让大模型推理过程可验证且隐私保护，无需暴露模型参数和中间结果。
NanoZK: Privacy-Preserving Verifiable Inference for Large Language Models via Layerwise Zero-Knowledge Proofs
- 分层构建零知识证明，将Transformer推理拆解为独立可验证的层
- 总证明大小约83KB，支持并行验证，比之前方案更高效
- 适合需要可信推理但不希望泄露模型细节的应用场景
我们提出NanoZK，一种用于大语言模型可验证推理的零知识证明系统：客户端和第三方审计者可在不获知模型权重或激活值的前提下，验证服务方确实对指定输入执行了宣称的模型。NanoZK引入分层证明框架，将Transformer推理分解为可独立证明的层，并通过SHA-256承诺链连接，生成恒定大小的子电路证明（3.5–3.7 KB；L=12时总大小约83 KB），总大小与先前的单体式证明相当，但更具并行性。我们证明了在标准假设下的组合安全性与零知识性，设计了16位查表近似方法处理softmax、GELU和归一化，六组模型/数据集下困惑度下降低于1e-4；引入基于费舍尔信息的审计预算分流机制以提升效率（完整安全性仍需验证所有层）。在CPU上，MLP子电路证明耗时约6.3秒（设置+证明约43秒），验证时间约22毫秒；注意力模块证明时间从d=16时的0.9秒到d=256时的184秒不等；端到端完整块证明已实测至d=128，基于测量的O(d²) MSM缩放和保守15–30倍GPU-MSM加速范围（参考Icicle在n≥2^20时30倍加速结果外推至小n情形），预计在d=768时每块约需68秒GPU时间。隐私范围：NanoZK隐藏权重和激活值，但不隐藏提示词给证明者，与同态加密或多方计算互补。
原文摘要 · Abstract (English)
We present NanoZK, a zero-knowledge proof system for verifiable LLM inference: clients and third-party auditors check that a provider executed the advertised model on a committed input without learning weights or activations. NanoZK introduces a layerwise proof framework that decomposes transformer inference into independently provable layers linked by a SHA-256 commitment chain, yielding constant-size sub-circuit proofs (3.5-3.7 KB; about 83 KB total at L=12), comparable in total size to and substantially more parallelizable than prior ZKML's monolithic 101-126 KB proofs. We prove compositional soundness and zero-knowledge under standard assumptions, design 16-bit lookup-table approximations for softmax, GELU, and normalization with measured perplexity degradation below 1e-4 across six model/dataset combinations, and add a Fisher-information-guided audit-budget triage as an efficiency tool (full soundness still requires verifying every layer). On CPU the MLP sub-circuit proves in about 6.3 s prove-only (about 43 s setup plus prove) with about 22 ms verification at any width; attention prove-only time scales from 0.9 s (d=16) to 184 s (d=256); full-block end-to-end proofs are measured to d=128, with a projected GPU time of about 68 s per block at d=768 from measured O(d^2) MSM scaling and a conservative 15-30x GPU-MSM speedup range based on Icicle's published 30x result for n >= 2^20 and extrapolated to the smaller-n regime. Privacy scope: NanoZK hides weights and activations from verifiers and auditors but does not hide the prompt from the prover; this is complementary to HE/MPC.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。