sertn — an inference verification and zkML proving protocol built on EigenLayer — and Subnet 2, a decentralized inference verification subnet on Bittensor.

Future Outlook: The Trust layer for AI-Driven Economies

Fueled in many respects by the advancement in blockchain, the fusion of AI inference, zero-knowledge machine learning (zkML), and zero-knowledge proofs (ZKPs) isn’t merely incremental, it’s rewriting the rules of digital trust in the 21st century. Enterprises that ignore this convergence risk obsolescence — with those embracing it positioned to define the Web3-AI intersection throughout the 2020’s and beyond.

As the global blockchain market surges toward a projected 1.43 trillion market by 2030 — these technologies will underpin the next level of trust, privacy, and efficiency across a wide range of industries. As is widely expected, regulatory bodies will soon mandate zkML audits for high risk systems, signaling a shift toward cryptographic accountability, showcasing the increased trajectory of the AI inference, zkML, and ZKP markets moving forward.

Overall, the connectivity between advanced AI and cryptographic techniques enables a plethora of newfound utilities to help ensure efficiency, security, and privacy preservation in an increasing number of real-world applications. Some of these include:

• Decentralized finance: As one of the cornerstones of Web3, decentralized finance (DeFi) leverages AI inference for fraud detection risk assessment and other uses, while zkML and ZKPs provide cryptographic proofs that ensure data is accurate and private, enabling compliant and transparent financial services.
• Medical and healthcare: The medical and healthcare industries harness AI inference modeling to analyze encrypted patient and clinical data for diagnostics and so on, with zkML and ZKPs ensuring predictions and research can be validated without exposing sensitive patient data, supporting privacy and regulatory compliance.
• Supply chain management: In supply chain specifically, AI inference helps forecast product and service demand and detect anomalies, while blockchain records each chronological step in an immutable manner; zkML and ZKPs help verify the authenticity and provenance of goods without revealing confidential supplier or logistics data.
• Transportation and logistics: The transport and logistics sectors leverage AI inference to optimize routing, traffic flow, cargo monitoring, and more — with zkML ensuring unbiased and transparent decision-making and ZKPs validating transactions such as toll payments and cargo integrity without tracking individual identities.
• Digital identity management: AI inference verifies biometric and behavioral identity attributes, while zkML and ZKPs allow users to prove identifiable characteristics such as age or citizenship without revealing underlying sensitive data, enabling secure and private self-sovereign identity systems.

Decentralized Finance (DeFi)

In general, DeFi platforms are among the earliest and most impactful adopters of blockchain, AI, and zero-knowledge technologies.

In recent years — DeFi is increasingly supported by AI inference, whose models analyze vast transaction data sets to detect fraudulent activities, unusual patterns, and market manipulation. Addedly, zkML allows these AI models to generate zero-knowledge proofs that verify the accuracy of fraud detection without revealing sensitive user data or proprietary algorithms, ensuring the integrity of all-important compliance and regulatory processes such as Know Your Customer (KYC) and Anti-Money Laundering (AML) are upheld.

Furthermore, ZKP technology can be harnessed to ensure private lending and borrowing by allowing users to prove creditworthiness without exposing sensitive financial details. As an example, zk-SNARKs can validate encrypted user income statements, on-chain collateral assets and credit scores, to ultimately facilitate trustless loan approvals, avoiding biases and tampering.

In addition, DeFi trading platforms also leverage zkML to ensure automated trading bots operate fairly and according to predefined rule-sets, reducing front-running and other malicious behaviors. Moreover, cryptographically verifiable investment and portfolio management that are private in nature can help investors monitor and track their investments while safeguarding their identities.

Medical and Healthcare

As a general rule, healthcare data is highly sensitive, making privacy-preserving technologies essential to ensure streamlined processes for many medical-specific uses. To help support these applications — AI inference models can be used to analyze encrypted off-chain patient data to increase the efficiency of disease detection, personalized treatments, and patient outcomes.

On the other hand, zkML generates cryptographic proofs to confirm AI inference validity without exposing sensitive patient data, ensuring compliance with HIPAA, GDPR, and other related frameworks, unlocking AI in regulated settings, allowing hospitals and healthcare providers to adopt AI while meeting strict privacy laws.

Further, zkML can be harnessed by pharmaceutical companies to maintain proprietary drug discovery algorithm secrecy, while proving the validity of results to partners and regulators. The pharmaceutical industry also benefits from the interconnectivity of blockchain, AI and ZKPs in clinical trial settings and drug supply chain integrity.

Specifically, AI inference and related technologies (ZKPs, zkML etc.) help drug manufacturers store trial data on-chain, ensuring immutability of sensitive data. In addition, the above technologies can be used for AI supply chain modeling to detect data anomalies and potential counterfeit drugs through various encryption techniques.

Supply Chain Management

As a whole, the supply chain industries face numerous challenges — including poor data collection, falsified data, and data isolation. In many instances, data is often completely incorrect, of low quality or quantity, and cannot be properly accessed by all parties involved.

To address the above issues and others, blockchains are designed to improve transparency and immutability by ensuring the verifiable integrity of data in supply chain systems. To help improve the provenance and integrity of supply chain systems, the combination of AI inference and zero-knowledge proofs is increasingly being utilized to dramatically increase supply chain efficiency and privacy.

AI models are typically used to forecast demand, optimize logistics, and detect anomalies such as counterfeit goods and theft. zkML allows these AI predictions to be verified cryptographically without revealing sensitive business data.

Through the serviceability of blockchain, step-by-step supply chain processes are recorded — from raw material provenance, to final delivery via metadata-anchored immutability, and beyond. In particular, ZKPs verify the authenticity of this provenance data without exposing supplier identities of trade secrets, enabling consumers and regulators to trust product origins while protecting competitive information.

Transportation and Logistics

Like most real-world industries, the transportation and logistics industries can benefit from blockchain’s immutability and AI’s predictive analytics, with zero-knowledge proofs ensuring privacy and trust in complex logistics networks.

With regard to transport specifically — AI inference technology can be used to enhance the relationship autonomous vehicles have with their surroundings. This can include the compilation of traffic flow data to improve vehicle routing in cities, leading to reduced congestion and emissions.

In the bigger picture, zkML ensures these AI algorithms remain free from bias, operating in a transparent and equitable manner. On the other hand, ZKPs can be used to validate toll payments and congestion charges without tracking individual vehicle identities, preserving driver privacy.

Blockchain and AI inference can help increase the integrity of cargo and risk management specificities in the transport sector. In logistics and shipping specifically, IoT sensors generally monitor container conditions (such as temperature, humidity, shock etc.), feeding data to AI models that detect anomalies or risks. Blockchain immutability records sensor data, while ZKPs prove cargo integrity to regulators and insurers without exposing proprietary shipment details.

Digital Identity Management

Self-sovereign identity (SSI) systems empower users to control their digital identities without the overarching control of centralized parties. To complement decentralized identity (DID) integrity — AI inference models can be used to analyze biometric data to verify identity attributes such as age, citizenship, and the like. In particular, zkML and ZKPs allow users to prove these attributes without revealing underlying biometric data, ultimately preserving privacy.

Moreover, these technologies can be harnessed to combat Sybil attacks in decentralized networks by analyzing behavior patterns and generating proofs of authenticity. In recent years, governments, institutions, and enterprises have increasingly adopted blockchain-based SSI systems enhanced with zkML to streamline KYC process, improve border control, and secure access management.

Decentralized Trust and Privacy in an AI-Driven World

The amalgamation of blockchain with AI inference, zkML, and zero-knowledge proofs is rapidly reshaping how industries manage trust, privacy, and efficiency across various market segments. From decentralized finance, supply chain and logistics, healthcare and medical, transportation, digital identity, and much more, this interconnectivity is reshaping how the world operates.

In general, blockchain provides the foundational layer of immutability and decentralization, ensuring data integrity while reducing reliance on centralized intermediaries. On the other hand, AI inference delivers powerful insights and automation, transforming raw data into actionable intelligence. Additionally, zkML and ZKPs inject cryptographic privacy and correctness guarantees, allowing organizations to prove the validity of AI-driven data without exposing sensitive information.

As regulatory frameworks evolve and demand for privacy-preserving technologies grows — enterprises that embrace this convergence will unlock new business models, enhance user trust, and gain competitive advantages. The continued maturation of zkML frameworks and efficient ZKP protocols will accelerate adoption, making verifiable AI inference a standard feature of Web3 ecosystems.

In this era, digital trust is no longer an abstract ideal but a cryptographically enforced reality. By harnessing the combined power of blockchain, AI, and zero-knowledge proofs, we’re building a future where privacy and transparency coexist, enabling innovation that is both responsible and resilient for a host of ever-changing applications.

Key Takeaways

• The Web3 landscape: The Web3 landscape is being redefined through the integration of AI inference, zkML, and ZKPs to rewrite the rules of digital trust, privacy, and efficiency across various industries and business models.
• Key industries: DeFi, healthcare, transportation, supply chain management, and digital identity are being transformed through innovative applications of these integrated technologies.
• AI Inference’s role: As a cutting edge paradigm, AI inference is revolutionizing industries of all types via intelligent insights and automation, from fraud detection to logistics optimization and beyond.
• Zero-knowledge technologies: Zero-knowledge frameworks help enhance data privacy and compliance by facilitating data and process verification without exposing sensitive details.
• Blockchain as a foundation: Blockchain underpins these advancements by providing a secure and decentralized infrastructure that ensures data integrity and transparency.

In today’s AI-powered world, inference is no longer just a backend process — it’s a foundational commodity. With generative models becoming foundational infrastructure, the question isn’t just what AI can do — it’s whether we can trust how it does it, prove it, and scale those guarantees across real-world demand.

At Inference Labs, we’re designing a new kind of network — one where Proof of Inference (a system requiring cryptographic evidence that an AI computation was performed correctly), network hygiene, and participation incentives aren’t afterthoughts, but first principles. Proof of Inference means cryptographically proving that an AI model performed exactly as claimed — no black boxes, no hidden processes. This article explores our approach to developing scalable, verifiable AI systems and includes insights directly from the team behind these innovations.

Generative AI is changing the game — but also rewriting the rules of trust. As @cdixon notes, AI’s power to generate at scale has outpaced our ability to prove what’s real, who owns what, and how decisions were made.

Chris Dixon on X (formerly Twitter): "I wrote about why AI needs blockchain-enabled computing, and why I'm optimistic as these technologies converge.AI is going to end the internet as we've known it. Its advancements are inevitable and will be mostly beneficial. But AI is already upending the internet's economic... / X"

I wrote about why AI needs blockchain-enabled computing, and why I'm optimistic as these technologies converge.AI is going to end the internet as we've known it. Its advancements are inevitable and will be mostly beneficial. But AI is already upending the internet's economic...

Meanwhile, researchers like @SashaMTL and @sarahookr are sounding the alarm: inference isn’t free. It’s expensive, resource-hungry, and often misunderstood — especially when you start layering verification on top.

Sasha Luccioni, PhD 🦋🌎✨🤗 on X (formerly Twitter): "To set things clear about DeepSeek + sustainability: (it seems that) training is much shorter/cheaper/more efficient than traditional LLMs, but inference is longer/more expensive/less efficient. So it's worth thinking about the trade-offs that this has in terms of sustainability! / X"

To set things clear about DeepSeek + sustainability: (it seems that) training is much shorter/cheaper/more efficient than traditional LLMs, but inference is longer/more expensive/less efficient. So it's worth thinking about the trade-offs that this has in terms of sustainability!

Sara Hooker on X (formerly Twitter): "Scaling is not the only lever for the next wave of innovation.The optimization space is expanding. For a long time it was solely the algorithm, our machine learning field was based around the notion of a model. It now encompasses both the data space, algorithm and inference... / X"

Scaling is not the only lever for the next wave of innovation.The optimization space is expanding. For a long time it was solely the algorithm, our machine learning field was based around the notion of a model. It now encompasses both the data space, algorithm and inference...

At Inference Labs, we believe verifiable inference is the backbone of a trustworthy AI ecosystem — not just for proving correctness, but for scaling trust itself. We don’t merely publish benchmarks; we share the rationale behind our systems transparently, making our reasoning as open as our circuits.

For this article, we conducted a rapid Q&A with Spencer (Senior Software Developer), Colin (Co-Founder), and Eric (MLOps Engineer). Consider this a glimpse into the whiteboard discussions shaping our roadmap.

Network Hygiene & Ecosystem Design

What is network hygiene, particularly in the context of verifiable inference? How do you prevent spammy inference requests or resource abuse?

SPENCER: Network hygiene is essentially about maintaining a secure, efficient, and stable system. In a verifiable inference marketplace, like Subnet 2 or Sertn, this becomes especially critical. Verifiable inference involves significant computational resources, both for generating proofs and verifying them, making it expensive. We take several key measures to maintain strong network hygiene:

• First, we rigorously analyze our smart contracts and dependencies, running state-of-the-art bug bounty programs to quickly detect and address vulnerabilities. Additionally, we invest in thorough audits of critical components to guarantee network reliability.
• Our team constantly seeks to simplify network operations by reducing complexity, streamlining communications, and automating deployments wherever possible.
• Clean Codebases, we adhere strictly to best practices, such as checks-effects-interactions and single-responsibility principles, ensuring code clarity and network stability.

In practice, core network operations involve transactions that prevent abuse by compensating users who perform intensive computations. This structure safeguards against resource flooding and ensures a fair, secure environment.

How do you balance scalability with decentralization? Can a healthy network handle thousands of inference tasks without becoming centralized?

SPENCER: Balancing scalability and decentralization is fundamental to maintaining a healthy and resilient network. Our strategy includes:

• By supporting multiple proof systems and a diverse range of AI models, we create an environment where numerous operators can specialize in various areas. This approach prevents market dominance by a small group of centralized entities.
• As demonstrated in Subnet 2, the network thrives because operators can optimize for different tasks, from FPGA and GPU-based systems to specialized software adjustments. This diversity fosters healthy competition and prevents centralization.
• Implementation of strategic incentives to maintain network scale in relation to demand for inference tasks. Through systems such as dutch auctions and reward curves, network participants are incentivized to maximize performance and availability. Should one node or a group of nodes go down, another party will assume the responsibilities of the downed node.

What are early indicators of whether a verifiable inference network is healthy or becoming overloaded? Is latency or volume more critical?

SPENCER: Proof latency — how quickly the network verifies inference requests — is the primary health indicator, ideally faster than users performing local inference. Latency reflects technical health, while volume represents overall engagement and market demand. Both metrics are crucial but offer different insights.

Proof Systems & Infrastructure

One of the cornerstones of our approach is JSTProve, a specialized zero-knowledge machine learning (zkML) library. When used alongside the Expander framework, JSTProve dramatically reduces the computing power needed for verification. It does this through advanced math tools (like polynomial commitments) and cryptography designed to work efficiently with modern hardware.

Put simply, JSTProve and Expander make it possible to generate secure proofs at scale, handling thousands of inferences with ease.

How does our zkML (Zero-Knowledge Machine Learning) infrastructure (like JSTProve + Expander) change the cost equation of inference?

COLIN: The biggest challenge with inference verification right now is the high computational cost. Our advanced proof systems, combined with network-scale crypto-economic strategies, introduce clever methods to cut down this overhead without compromising security. Examples of this approach include optimistic inference, liveness guarantees, and proof deferral — each significantly reducing verification costs.

What’s the most misunderstood piece about inference verification

COLIN: One common misunderstanding is:

“Open-source or publicly available models don’t require verification since anyone can re-run the inference themselves.”

While this sounds correct, and often can be, there are important cases where the input data must remain private (such as KYC or age verification). As privacy regulations tighten, we anticipate a growth in applications that perform inference on users’ edge devices, limiting the company’s direct access to private data.

In these scenarios, users will input private data into an open-source model and then produce a cryptographic proof of execution, which can be verified by a third party without revealing the sensitive data itself.

Why did you push for full transparency and open source from day one?

COLIN: The rapid rise of companies like OpenAI and Meta’s LLAMA shows how much investor interest there is in frontier technologies. These technologies have dramatically changed the way we work and access information. With the inherent dynamic between these two facts, the companies responsible for their creation will inevitably be at odds on balancing them. Will they remove accurate but inconvenient content to maintain favor with certain governments? How will they balance maximizing profits with the broader public good?

Providing open-source solutions and exploring alternative business models may help address these challenges. Many companies, including OpenAI, initially promised transparency and openness, acknowledging the potential danger and dragons in the path forward. They have yet to live up to these promises.

Incentive Design & Participation

From a system design perspective, how do you encourage honesty in a proof-optional network?

ERIC: To enable proof-optional networks, we must incentivize honesty through random proof requirements. When proof requirements are lower (meaning proofs are requested less frequently), the temptation to cheat naturally increases, as cheating offers higher rewards for less work. To counteract this, we need stronger penalties or disincentives for cheating. This ensures the expected return from cheating remains lower than the return from being honest.

For example, let’s say a truthful inference requires 1 unit of work for 1 unit of reward, but a dishonest participant could submit a fake inference requiring 0 work and still get 1 reward. If proofs are randomly required roughly once every 100 inferences, penalties for getting caught must be high enough that the dishonest participant’s overall expected return stays below the honest participant’s expected return.

What’s something you think people underestimate about network incentive design?

ERIC: How creative bad actors can be. There might be hidden, external incentives influencing behavior — factors we don’t usually consider when calculating expected value. For example, the immediate reward and the work avoided might not be the only motivations. A malicious actor might specifically target a certain individual or inference type due to external motivations.

In critical scenarios, like an inference influencing a high-value smart contract outcome, a malicious actor might build up trust over a long period, behaving perfectly honestly, only to exploit that trust at a critical moment. I’m thinking specifically about the recent XZ Utils attack and similar extreme scenarios — like repeatedly cheating whenever possible, or never cheating until the exact moment when the payoff is highest. These kinds of possibilities need serious consideration in incentive design.

Final Thoughts: Building Trustworthy AI Networks

The future of AI depends not only on innovative technology but also on the trust we build around it. At Inference Labs, we’re committed to creating transparent, scalable, and secure AI networks through verifiable inference. By emphasizing network hygiene, sophisticated proof systems, and thoughtful incentive design, we aim to empower users and organizations alike with the confidence to rely on AI solutions.

In essence, treating AI inference as a foundational commodity demands that we prioritize transparency and performance in tandem. By doing so, we ensure generative models can scale responsibly, fostering an AI landscape that is both powerful and accountable to its users.

Introduction

The decentralized web is evolving rapidly. With the launch of AR.IO’s new initiatives to expand the Permaweb, a fundamental shift is reshaping our understanding of permanent, verifiable storage in the Web3 ecosystem. At Inference Labs, we believe this evolution is crucial for the commercial viability of decentralized AI — and we are committed to advancing its infrastructure.

In this article, we’ll explore:

• The significance of AR.IO’s recent launch and its connection to Bittensor and Subnet 2.
• How cryptographic verification and trustless AI inference can enhance Arweave’s utility.
• Inference Labs’ role in driving the commercial adoption of the Permaweb.
• Our approach to building verifiable, scalable AI on decentralized storage.

The Permaweb and the AR.IO Launch

The Permaweb, built on Arweave, serves as a decentralized and permanent data storage layer. Unlike traditional cloud storage, it allows for immutable, censorship-resistant content to persist indefinitely with a one-time payment model. This architecture is foundational for Web3 applications, decentralized publishing, and long-term AI infrastructure.

Recently, AR.IO introduced a suite of upgrades and network enhancements aimed at expanding access to the Permaweb and bolstering its commercial adoption. Inference Labs was proud to contribute to this milestone — not just as a supporter but as a key infrastructure partner shaping the role of permanent storage in decentralized AI.

Bittensor, Subnet 2, and the Permaweb’s Role in Decentralized AI

The value of AI inference hinges on the integrity of the data it processes. For decentralized AI systems — especially those built on Bittensor’s Subnet 2 — the challenge lies in ensuring that model outputs are verifiable, permanently stored, and tamper-proof. This is where Arweave and the Permaweb come into play.

Inference Labs is defining the intersection of decentralized AI computation (Bittensor) and decentralized storage (Arweave) by focusing on:

• Ensuring AI-generated insights remain accessible and immutable over time.
• Creating a structured data verification layer that integrates cryptographic proofs into AI inference.
• Linking decentralized compute with decentralized storage to form the backbone of an enterprise-grade Web3 AI stack.

View the Permaweb transaction

Cryptographic Verification: Elevating Trust in the Permaweb

Permanent storage is only as valuable as its ability to be trusted. While Arweave guarantees immutability, it does not inherently provide mechanisms to verify the provenance of AI-generated outputs. Inference Labs is exploring solutions to enhance the Permaweb’s reliability, such as:

• Zero-Knowledge (ZK) Proofs: To verify AI outputs stored permanently.
• Attestation Mechanisms: To certify data integrity, timestamps, and authorship.
• Automated Cryptographic Audits: To track and validate inference results over time.

By integrating trustless verification layers, we aim to transform Arweave from a permanent storage solution into a fully accountable knowledge base for AI inference.

Building for Commercial Adoption: Inference Labs’ Vision

The success of Web3 hinges on delivering enterprise-ready infrastructure. Despite its potential, decentralized storage remains underutilized in commercial AI applications due to integration challenges, security concerns, and usability gaps.

Inference Labs is dedicated to overcoming these barriers by:

• Bridging the gap between decentralized AI and business applications.
• Developing smart access control and security layers to make Permaweb-based AI solutions commercially viable.
• Positioning trustless AI inference as an essential enterprise tool, ensuring that stored data is not only permanent but also cryptographically sound.

Integration: Proof Publishing System for Subnet 2

In collaboration with the AR.IO team, Inference Labs has developed a Proof Publishing System for use within Subnet 2 — setting a benchmark for how other subnets can adopt this technology. Utilizing the open-source Turbo SDK, we configured a subsidized server to manage proof ingress from validators across Subnet 2 and publish them publicly through Turbo. Validators receive transaction IDs, which can be accessed and re-verified by anyone in the ecosystem at any time.

Inference Labs also hosts a gateway to facilitate easy access for the ecosystem.

This system was straightforward to configure, thanks to the AR.IO team’s diligent work in making the Turbo SDK well-documented and user-friendly.

The Proof Publishing System is designed not only for Subnet 2 but to support the decentralized storage needs of the entire Bittensor ecosystem. We hope it will serve as a reference implementation for many other subnets.

Looking Ahead

Inference Labs’ partnership with AR.IO marks a significant step toward realizing a truly decentralized AI ecosystem — one where AI-generated knowledge is provable, tamper-proof, and permanently accessible.

Innovating at the intersection of Bittensor’s decentralized compute, Arweave’s immutable storage, and cryptographic verification technologies. This is part of our ongoing commitment to the next generation of scalable, verifiable AI.

The future of AI isn’t just decentralized — it’s permanent, trustless, and built to last. And we’re dedicated to making that vision a reality.