Verifiable Inference Went From Theory to Product This Week

Verifiable AI inference crossed from theory to product this week: Attestable exited stealth on August 11, 2026, with a $20M seed round co-led by Altimeter Capital and TLV Partners, and NEAR AI Cloud began returning Intel-signed attestation certificates for every inference on August 12, 2026, per KuCoin’s flash report and The Crypto Times. Two independent verification stacks went from whitepaper to shippable product within 48 hours of each other. Attestable claims 85 tokens/sec of ZK-verified inference on a 30B-parameter model across NVIDIA H100s, with Vitalik Buterin noting ZK overhead for LLMs is “nearing single-digit” percent. NEAR AI Cloud, meanwhile, now attaches a hardware-signed certificate to every workload, verifiable by any third party.

Why this matters: verifiable inference is the missing primitive for agents that move money onchain. Without cryptographic proof that a specific model produced a specific output on specific inputs, agent-to-agent payments, on-chain inference markets, and AI trading agents all rest on blind trust in an API operator. That trust model is now obsolete.

Two Verification Families: TEE Attestation vs. ZK Proofs

Verifiable inference comes in two families: hardware-signed TEE attestation, which trusts the silicon vendor, and software-only zero-knowledge proofs, which trust the math — NEAR AI Cloud ships the former through Intel Trust Authority while Attestable and Inference Labs build the latter, per near.ai, attestable.com, and Inference Labs. Understanding the difference is the difference between trusting Intel and trusting cryptography.

TEE attestation works like this: the model runs inside a hardware enclave (Intel SGX/TDX or NVIDIA confidential computing). The enclave produces a signed certificate containing the enclave measurement (a hash of the enclave’s code and configuration), the attestation signing key, and a hash of the workload. That certificate chains back to Intel’s root signing key. A third party verifies the signature chain, checks the measurement, and knows the workload ran inside genuine Intel hardware. NEAR AI Cloud describes this as a “triple lockout” — the operator, the model provider, and the hardware vendor are all bound by the attestation. The trust anchor is Intel’s signing key.

ZK proofs take a different path. A prover generates a cryptographic proof that a specific output was computed from a given model and input — without revealing the model weights. The verifier checks the proof in milliseconds. No trusted hardware required; the soundness rests on the underlying mathematics and the correctness of the implementation. Attestable’s engineering blog details their approach to proving LLMs at scale.

The hybrid reality: most production systems will blend both. TEEs handle the bootstrapping and key management; ZK proofs handle the parts that need to be publicly auditable. NEAR AI Cloud’s Intel integration and Attestable’s ZK stack are not competitors so much as two layers of the same verification stack.

How to Fetch and Check an Attestation Certificate (Intel Trust Authority)

Fetching and checking an attestation certificate is a documented, scriptable workflow: NEAR AI Cloud returns a hardware-signed attestation certificate for every request, and Intel Trust Authority’s documentation specifies how a third party verifies the enclave measurement, signing key, and workload hash without trusting the operator. The workflow is mechanical, not magical.

Intel Trust Authority’s docs specify the following five-step verification flow:

  1. Call the endpoint and capture the attestation artifact. NEAR AI Cloud returns the attestation certificate as part of the inference response. The artifact includes the enclave measurement, the attestation signing key, and a hash of the workload that ran inside the enclave.

  2. Parse the certificate. Extract the enclave measurement (a hash of the enclave’s code and initial state), the attestation signing key identifier, the workload hash, and the timestamp. These four fields are what you verify.

  3. Verify the signature chain. The certificate must chain to Intel’s root signing key. Intel Trust Authority’s docs specify the root certificate and the intermediate certificates. If any link in the chain fails, the attestation is invalid.

  4. Check the workload hash against the model you expect. The workload hash commits to the exact model and inference code that ran inside the enclave. If the hash doesn’t match the model you think you called, the response is not from that model — regardless of what the API response header says.

  5. Fail closed. Any verification error — signature mismatch, expired certificate, unknown root, workload hash mismatch — means the inference is unverified. Treat it as a failed call, not a degraded call.

This workflow is documented in Intel Trust Authority’s docs and is the reference implementation for paying for AI inference with NEAR. The operator never needs to be trusted; the certificate either verifies or it doesn’t.

What to Verify When a Vendor Claims “ZK-Verified Inference”

When a vendor claims ZK-verified inference, interrogate four numbers: proof-generation throughput, verification time, whether the proof commits to the exact model weights, and whether inputs stay private — Attestable reports 85 tokens/second proving a 30B-parameter model on H100s with sub-second verification, per its engineering blog and the KuCoin flash. These four numbers separate real ZK inference from marketing.

1. Proof throughput. Tokens per second, at what model size, on what hardware? Attestable reports 85 tokens/sec on a 30B-parameter model across H100s. Vitalik Buterin’s “nearing single-digit” percent framing puts that in context: the overhead is approaching the point where ZK verification is a rounding error on inference cost. But 85 tokens/sec is a claim, not a benchmark — ask for the exact model, hardware, and proof settings.

2. Verification time. Attestable claims sub-second verification. Verification time matters because it determines whether the gate can run inline in an agent loop or must run asynchronously. Sub-second means inline verification is viable for most agent actions.

3. Model commitment. Does the proof bind to the exact model weights, or just to “some model with this architecture”? Nexus’s verifiable AI blog covers model attestation in depth — the proof must commit to the specific weights, not just the architecture. A proof that commits to “a 30B model” is not a proof that commits to the model you think you’re calling.

4. Input privacy. Does proving reveal the prompt? Can the prover prove the output without revealing the weights? ZK proofs are designed to hide both, but implementation matters. Ask specifically: what does the prover see, and what does the verifier learn?

Unverified-name rule: some secondary reports reference “Meta Muse Glimmer 30B” as the model Attestable proved. That name is unverified — treat it as “a 30B-parameter model as reported via KuCoin,” not as a confirmed product name.

Wiring a Verification Gate Into Your Agent Loop (Verify → Execute, Else Halt)

A verification gate makes agent trust mechanical: verify the attestation certificate or ZK proof before every high-value action, execute the trade or payment only on success, and halt otherwise — the same verify-then-execute discipline exchanges now apply to agentic trading, per Gemini’s agentic trading launch and TechCrunch’s Coinbase for Agents coverage. The gate sits between the LLM output and any tool call that moves money.

# Verification gate — mandatory before any money-moving action
def agent_action(model_input, action):
    output, proof = call_model(model_input)
    
    if not verify(proof):                    # signature chain / ZK proof valid
        halt("unverified inference")
    
    if not matches_model_commitment(proof):  # proof bound to exact weights
        halt("model commitment mismatch")
    
    if not input_privacy_holds(proof):       # prompt not leaked
        halt("privacy violation")
    
    return execute(action, output)           # only now: trade, pay, sign

The gate sits between the LLM output and any tool call that moves money — trades, payments, contract deployments. Policy tiers make this practical: verify all money-moving actions, sample cheap reads at low frequency, and require full verification above a value threshold. Log every verification result — success, failure, and reason — so you can audit the gate’s behavior later. Halt means halt: no fallback, no “best effort” execution, no retry without re-verification.

This is the same discipline trust boundaries in agent tooling demands for MCP servers. The MCP-based trading ecosystem — Coinbase’s MCP for agent trading and Gemini’s agentic trading — makes it trivially easy for an agent to call a trading tool. The verification gate is what makes that call safe.

A 6-Point Evaluation Checklist for Verifiable-AI Products

A six-point checklist filters verifiable-AI products: auditable claims, proof type and verifier independence, model commitment, input privacy, operational overhead, and vendor track record — and the ELIZAOS collapse shows what happens when unverifiable “autonomous” claims meet reality, per CoinDesk’s post-mortem. Run every vendor through this list before you wire their product into your agent loop.

  1. Auditability — Can a third party independently verify the claim, or does verification require the vendor’s own tooling? Third-party verifiability is non-negotiable. Intel Trust Authority’s docs specify the process; if a vendor can’t point to a similar spec, walk away.

  2. Proof type and verifier independence — Is it TEE attestation or ZK? Is the verifier independent of the prover? A vendor that both generates and verifies proofs is not providing verification.

  3. Model commitment — Is the proof bound to exact weights, or just to an architecture? Nexus’s verifiable AI blog covers why this matters: a proof that doesn’t commit to weights proves nothing about which model ran.

  4. Input privacy — What does the vendor see? Does the proof leak the prompt or the weights? Prompt20’s verifiable inference guide covers the privacy spectrum.

  5. Operational overhead — What’s the throughput, latency, and cost impact? Attestable’s 85 tokens/sec claim and Vitalik’s “single-digit” percent framing are the reference points for ZK; TEE attestation adds near-zero latency.

  6. Track record and audit trail — Does the vendor have a history of auditable claims, or marketing? The ELIZAOS collapse — an “AI agent token” worth $2.4B at peak, ending with the founder calling it dead — is the canonical example of what unverifiable claims produce. Verification claims, like autonomous-fund claims, must be auditable.

Build this checklist into your agent eval harness — the same discipline you apply to model quality applies to verification quality.

Comparison Table: TEE Attestation vs. ZK Proofs vs. Plain API Trust

TEE attestation, ZK proofs, and plain API trust differ across trust model, cost, latency, hardware dependency, privacy, and post-quantum resistance: TEEs trust the silicon vendor, ZK trusts the math with single-digit overhead claims, and unverified APIs trust the operator — per near.ai, attestable.com, and the KuCoin flash.

Dimension TEE Attestation ZK Proofs Unverified / Plain API
Trust model Trust the silicon vendor (Intel signing key) Trust the math (cryptographic soundness) Trust the operator (blind trust)
Cost Enclave infra + attestation service High proof-generation compute (GPU-hours) Lowest (raw API call)
Latency overhead Low (attestation ~ms-scale) High at generation (85 tok/s claim, 30B model, H100s); sub-second verification None
Hardware dependency Requires TEE-capable hardware (Intel/NVIDIA) Software-only, no trusted hardware Any hardware
Privacy (inputs/weights) Inputs inside enclave; weights visible to vendor Proves output without revealing weights Operator sees everything
Post-quantum resistance Depends on vendor crypto roadmap Yes (Attestable’s stated positioning) N/A
Live examples NEAR AI Cloud (Intel Trust Authority) Attestable; Inference Labs Proof of Inference Most public LLM APIs

The two highest-signal rows are trust model and privacy. Trust model tells you who you’re actually trusting: Intel’s signing key, the mathematics, or an API operator’s promise. Privacy tells you what the vendor sees: TEEs protect inputs but expose weights to the enclave operator, ZK protects both, and plain APIs expose everything. For agents that move money, the trust model row alone disqualifies plain API trust — you cannot audit an operator’s promise.

Frequently Asked Questions

These are the most common questions engineers ask when evaluating verifiable inference for production agents — each answer is self-contained and cited.

What exactly is verifiable AI inference? Verifiable AI inference is the ability to cryptographically prove that a specific model produced a specific output from a specific input, without trusting the API operator. Two families exist: TEE attestation (hardware-signed certificates from Intel) and ZK proofs (software-only cryptographic proofs). Both went live as products this week, per near.ai and Attestable.

What’s the difference between a TEE attestation certificate and a ZK proof? A TEE attestation certificate is a hardware-signed statement that a workload ran inside a genuine Intel enclave, verified by checking the signature chain to Intel’s root key per Intel Trust Authority’s docs. A ZK proof is a software-only mathematical proof that an output was computed from given weights, verifiable without trusted hardware. TEE trusts Intel; ZK trusts math.

Can I verify a NEAR AI Cloud inference myself as a third party? Yes. NEAR AI Cloud returns an Intel-signed attestation certificate for every workload, and Intel Trust Authority’s documentation specifies how any third party verifies the enclave measurement, signing key, and workload hash. You don’t need NEAR’s cooperation or a special account — just the certificate and Intel’s public verification process.

How fast is ZK-verified LLM inference in 2026? Attestable reports 85 tokens/second proving a 30B-parameter model on NVIDIA H100s, with sub-second verification, per its engineering blog and the KuCoin flash. Vitalik Buterin says ZK overhead for LLMs is “nearing single-digit” percent. These are vendor-reported figures, not independent benchmarks.

Do ZK proofs reveal my prompt or the model’s weights? No — that’s the point of zero-knowledge. The prover generates a proof that the output was computed from given weights and input without revealing either, per Attestable’s engineering blog and Nexus’s verifiable AI blog. The verifier checks the proof and learns only that the computation was correct. Implementation matters, so verify the privacy claims before trusting them.

Should my agent verify every action or only high-value ones? Use policy tiers: verify all money-moving actions, sample cheap reads at low frequency, and require full verification above a value threshold. The verification gate — verify → execute, else halt — is mandatory for any action that moves money, per Gemini’s agentic trading launch. Cheap reads can tolerate sampling; trades and payments cannot.

The Bottom Line

The bottom line: verifiable inference is shippable in 2026 — Intel-signed attestations are live on NEAR AI Cloud today and ZK inference is approaching practical overhead — so agent builders should adopt a verification gate now rather than after a loss, per NEAR AI and Attestable’s announcements. The infrastructure exists, the performance is viable, and the cost of not verifying is now measurable in real losses.

TEE attestation is the production-ready default today; ZK proofs are the strategic bet; plain API trust is no longer defensible for agents that move money.

The ELIZAOS collapse is the cautionary tale: an “AI agent token” worth $2.4 billion at peak, ending with the founder calling it dead, per CoinDesk’s post-mortem. The lesson isn’t that AI agents are hype — it’s that unverifiable claims are worthless. Verification claims, like autonomous-fund claims, must be auditable. The agent payments vs. agent tokens distinction is exactly this: payments move real value, tokens are speculative claims. Verify the former. The rest is marketing. For a broader view of what’s shippable, see the arena hub.

How This Guide Was Built

This guide is based on official documentation, vendor announcements, and community reports — we did not run the tools hands-on. Sources were gathered on August 14, 2026, and every URL was curl-verified HTTP 200. Primary authorities include Intel Trust Authority’s docs, near.ai, Attestable’s engineering blog, and CoinDesk’s ELIZAOS post-mortem. Performance figures are vendor-reported, not independently benchmarked. The “Meta Muse Glimmer 30B” model name appears in secondary reports but is unverified. For more, see all NiteAgent guides.

← Back to all posts