Zero-Knowledge Proofs
Verifiable AI: Proving the Model and the Data It Reads
November 4, 2026
9 mins read
Verifiable AI now has proofs for which model ran. The data an AI agent reads needs its own proof that it was stored and processed as claimed, kept private.
Verifiable AI means anyone who relies on an AI system can check two things instead of trusting the output: inference integrity, meaning which model produced the answer, and data integrity, meaning what data the model used and whether that data was stored and processed as claimed. In 2026 the first half started to get real proofs, built on Zero-Knowledge Proofs: a cryptographic proof that shows a statement holds while revealing nothing else. The second half, the data an AI agent reads at runtime, is still mostly taken on trust.
TL;DR: Proofs of model inference are arriving, led by research such as Anthropic's FlashProve. They show which model ran on a given prompt. They do not show where that prompt's data came from. For AI agents that act on private data, the data layer needs its own Zero-Knowledge Proof, one that proves the data was stored and processed as claimed without exposing it.
AI systems now act, so their outputs need a proof
AI models generate code, handle customer support and, more and more, run as autonomous agents that call external tools and execute transactions. When a model only drafted text for a person to read, a wrong answer cost someone a few minutes. When an agent approves a refund, merges a pull request or moves funds, a wrong answer becomes an action.
Users, companies and auditors who rely on these systems need more than a confident output. They need to check which model ran and what it was given. Inside one company, logs and internal reviews do much of this work. A second party that has to rely on the result usually cannot open those logs, so it needs something it can check on its own.
Ethereum's direction: AI that anyone can verify
In a February 2026 post on X, Vitalik Buterin set out where Ethereum and AI should meet. The first area he listed was tooling for "more trustless and/or private interaction with AIs", including "client-side verification of cryptographic proofs, TEE attestations, and any other forms of server-side assurance". He also argued that the old cypherpunk idea of "don't trust; verify everything" can finally work, "with LLMs doing the hard parts".
That last point changes who does the checking. We expect most verification to be done by software: an agent that checks a proof before it acts on another agent's output, or a monitoring system that reviews what an agent did overnight. Software can check a proof without reading the data or rerunning the work, but only if someone produced the proof in the first place.
Proof without exposure
Verification for AI also has to protect privacy. Vitalik Buterin has made the point for years, and he made it again in his opening talk at Devcon 8 in Mumbai: "We really need to treat data as toxic waste by default. If you can, don't collect it at all." In the same talk he described how cryptographic proofs should work instead: "do not prove by revealing all of the information about yourself, because then you're leaking your privacy, and that itself makes you less secure."
The rule is simple to state. You prove only the specific statement the other side needs. A lender's agent does not need a borrower's full bank history; it needs proof that the cash flow data it scored is the version on file and was not changed. The Ethereum Foundation, sharing the talk, listed trustworthy AI as part of Ethereum's mission.
This is the job a Zero-Knowledge Proof was built for. The prover shows that a statement about private data holds, and the verifier learns that the statement holds and nothing else.
Provable inference: what a model proof covers
On 2 November 2026, Anthropic, the company behind Claude, published research on provable inference and open-sourced the code, called FlashProve. It uses a Zero-Knowledge Proof to show that a given prompt produced a given output from a specific model. The model's weights, the learned numbers that define it, are fixed in advance by a commitment, a cryptographic fingerprint that cannot be changed later. Anyone can check that proof on a CPU, without a GPU and without seeing the model's weights.
The problem it targets is real. Anthropic notes that "judging from the model's output alone is unreliable, even if it produces high-quality responses." A swapped or downgraded model looks the same as the one you paid for.
FlashProve is a research prototype. It was tested on an open third-party model, Llama 4 Maverick. Anthropic is clear about its limits: it proves inference only for short inputs, up to 1,024 tokens (much shorter than a typical chat), and only for one fixed way of picking each next word, called greedy decoding.
It also has a clear scope. The proof shows what the model did with the prompt it received. It says nothing about where that prompt came from, or whether the data behind it was stored and processed correctly. That gap matters, because changed or stale data looks exactly like correct data. An old account balance in the prompt produces a confident answer just the same.
The full map of what verifiable AI has to prove
Verifiable AI is more than one proof. Each layer answers a different question, and different techniques cover each one.
| Layer | The question a reviewer asks | What covers it |
|---|---|---|
| Model identity | Which model produced this output? | Inference proofs (zkML), TEE (Trusted Execution Environment) attestations |
| Execution integrity | Did the model run on this exact prompt as stated? | Inference proofs (zkML), TEE attestations |
| Input data integrity | Was the data the model read stored and processed as claimed? | A verifiable database |
| Data version and time | Which version of the data did it read, and when? | A verifiable database |
| Authorization | Was the agent allowed to take this action? | Identity and intent frameworks |
zkML, short for Zero-Knowledge machine learning, proves the model ran. A TEE is secure hardware that attests to what code ran inside it. A verifiable database proves the data the model used. The two are halves of the same evidence, not rivals. Our post on benchmarking ZKML frameworks covers the model half in more depth. Authorization is its own layer too; we wrote about it in verifiable intent for AI agents.
The data an AI agent reads is where the decision comes from
For most AI systems, the input is where the decision really comes from. A support assistant answers from a company's policy documents. A medical assistant answers from a patient's records. A coding agent works from a codebase and its dependencies. A lending agent scores a borrower's cash flow.
If that data was changed, stale or processed in a different way than claimed, a fully proven model still produces an answer nobody can defend.
Three things make this layer hard to check with the tools teams use today. The data sits in private systems the reviewer cannot open. It changes all the time, so a snapshot from last week proves little about this morning. And it is often too sensitive to show the party who checks it, whether that party is an auditor, a regulator or another company's agent.
What reviewers need is a proof of one specific statement: that the agent read a given version of the data at a given time, and that this version was built from correct updates, without seeing the data itself. The same need runs through institutional agentic finance, where agents act on reserves, collateral and identity data that cannot go on-chain.
How zkDatabase proves the data behind an AI answer
zkDatabase is a verifiable database powered by Zero-Knowledge Proofs. It generates a Zero-Knowledge Proof for every insert, update and query, so each data change and each read comes with a proof that it was done correctly. For AI systems, it is designed to be the place an agent reads from when its work has to be checked.
The flow works in four steps.
Each write and each read comes with a Zero-Knowledge Proof, while the raw data stays off-chain.- Write with a proof. Each insert or update to the data generates a Zero-Knowledge Proof that the change was applied correctly. The new state of the database is committed as a Merkle root, a single hash that fingerprints the whole data set.
- Publish the commitment, keep the data private. The raw data stays off-chain in the operator's own environment. Only the commitment, the proofs and the query results the agent asks for leave it, and they can be anchored on-chain, written to a blockchain, so every party checks against the same state.
- Query with a proof. When an AI agent queries the data, the result comes with a proof that it matches the committed Merkle root. The verifier learns that the value is in the database at that version, without seeing the rest of the data or where it sits.
- Verify before acting. The agent, an auditor or another agent checks the proof in software or in a smart contract, and only then uses the result.
Put next to an inference proof, zkDatabase is designed to cover the other half of the evidence. One proof shows which model ran on the prompt. The other shows that the data the agent read came from a known version of the database. zkDatabase is designed with a Proof-System Agnostic architecture, so the data layer is not locked into one proof system.
We have been building verifiable data since 2021
Long before verifiable AI became a common topic, we started building zkDatabase on one idea: data that others rely on should be provable without being revealed. We explain that starting point in why Orochi built zkDatabase.
AI agents bring the same requirement to a much wider set of systems. Proofs for the model are starting to arrive, and the data each model reads needs its own. As AI systems take on more decisions, showing which model ran and which data it used will become a basic expectation. Our direction is to make zkDatabase the data layer that AI systems read from when their answers and actions have to be checked, while the raw data stays private.
Explore zkDatabase: see how zkDatabase generates a Zero-Knowledge Proof for every insert, update and query.
Related toZero-Knowledge Proofs
