We Generated Our First ZK Proof
The first RISC Zero proof-of-execution is working, proving deterministic input-output commitments now and setting up the full execution proof for Devnet.
There are now two Rust programs under proofs/: risc0-guest and risc0-host. The guest runs inside the zkVM and computes the commitment, while the host loads the guest, supplies inputs, generates the proof, and verifies the receipt.
Proof generation currently takes roughly 15 to 40 seconds on CPU, while verification is effectively instant for developer workflows.
- βrisc0-guest: hashes input and output inside the zkVM
- βrisc0-host: drives proving and verification
- βPhase 0 proves commitment correctness, not full model execution
The current proof demonstrates a narrow but structurally important statement: given input I and output O, their joint SHA-256 commitment is HASH(SHA256(I) || SHA256(O)).
This ties the declared input and output together in a way that cannot be forged, because the zkVM guarantees the hash was computed from the real private bytes provided to the guest.
It does not yet prove that a specific model with specific weights produced that output. In Phase 0, inference still happens outside the zkVM.
The Devnet version of pi_exec is intended to prove that declared code, with declared memory state, processed input I and produced output O through the exact execution trace.
That means the verifier will be able to trust the tuple of code hash, memory root, input hash, and output hash, without seeing the private witness itself.
This is the property that blocks output substitution after the fact.
- βBytecode hash must match the on-chain declaration
- βInference must run against the declared memory state
- βOutput must come from that exact execution
The Phase 0 proof is already slow enough to matter and fast enough to be useful as a scaffold. The documented baseline is about 18 seconds on a MacBook M2 Pro, around 28 seconds on a Ryzen 5800X, and up to 55 seconds in a constrained CI environment.
These numbers matter because every future optimization can now be measured against a real baseline instead of claims.
RISC Zero is being used for execution proofs because it is a general-purpose zkVM. That makes it viable for proving arbitrary agent code later, including future RaxLang programs, without building a new custom circuit for every operation.
The tradeoff is proof latency. That is why the protocol reserves Jolt for quality proofs where lookup-heavy math like similarity and embedding work benefits from a more specialized proving model.