1. Introduction

The problem.

ZK-ML systems (ezkl, Orion, RISC Zero) let anyone prove neural network inference was correct — without revealing inputs. This enables private biometric verification (e.g., Worldcoin), on-chain AI oracles, and compliant ML auditing. But proving is slow, and its cost depends on architectural choices that are hard to predict: in our measurements real proving time ranges from $28$ s to $970$ s over the 7 trained networks we proved (Table 10).

What we show empirically.

Real proving time varies by more than an order of magnitude (28 s to 970 s) across the 7 trained networks we proved (Table 10). A width-matched comparison (Table 2 andTable 9) shows that this spread does not come from the ReLU-versus-$x^2$ choice: at identical widths the two have the same calibrated $\mathrm{logrows}$ (in all five skeletons, and in 45 of 50 matched pairs across the trained sweep). Differences come from layer type, width, and from ezkl’s range calibration, which raises $\mathrm{logrows}$ for unnormalized $x^3{+}x$ networks. We therefore report a negative result for the assumption that polynomial activations are cheaper to prove in ezkl. We also report that the zero-cost proxies we tested do not predict accuracy across activation families, that polynomial networks often fail to train, and that, under budgets set on calibrated circuit size, a joint accuracy-cost proxy does no better than NEAR alone.

Why this requires NAS.

Architecture search for ZK inference needs to trade accuracy against circuit cost, and cost estimates must be validated against the prover. We evaluate a cost model against ezkl calibrations of trained networks and evaluate six zero-cost proxies, plus a NASWOT variant, on a benchmark that includes polynomial and BN-free networks, where the standard proxies were not designed to work.

Our contributions.

1. Cost model with a held-out evaluation (Section 3, Table 14): a parametric model of assigned cells, fitted on 180 trained, calibrated networks and evaluated on 54 disjoint ones.

2. Measurements (Section 5 andSection 6.7): a width-matched ReLU $\approx$ $x^2$ result replicated on untrained and trained networks, and the $x^3{+}x$ calibration effect.

3. Benchmark and proxy study (Section 6): 474 networks, two seeds, per-architecture results released; proxy correlations with Holm-adjusted significance, confidence intervals, partial correlations, and analyses with and without failed networks and with a common training recipe.

4. Search under calibrated budgets (Section 6): a protocol with a tuning/evaluation split; the joint proxy does not beat NEAR-only, and the cost model’s estimate removes most budget violations.

Paper organization.

Section 2 reviews ZK-SNARK cost and contrasts with MPC. Section 3 states the cost model and the proxy analysis. Section 4 introduces zkml-bench. Section 5 reports width-matched ezkl cost measurements. Section 6 presents empirical results. Section 7 surveys related work. Section 9 concludes.

2. Background

2.1 ZK-SNARK Circuit Cost Model

In Halo2/PLONK over BN254 (as used by ezkl), the circuit is a rectangular table of $2^{\mathrm{logrows}}$ rows. Cost is dominated by three components:

• Linear layers: each multiply-accumulate contributes about one assigned cell (fitted coefficient $\approx1$, Section 6), giving $O(w_{\mathrm{in}} \times w_{\mathrm{out}})$ cells per layer.

• Lookup-based activations: non-linearities such as ReLU are evaluated through lookup tables whose size grows with the activation’s integer range; the table is shared across the circuit. At the widths we test, the resulting per-element cost is small relative to the multiply-accumulate rows (Section 5).

• Polynomial activations ($x^2$): evaluated with multiplications and no lookup; the fitted per-element cost of the power operator is of the same order as ReLU’s (Section 6).

For a fixed quantization scale and lookup range, the circuit structure is determined at compile time from the architecture specification and does not depend on weight values. In ezkl the scale and range, and hence $\mathrm{logrows}$, are chosen by a calibration pass on data, which can raise $\mathrm{logrows}$ (Section 5); our cost model therefore predicts the circuit size up to this calibration effect.

2.2 Contrast with MPC Cost Model

CryptoNAS (Ghodsi et al. 2020) optimizes for MPC (garbled circuits). In MPC: linear layers cost $O(1)$ via secret sharing (effectively free), while ReLU requires oblivious transfer (expensive). In ZK-SNARKs, linear layers are not free: multiply-accumulates dominate the assigned cells at the widths we test (Section 5), so an architecture chosen to minimize the ReLU count need not be cheap to prove. We do not evaluate CryptoNAS itself.

3. Cost Model and Proxy Analysis

This section states what we can and cannot establish about ezkl circuit size. The claims are deliberately modest: AssumptionAssumption 1 is a structural statement and a parametric form; its quantitative content is tested empirically in Section 5 andSection 6, not proved.

3.1 A Parametric Cost Model

ezkl compiles an ONNX graph $G$ into a PLONKish circuit. Fix the quantization scale $s$ and the lookup range $R$ (both are chosen by ezkl’s calibration pass). Each node $v$ has an operator type $o(v)$, input and output tensor shapes, and attributes (kernel size, stride, padding, groups).

Assumption 1 (Structure of the cost model). *For fixed $(s,R)$ the circuit layout (columns, selectors, lookup and permutation structure) is a function of the graph structure $(o(v),\text{shapes},\text{attributes})_{v\in G}$ only and does not depend on the weight values, which enter only as cell assignments. Define $C(G;s,R)$ as the total number of assigned cells (ezkl’s total_assignments). We use the parametric form

$$C(G) \;=\; \sum_{v\in\mathcal{M}} \beta_{o(v)}\,\mathrm{MAC}(v) \;+\; \gamma\,|\mathcal{M}| \;+\; \sum_{v\notin\mathcal{M}} \alpha_{o(v)}\,\mathrm{el}(v) \;+\; \varepsilon ,$$

where $\mathcal{M}$ is the set of Gemm, MatMul and Conv nodes, with $\mathrm{MAC}=n_{\mathrm{in}}n_{\mathrm{out}}$ for a Gemm node and $\mathrm{MAC}=h'w'\,c_{\mathrm{out}}\,(c_{\mathrm{in}}/g)\,k_hk_w$ for a Conv node with output spatial size $h'\times w'$ and $g$ groups; $\mathrm{el}(v)$ is the number of output elements; $\beta_o,\gamma,\alpha_o\ge 0$ are coefficients; and $\varepsilon$ is an unmodelled residual.*

What is and is not claimed.

The first sentence of the assumption follows from how PLONKish layouts are built (weights are witness values), but we do not prove it for ezkl’s implementation; it is the premise of the model. It is supported empirically: assigned cells and calibrated $\mathrm{logrows}$ were identical across three re-drawn weight and calibration-data seeds in every width-matched skeleton (Table 2). We do not derive the coefficients or the accounting from assigned cells to rows analytically. Instead the coefficients are fitted by non-negative least squares on a fit split of trained, calibrated networks and evaluated on a disjoint split (Section 6), and the relation between assigned cells and $\mathrm{logrows}$ is checked empirically (Section 5 andSection 6): the identity $\mathrm{logrows}=\lceil\log_2 C\rceil$ holds in the unnormalized width-matched skeletons but for only 163 of 234 trained networks (the calibrated $\mathrm{logrows}$ is lower in 52 and higher in 19), and we do not assume it. Empirically (Section 6, 72 dumped circuits at $\mathrm{logrows}$ 19–23), ezkl reports $C/2$ rows and the calibrated $\mathrm{logrows}$ is the largest of four requirements (rows, constants, lookup table, range-check table), so $\mathrm{logrows}=\lceil\log_2 C\rceil$ holds only when another requirement binds exactly one level above the rows requirement $\lceil\log_2 C\rceil-1$. The structural proxy used by the search is the same form with hand-set coefficients; the fitted version is reported alongside it. $\varepsilon$ is reported only through the fit residuals.

3.2 Activation Costs at Equal Multiply-Accumulate Counts

Lemma 1 (Bounded ratio in the idealized model). *Let two networks have identical width profile (hence identical $M=\sum_v\mathrm{MAC}(v)$ and element counts $S=\sum_i w_i$) and differ only in per-element activation cost, $\kappa_A<\kappa_B$, with all other terms of Eq. Eq. (1) equal. With $\bar f=M/S$ the average fan-in,

$$\frac{C_B}{C_A}=\frac{\bar f+\kappa_B}{\bar f+\kappa_A}\in\bigl(1,\kappa_B/\kappa_A\bigr),$$

decreasing in $\bar f$.*

Proof. Divide $C_X=M+S\kappa_X$ by $S$; the ratio is a decreasing function of $\bar f$ equal to $\kappa_B/\kappa_A$ at $\bar f=0$ and tending to $1$ as $\bar f\to\infty$. ◻

The lemma is deliberately weak. It shows that, in a model where activation costs are fixed constants, networks with equal MACs differ in cell count by at most $\kappa_B/\kappa_A$; it does not show that FLOPs cannot approximate cell count within a constant factor (for fixed $\kappa$ it can). Whether the factor is large is an empirical question: our measurements find $\kappa_{\mathrm{ReLU}}\approx\kappa_{x^2}$ (Section 5). The one place where equal-MAC networks differ substantially in ezkl is through calibration, not through cell count: unnormalized $x^3{+}x$ networks have the same assigned cells but a $\mathrm{logrows}$ larger by up to $4$, i.e. a circuit up to $2^4=16\times$ larger, than the other activations at the same width. That is an observation about ezkl’s calibration, and we state it as such.

3.3 Proxy Failure Modes for Polynomial Activations

Proposition 2 (NASWOT degeneracy for $x^2$ activations). For any network whose activations are $\sigma(t)=t^2$ (more generally $t^d$ with $d$ even), the Gram matrix $K$ of the binary patterns $\mathbf{1}[\sigma(\cdot)>0]$ used by NASWOT has rank one on almost every input set, so $\log|\det K|$ is degenerate.

Proof. For $\sigma(t)=t^2$ the indicator $\mathbf{1}[t^2>0]$ equals one for every non-zero value, which holds almost surely under continuous random inputs. Every sample therefore maps to the all-ones code, $K$ is the all-ones matrix, and $\det K=0$. ◻

Remarks.

(i) The proposition is mathematics only: standard NASWOT scores the outputs of nn.ReLU modules and returns $-\infty$ for any network without them, so the $-\infty$ counts in our sweep (all polynomial networks, including the pure-$x^2$ ones) are produced by the implementation and do not test the proposition. (ii) The argument does not cover $x^3{+}x$ or $x^2{+}x$, whose sign patterns are not constant. (iii) To avoid the confound we also evaluate a heuristic generalization that records $\mathbf{1}[\text{pre-activation}>0]$ at the input of every activation module; for ReLU it equals the standard score, and for polynomial networks it is defined. This variant is not part of the NASWOT paper.

A Zen-style score (a variant of Zen-NAS, not the published protocol).

Lin et al. (Lin et al. 2021) (Algorithm 1) compute the Zen-Score on the feature map before global average pooling, after removing the residual links, and add a term that sums $\log\sqrt{\text{mean batch-norm variance}}$ over the batch-norm layers. We did not implement that protocol. Our score is $\mathrm{Zen\text{-}style}(f)=\mathbb{E}_{x,\epsilon}\log\|f(x+\epsilon)-f(x)\|_2+\log\mathbb{E}\,[\operatorname{std}_{\text{batch}} f(x)]$ with $x\sim\mathcal{N}(0,I)$ and $\epsilon\sim\mathcal{N}(0,10^{-4}I)$, and it differs from the published score in four ways: (i) it is computed on the network output (logits), not the pre-pooling feature map; (ii) residual links of ResNet-style networks are kept; (iii) it has no batch-norm-variance term (our networks use no BatchNorm, and we do not substitute a LayerNorm or GroupNorm statistic) and instead adds $\log\mathbb{E}[\operatorname{std}_{\text{batch}}f(x)]$ as a second term; and (iv) the perturbation and input scales are fixed as stated. Every result labelled Zen-style concerns this variant and not the published Zen-Score; we draw no conclusion about the published proxy. In an earlier version we gave a scaling argument for its anti-correlation with accuracy on polynomial networks; because the inputs are fixed at unit scale the argument as stated is not well defined, so we withdraw it and instead report the empirical dependence of the score on depth, size and training failure (Section 6).

4. The zkml-bench Benchmark

4.1 Search Space

Activation types.

$\{$ReLU, $x^2$, $x^3{+}x$, $x^2{+}x\}$. ReLU is the baseline (lookup-based); $x^2$ is the simplest polynomial; $x^3{+}x$ is a signed polynomial with better expressivity; $x^2{+}x$ approximates GELU-style behavior.

Normalization.

$\{$none, LayerNorm, GroupNorm$\}$. BatchNorm is excluded because its inference form divides by $\sqrt{\mathrm{variance}}$, which we expect to be costly in ZK but did not measure.

Convolution type.

$\{$standard conv, depthwise separable (DWS)$\}$. DWS reduces parameters and multiply-accumulates.

Architecture families.

MLP, CNN, ResNet-style with skip connections, DepthwiseSepConv-based.

4.2 Metrics

Evaluated on CIFAR-10, the primary dataset of NAS-Bench-201 (Dong & Yang 2020) (earlier CIFAR-100 and ImageNet-16-120 results are withdrawn; Section 6.1). Recorded per architecture: mean test top-1 accuracy after 30 epochs over two seeds, the zero-cost proxy scores and the structural cost estimate at the seed-0 initialization, and, for the calibrated subset, ezkl’s calibrated $\mathrm{logrows}$ and assigned cells on the trained network.

4.3 Zero-Cost Proxies Evaluated

Zero-cost proxies evaluated in zkml-bench.

4.4 Algorithm: Joint Proxy-Guided ZK-ML NAS

Algorithm 1 ranks candidate architectures by a scalarized score of an accuracy proxy and a circuit-cost estimate. Both terms are $z$-scored within the candidate pool $\mathcal{P}$:

$$J(a) \;=\; z_{\mathcal{P}}\bigl(\mathrm{NEAR}(a)\bigr) \;-\; \lambda\; z_{\mathcal{P}}\bigl(\log_2 \hat C(a)\bigr),$$

where $\hat C(a)$ is the cell count from the cost model of Eq. Eq. (1). $\lambda\ge0$ is not fixed a priori: in the experiments it is chosen from $\{0,0.25,0.5,1,2,4\}$ by maximizing the best accuracy among the selected architectures on a tuning split that is disjoint from the evaluation split (Section 6). Setting $\lambda=0$ recovers NEAR-only selection.

Candidate architectures $\mathcal{A}$, budget $B$ on $\mathrm{logrows}$, selection size $K$, weight $\lambda$ $K$ architectures to train $\mathcal{P}\leftarrow\{a\in\mathcal{A}:\ \mathrm{logrows}(a)\le B\}$ $\triangleright$ $\mathrm{logrows}$ estimated by the cost model, or calibrated by ezkl compute $\mathrm{NEAR}(a)$ at initialization and $\log_2\hat C(a)$ from the cost model $J(a)\leftarrow z_{\mathcal{P}}(\mathrm{NEAR}(a))-\lambda\, z_{\mathcal{P}}(\log_2\hat C(a))$ the $K$ architectures with the largest $J$

Properties. The cost term is a deterministic, training-free model (AssumptionAssumption 1); how closely it matches ezkl-calibrated $\mathrm{logrows}$ is measured in Section 6. The budget in line 1 is applied either to the model’s estimate or, when calibration has been run, to the calibrated $\mathrm{logrows}$; the search experiments use the latter, because the former can under- or over-estimate the circuit, and in them the cost term $\hat C$ is ezkl’s calibrated cell count (an oracle cost) rather than the model’s estimate. The cost is one NEAR evaluation and one cost-model evaluation per candidate, versus an ezkl calibration or proof per candidate.

5. What Drives ezkl Circuit Cost

This section reports width-matched measurements of ezkl circuit size. Skeletons are identical across columns and only the activation changes. For each network we run ezkl (version 9.5.0) gen_settings and calibrate_settings (target=resources) with $40$ random Gaussian calibration inputs and read the calibrated $\mathrm{logrows}$ and the row count; no proofs are generated. Weights are random (seed $0$) and untrained, so calibration ranges reflect untrained networks. Polynomial networks are exported without clamping. Each cell is a single run.

Width-matched ezkl circuit size: total assigned cells (calibrated $\mathrm{logrows}$) for the same skeleton with different activations (no normalization, CIFAR-10 input). Weights and calibration data were re-drawn for three seeds; all assignment counts and $\mathrm{logrows}$ are identical across the three seeds, so one seed is shown.

ReLU and $x^2$ have the same circuit size at these widths.

We use ezkl’s total_assignments as the circuit-size measure $C$: for all $45$ runs of ReLU, $x^2$ and $x^2{+}x$ networks (five skeletons, three seeds), $\lceil\log_2 C\rceil$ equals the calibrated $\mathrm{logrows}$ exactly. The $x^2$ network has the same calibrated $\mathrm{logrows}$ as the ReLU network in all $15$ skeleton-seed pairs, and $0.2\%$ more assignments in the MLPs and $4$–$6\%$ more in the CNNs. At these widths the multiply-accumulate rows dominate, and we find no evidence that ReLU is more expensive than $x^2$. This contradicts a claim made in an earlier version of this work. The large cost differences between architectures in Table 10 therefore come from layer type (depthwise and standard convolutions versus MLP layers) and width, not from the ReLU/$x^2$ choice, and the lowest-cost architectures in that table are small polynomial MLPs because they are small MLPs.

Unnormalized $x^3{+}x$ networks calibrate to a larger circuit.

In every unnormalized skeleton, in all three seeds, the $x^3{+}x$ network has about the same number of assignments as the others ($0.99$–$1.06\times$ ReLU) but is calibrated at $\mathrm{logrows}{=}23$, against $19$–$22$ for the other activations; ezkl’s calibration also selected a lower input scale ($11$ versus $13$). At equal assigned cells this is a circuit $2^{1}$ to $2^{4}$ times larger. On trained networks calibrated with real inputs (Section 6.7), 20 of the 24 calibrated unnormalized $x^3{+}x$ networks in the sweep are at $23$ and the rest between $24$ and $25$; with LayerNorm (15 networks) they range from $19$ to $25$. Dumped ezkl settings show the mechanism (Section 6): the calibration adds a range check over $\pm2^{21}$, a table of $2^{22}$ entries, which needs $\mathrm{logrows}=23$.

Repeated draws.

Re-drawing weights and calibration data (three seeds, untrained) did not change any assignment count or $\mathrm{logrows}$ in Table 2, and Table 9 gives the same picture for trained networks and real inputs.

Hypotheses we did not test.

From reading ezkl’s circuit layout code (ezkl/src/circuit/ops/layouts.rs) we expect that reshape and concatenation add no rows, that the reciprocal square root in LayerNorm is a costly operation, and that max-pooling costs more than average-pooling. We did not measure these and make no claim about them.

6. Empirical Results

6.1 Experimental Setup

Benchmark. We regenerated the architecture sweep for this version. It contains 474 CIFAR-10 networks: 78 MLPs, 72 CNNs, 60 depthwise-separable CNNs, 132 ResNet-style and 132 depthwise ResNet-style networks, each with ReLU, $x^2$, $x^3{+}x$ or $x^2{+}x$ activations (111, 121, 121 and 121 networks) and no normalization, LayerNorm or GroupNorm. CIFAR-100 and ImageNet-16-120 results from an earlier version are withdrawn: the underlying files could not be recovered and the CIFAR-100 ReLU subset had only three networks.

Training. 30-epoch SGD (momentum $0.9$, weight decay $5{\times}10^{-4}$, cosine schedule, batch $128$, random crop with padding $4$ and horizontal flip), learning rate $0.1$, or $0.01$ with gradient clipping $1.0$ for polynomial networks without normalization. The sweep is run by sweep_gpu.py, which follows this recipe with two differences from the earlier CPU pipeline: the dataset and the augmentation live on the GPU, and the random-crop padding adds zeros in normalized space, whereas the earlier pipeline padded raw images with black pixels (which normalize to a nonzero constant). The two pipelines are therefore not identical, and accuracies are not comparable across them: for the 8 architectures shared with the earlier version the two-seed sweep mean is higher than the earlier three-seed 30-epoch mean for 8 of 8 (by +0.8 to +5.6 points; +5.6 for the LayerNorm $x^2{+}x$ MLP). All comparisons in this paper use the new sweep only. Every architecture is trained with two seeds (0 and 1). Zero-cost proxies and the cost estimate are computed once, at the seed-0 initialization. A network is called failed if training diverged or its mean test accuracy is below $15\%$.

ezkl. All calibrations in this section use ezkl 9.5.0 (calibrate_settings, target=resources), $20$ real CIFAR-10 test images as calibration inputs, and the seed-0 trained weights, on a 24-logical-core AMD Threadripper PRO 3945WX host shared with other jobs. One rule decides which networks enter every calibration-based analysis: networks whose seed-0 training failed (nothing meaningful to calibrate) and networks whose estimated $\mathrm{logrows}$ exceeds $25$ (irrelevant to the budgets studied) are excluded. 255 networks were calibrated; 21 of them met the exclusion rule (they were calibrated in an early pass before the rule was applied) and are dropped, leaving 234, of which 0 failed inside ezkl. The dropped and skipped lists are released.

Released data. Per-architecture results for both seeds (accuracy, proxies at initialization, cost estimate), the calibration records with the per-operator features used for fitting, and every summary number in this section are in the repository, together with the scripts that regenerate Tables 4–10. Trained network weights (about 0.7 GB) are not released.

6.2 Label Noise and Training Failures

Across the two seeds the median per-architecture standard deviation of test accuracy is 0.24 points (90th percentile 1.53; the maximum, 45.4, is a network that trained in one seed and failed in the other), and the Spearman correlation between the two seeds’ accuracies is 0.95. Label noise is therefore small relative to differences between architectures. Training failure is large and depends on the recipe: a network is failed if training diverged in at least one seed or its mean accuracy is below $15\%$; 170 of the 474 networks failed, and 153 of them have mean accuracy below $15\%$. Failures by activation are 0 of 111 (ReLU), 50 of 121 ($x^2$), 73 of 121 ($x^3{+}x$) and 47 of 121 ($x^2{+}x$); by normalization, 37 none, 49 LayerNorm and 84 GroupNorm (polynomial networks with normalization use the larger learning rate, so normalization does not prevent failure here). The accuracy labels of polynomial networks are therefore partly trainability labels, and we report results with and without the failed networks.

6.3 Multi-Seed and Training-Budget Validation

To check that 30-epoch accuracy is a usable ranking signal, we retrained 26 architectures (the eight architectures of the earlier version’s timing table plus activation-matched controls for ReLU, $x^2$, $x^3{+}x$ and $x^2{+}x$) with three seeds (42, 43, 44) at 30 and at 100 epochs, each with a fresh cosine schedule, using the same sweep_gpu.py pipeline as the sweep; all 156 of 156 planned runs completed (8 diverged and are included at chance level) and the per-run outputs are released (Table 3). Across architecture means the 30- to 100-epoch Spearman correlation is 0.949 ($n=26$); across the 78 paired runs it is 0.952, and the three seed-wise correlations range from 0.942 to 0.964. Accuracy rises by 6.13 points on average from 30 to 100 epochs, so the longer budget changes accuracy levels more than ordering; some deep polynomial networks learn late, so the ordering is not exact. The largest seed standard deviation at 30 epochs is 15.08 points. This job replaces an earlier three-seed validation run on a different GPU whose raw output was not retained; its numbers are used only for the pipeline comparison in Section 6.1.

Three-seed (42, 43, 44) test top-1 (mean $\pm$ sample SD) after 30 and after 100 epochs (a fresh cosine schedule for each budget) for the 26 architectures of the earlier validation, rerun with sweep_gpu.py; per-run outputs are released. Runs that diverged are included at their (chance-level) accuracy.

6.4 Zero-Cost Proxies Across Activation Families

Table 4 gives Spearman $\rho$ between each proxy and mean accuracy per activation family with bootstrap intervals and Holm-adjusted significance over the 25 activation-family tests it contains. NEAR is a reliable predictor only for ReLU networks ($\rho=+0.70$, $95\%$ CI $[+0.57,+0.80]$); on the polynomial families its intervals include zero ($x^2$ -0.12 $[-0.29,+0.05]$, $x^3{+}x$ +0.01, $x^2{+}x$ -0.14). The Zen-style score (our variant, Section 3; not the published Zen-Score) is negatively correlated with accuracy in every family in this analysis (ReLU -0.23, $x^2$ -0.42, $x^3{+}x$ -0.31, $x^2{+}x$ -0.54), but not robustly: with a common training recipe its ReLU correlation is +0.19 (Table 6) and its partial correlation on ReLU is +0.02. ZiCo is the one proxy with a significant positive coefficient on a polynomial family ($x^3{+}x$, +0.45), but once failed networks are removed (Table 5) it is -0.38 on $x^3{+}x$ and -0.50 on $x^2$: its apparent success on $x^3{+}x$ comes from separating networks that train from networks that do not, not from ranking accuracy among those that train. Removing failed networks changes other conclusions too: Holm-significant entries lost are NASWOT-sign on $x^2$; NASWOT-sign on $x^2{+}x$; NASWOT-sign on $x^3{+}x$; Zen-style on $x^2$; ZiCo on $x^3{+}x$; entries gained are Synflow on $x^2$; Synflow on $x^2{+}x$; Zen-style on $x^3{+}x$; ZiCo on $x^2$; ZiCo on $x^2{+}x$. The negative correlations of the Zen-style score and of the sign-pattern NASWOT variant are therefore partly trainability effects. MeCo and Synflow are weak or inconsistent.

Two controls address confounds. Table 6 restricts to normalized networks, where every activation was trained with the same recipe, and the picture is the same (NEAR on ReLU +0.73, on $x^2$ -0.02, $x^3{+}x$ +0.06, $x^2{+}x$ -0.07). Table 7 removes, by rank regression, the effects of architecture type, normalization and parameter count: NEAR’s partial correlation on ReLU is +0.22 (against +0.70 unadjusted), so much of NEAR’s apparent power on ReLU networks reflects architecture type and size. We therefore do not claim that any tested proxy is a reliable accuracy predictor across activation families, and we do not attribute the failure to the activation function alone.

Spearman $\rho$ between proxy score at initialization and mean top-1 accuracy over two training seeds (CIFAR-10, regenerated sweep), per activation family, with $95\%$ bootstrap CI over architectures. ${}^{*}$ marks Holm-adjusted $p<0.05$ over the 25 activation-family tests in this table. A dash or “n/a” means fewer than $8$ finite scores.

As Table 4 after excluding networks whose training diverged or ended at chance level (mean top-1 $<15\%$; 0 of 111 ReLU, 50 of 121 $x^2$, 73 of 121 $x^3{+}x$, 47 of 121 $x^2{+}x$ excluded). Holm adjustment is applied within this table.

As Table 4, restricted to networks with LayerNorm or GroupNorm. All activations in this subset were trained with the same recipe (lr $0.1$), removing the learning-rate difference that applies to norm-free polynomial networks (lr $0.01$ with clipping). Holm adjustment is applied within this table.

Partial Spearman correlation of proxy and accuracy after removing, by rank regression, the effects of architecture type (MLP, CNN, DWS-CNN, ResNet-style), normalization and $\log$ parameter count. ${}^{*}$: unadjusted $p<0.05$ for the partial correlation (descriptive only; the Holm-adjusted tests are in Table 4).

6.5 NASWOT

Standard NASWOT scores the outputs of nn.ReLU modules. It returns $-\infty$ on all 363 of the 363 polynomial networks because they contain none; for the $x^2$ networks the degeneracy is also mathematically correct (Proposition 2), but the count does not test the proposition. To remove the confound we score the sign of each activation module’s input instead (Section 3). That variant equals the standard score on ReLU networks ($\rho=+0.60$) and is defined for every polynomial network, yet it is negatively correlated with accuracy there ($x^2$ -0.27, $x^3{+}x$ -0.29, $x^2{+}x$ -0.35; Table 4). The failure of NASWOT on polynomial networks is therefore not only a missing-module artifact.

Networks with a $-\infty$ NASWOT score: standard implementation (scores nn.ReLU outputs) versus the pre-activation-sign variant.

6.6 The Zen-Style Score

Among the 110 polynomial networks without normalization, the Zen-style score is weakly negatively correlated with accuracy ($\rho=-0.22$), positively correlated with depth ($+0.35$) and with $\log$ parameter count ($+0.15$), and the failure rate is 43% in the top Zen-style quartile against 11% in the bottom quartile (14% overall). Excluding failed networks, the correlation with accuracy is -0.19 ($n=95$). Among the 39 ReLU networks without normalization it is -0.42, with $\log$ parameter count +0.40. This is descriptive: it is consistent with this variant rewarding size and depth, which are not what determines accuracy here, but we do not claim a mechanism.

6.7 ezkl Circuit Size and Timings on Trained Networks

Width-matched comparison. Table 9 repeats the width-matched comparison of Section 5 on trained networks calibrated with real inputs. The result is unchanged: ReLU and $x^2$ networks have the same $\mathrm{logrows}$ in all five unnormalized skeletons, and unnormalized $x^3{+}x$ networks calibrate to $\mathrm{logrows}{=}23$ in every skeleton. Across all 50 ReLU/$x^2$ pairs in the sweep that share a skeleton and were calibrated, 45 have the same $\mathrm{logrows}$, in 4 the $x^2$ network is smaller and in 1 it is larger; the median ratio of assigned cells ($x^2$/ReLU) is 1.03.

Accounting. $\lceil\log_2 C\rceil$ equals the calibrated $\mathrm{logrows}$ for 163 of the 234 trained networks (70%): for 146/194 ReLU, $x^2$ and $x^2{+}x$ networks (ReLU 59/77, $x^2$ 42/55, $x^2{+}x$ 45/62) and 17/40 of the $x^3{+}x$ networks. It is not exact in either direction: the calibrated $\mathrm{logrows}$ is lower than $\lceil\log_2 C\rceil$ in 52 networks and higher in 19. The next subsection explains both directions.

Timings. Table 10 replaces the timings of the earlier version, whose ezkl version, settings, weight state and hardware were not recorded. It covers 7 trained seed-0 networks at $\mathrm{logrows}$ 19–22 with real inputs, one ezkl version and one host. Mock proofs were repeated three times (spread at most 14% of the median) and take 2–49 s. Real proofs were run for all 7 networks, three times for $\mathrm{logrows}\le21$ and once for $\mathrm{logrows}=22$, and take 28–970 s. The proving times in the earlier version (up to $1340$ s for a $\mathrm{logrows}{=}21$ network) are not reproduced: the comparable network here proves in a fraction of that time, and we withdraw the earlier timings. The quantized circuits agree with the float models on 700 of 700 real test-image predictions. The host is shared with other jobs, so times are indicative; the load average before and after each run is in the released file.

Width-matched ezkl circuit size on trained seed-0 networks calibrated with real CIFAR-10 inputs: assigned cells (calibrated $\mathrm{logrows}$). “fail”: calibration did not complete or errored (recorded in the released file).

ezkl timings on trained seed-0 networks with real CIFAR-10 inputs under one recorded configuration (ezkl 9.5.0, AMD Ryzen Threadripper PRO 3945WX 12-Cores, 24 logical cores, shared host). Median [min,max] over repeats; seconds. Mock proofs: $\times3$. Real proofs: $\times3$ for $\mathrm{logrows}\le21$, $\times1$ for $\mathrm{logrows}=22$. Last column: quantized-circuit predictions that agree with the float model on real test images.

6.8 Budget-Constrained Architecture Search

Protocol. The pool is the 234 calibrated trained networks; for a budget $B$ it contains those with calibrated $\mathrm{logrows}\le B$. A method selects $K=10$ networks to train, and the outcome is the best mean accuracy among them. The joint proxy’s cost term is ezkl’s calibrated assigned cells, an oracle cost that is at least as informative as the model’s estimate, so the comparison favors the joint proxy. Each of 300 random $50/50$ splits of the pool tunes $\lambda$ over $\{0,0.25,0.5,1,2,4\}$ for the joint proxy on one half (strict improvement is required to move away from a smaller $\lambda$, so ties go to $\lambda=0$, i.e. NEAR-only) and evaluates all methods on the other. Table 11 reports regret against the best network in the evaluation half. Networks whose seed-0 training failed are not in the pool, so no method is penalized for selecting one; 2 pool members fail in seed 1 or have mean accuracy below $15\%$ and are kept at their mean accuracy. This is a limitation.

Result. Under calibrated budgets the tuned joint proxy almost always reduces to NEAR-only: $\lambda=0$ is chosen in 95% of tuning splits at $K=10$, and Joint ties NEAR-only in almost every split at $K=10$ (win/tie/loss against NEAR-only: 0/300/0, 0/300/0, 0/300/0, 19/280/1 at $B=20,21,22,23$). Because ties favor $\lambda=0$ by construction, we also report the untuned test (Table 12): the mean regret of each fixed $\lambda$ on the evaluation halves is at its minimum at $\lambda=$ 0.0, 0.0, 0.0, 0.25 for $B=20,\dots,23$, with regret 0.02, 0.04, 0.33, 3.61 at $\lambda=0$ against 0.02, 0.04, 0.33, 2.93 at the best fixed $\lambda$. Table 12 gives the paired per-split differences: for $\lambda\in\{0.25,0.5\}$ the joint proxy is better than NEAR-only in at most 25% of splits and worse in at most 25%, and in 0 of 16 budget–$K$ cells does the interval exclude zero. We therefore withdraw the earlier claim that the joint proxy improves on NEAR-only. NEAR-only does beat random selection by a wide margin at every budget (regret 0.02 vs. 1.58 at $B=20$, 0.04 vs. 4.18 at $21$, 0.33 vs. 7.47 at $22$ and 3.61 vs. 8.63 at $23$ accuracy points), and ranking by cost alone is poor (1.77 to 19.35). The pools are mixed: ReLU networks are 28–33% of each, and among the $K=10$ highest-NEAR networks at $B=20,\dots,23$ there are 7, 7, 7 and 3 polynomial networks. Because $K=10$ is a large share of the smaller pools, we repeat the comparison with $K=5$: regret is then 0.88, 0.39, 4.17 and 7.07 for NEAR-only against 3.43, 6.62, 11.78 and 12.91 for random selection, and the tuned joint proxy is again no better than NEAR-only (win/tie/loss 4/290/6, 0/294/6, 0/300/0, 2/266/32; slightly worse at $B=23$). Untuned at $K=5$ the best fixed $\lambda$ is 0.5, 0.25, 0.25 and 0.0 at $B=20,\dots,23$ (regret 0.33, 0.19, 4.12, 7.07 against 0.88, 0.39, 4.17, 7.07 at $\lambda=0$). A small $\lambda$ therefore lowers regret at some budgets and sizes and not at others, and we find no consistent gain from the cost term.

Where the cost model helps. The cost model is useful when ezkl is not run. Table 13 filters by the model’s estimated $\mathrm{logrows}$: 0–21% of the networks it admits exceed the calibrated budget, and it rejects 5–25% of the networks that are feasible. Choosing high-NEAR networks with no budget violates the calibrated budget in every case, whereas choosing inside the estimated budget does so for a fraction of 0.0, 0.4, 0.1 and 0.0 of the $K=10$ selections at $B=20,\dots,23$. The estimate thus removes most but not all budget violations; it does not replace calibration.

Budget-constrained search under ezkl-calibrated budgets ($\mathrm{logrows}\le B$ from calibration of trained networks). Each of 300 random $50/50$ splits of the pool tunes $\lambda\in\{0,0.25,0.5,1,2,4\}$ for the joint proxy on one half and evaluates all methods on the other, choosing $K{=}10$ architectures to train; the outcome is the best accuracy among them. Entries are mean regret in accuracy points against the best architecture in the evaluation half, with the $2.5$–$97.5$ percentile range over splits; Random averages $50$ draws per split. Last column: splits where Joint beats / ties / loses to NEAR-only (regret).

Untuned test of the joint proxy. For each fixed $\lambda>0$, the per-split paired difference in regret (accuracy points) relative to $\lambda=0$ (NEAR-only) on the evaluation halves: mean, $2.5$–$97.5$ percentile range over 300 splits, and in parentheses the percentage of splits in which it is better / worse (negative difference = better than NEAR-only). The third column is NEAR-only’s mean regret. Upper block $K=10$, lower block $K=5$.

Filtering by the cost model’s estimated $\mathrm{logrows}$ (no ezkl run) against the calibrated budget, on the 234 calibrated trained networks. “feasible”: calibrated $\mathrm{logrows}\le B$. “admitted”: estimated $\mathrm{logrows}\le B$. “Exceeds”: share of admitted networks whose calibrated $\mathrm{logrows}>B$. “Rejected”: share of feasible networks the estimate rejects. “Violation”: share of the $K{=}10$ highest-NEAR networks, chosen inside the estimated budget (or with no budget), whose calibrated $\mathrm{logrows}>B$. $95\%$ bootstrap intervals over networks.

6.9 Cost-Model Fit and Evaluation

Table 14 fits the coefficients of Eq. Eq. (1) by non-negative least squares on 180 trained networks and evaluates on the 54 networks that remain, after the exclusion rule, from a $73$-network validation sample drawn earlier (a stratified sample of MLP, CNN and DWS-CNN architectures; no ResNet-style networks), which are excluded from the fit. Because that evaluation split contains no ResNet-style networks while 82 of the fit networks are ResNet-style, we also report repeated $5$-fold cross-validation over all 234 calibrated networks: the hand-set proxy matches the calibrated $\mathrm{logrows}$ exactly for 68% and within one for 93% (Spearman 0.87), the fitted model for 70% and 95% (0.89), and the fitted model is exact for 100% of the 16 ResNet-style and 66% of the 66 depthwise ResNet-style networks. On the evaluation split the hand-set proxy matches the calibrated $\mathrm{logrows}$ exactly for 37 and within one for 50 of 54 (Spearman 0.80, RMSE 0.19 in $\log_2$ cells); the fitted model for 39 and 51 (0.84, 0.11). Fitted coefficients are close to one assigned cell per multiply-accumulate (standard convolution 0.94, depthwise 1.11, Gemm 0.99) and zero per matrix-multiply or convolution node, so the hand-set per-node overhead of $4096$ cells is not supported by the data. Per-element costs are 14.82 (ReLU), 12.30 (power), 5.57 (normalization), 2.28 (multiplication) and 3.40 (addition), so ReLU and the polynomial power operator cost the same order of magnitude per element, consistent with Section 5. Agreement is weaker for $x^3{+}x$ networks (exact on 3/7 of the evaluation networks), where calibration, not cell count, sets the circuit size.

Why $\lceil\log_2 C\rceil$ is not always $\mathrm{logrows}$. In ezkl’s settings the reported row count is half of the assigned cells: the ratio of assigned cells to rows lies between 1.9999 and 2.0000 in all 234 calibrated networks. The calibrated $\mathrm{logrows}$ is then the largest of four resource requirements, not a function of rows alone: $\mathrm{logrows}=\max(\lceil\log_2\text{rows}\rceil,\lceil\log_2\text{const}\rceil,\lceil\log_2\text{lookup span}\rceil,\lceil\log_2\text{range-check span}\rceil)$, where const is ezkl’s total_const_size (weights stored as constants: for MLPs it equals the parameter count, median const/parameters 1.0, while for convolutional networks it is 126–363 times larger; we did not investigate why), lookup span is the width of the calibrated lookup range and range-check span is the largest range-check table. The rule reproduces the calibrated $\mathrm{logrows}$ exactly for 72 of 72 dumped networks, a random sample of up to $30$ networks per activation family among those with fewer than $2.2$M assigned cells plus $11$ chosen earlier to include matching and mismatching cases; none is excluded by the exclusion rule, and their $\mathrm{logrows}$ range over 19–23, so the rule is validated for small circuits only (Table 15; ReLU 19/19, $x^2$ 19/19, $x^2{+}x$ 21/21, $x^3{+}x$ 13/13). The resource that binds is the row count in 16 networks, the constants in 60, the lookup table in 15 and a range-check table in 12. This explains the $x^3{+}x$ anomaly: 12 of the 13 dumped $x^3{+}x$ networks have a range check of $\pm2^{21}$ (a span of $2^{22}+1$ values, just above a $2^{22}$-entry table, so it needs $\mathrm{logrows}=23$; ezkl’s calibration also selects the lower input scale $11$) regardless of cell count (the unnormalized $x^3{+}x$ networks of the sweep are at 23 and, for four of them, at 24–25), and none of the 0 ReLU, $x^2$ or $x^2{+}x$ networks has such a range check, and it explains why parameter-heavy but MAC-light networks are set by their constants rather than their cells. The rule is an empirical fit to settings we dumped, not a derivation from ezkl’s source, and our cost model predicts only the cell count, which fixes the rows requirement but not the constants, lookup-table or range-check requirements. Because ezkl’s rows are half the cells, the rows requirement is $\lceil\log_2 C\rceil-1$ in 72 of 72 dumps; $\lceil\log_2 C\rceil$ is then the calibrated $\mathrm{logrows}$ exactly when another requirement binds one level higher (the constants requirement equals $\lceil\log_2 C\rceil$ in 53 of 72 dumps, which is why the cell-count estimate is right for most networks), and the calibrated $\mathrm{logrows}$ is lower than $\lceil\log_2 C\rceil$ when the rows requirement alone binds. $\varepsilon$ in Eq. Eq. (1) is reported only through these residuals, and we do not claim an exact formula.

Cost model of Eq. Eq. (1) against ezkl-calibrated $\mathrm{logrows}$ on trained networks with real inputs. Coefficients are fitted by non-negative least squares (relative-error weighting) on 180 networks and evaluated on the 54 networks of the earlier validation set, which are excluded from the fit. “exact” and “within 1” count networks whose predicted $\lceil\log_2 C\rceil$ equals or is within one of the calibrated $\mathrm{logrows}$; $\rho$ is Spearman between predicted and calibrated $\mathrm{logrows}$; RMSE is in $\log_2$ of assigned cells.

Fitted coefficients (cells per MAC / per node / per element): macs_conv_standard=0.941, macs_conv_depthwise=1.11, macs_gemm=0.992, n_matmul_conv_nodes=0, elem_relu=14.8, elem_pow=12.3, elem_mul=2.28, elem_add_sub=3.4, elem_norm=5.57, elem_pool_reduce=0.

Test of the four-resource rule $\mathrm{logrows}=\max(\lceil\log_2\text{rows}\rceil,\lceil\log_2\text{const}\rceil,\lceil\log_2\text{lookup span}\rceil,\lceil\log_2\text{range-check span}\rceil)$ on ezkl’s dumped settings.json for 72 trained networks (a random sample of up to $30$ per activation among networks under $2.2$M assigned cells, plus $11$ chosen earlier; $\mathrm{logrows}$ range 19–23 ). The binding resource (ties counted for each) was rows in 16, constants in 60, lookup table in 15 and range-check table in 12 networks.

7. Related Work

ZK-ML provers.

ezkl (zkonduit 2022) is the primary Halo2-based system (our evaluation target). Orion/Giza uses Cairo/STARK (no trusted setup, larger proofs). RISC Zero and SP1 use RISC-V zkVMs. None include NAS tooling or benchmark data. A recent survey of ZK-based verifiable machine learning (Peng et al. 2025) names limited circuit expressiveness and high proving cost among the main obstacles; architecture-level search for proving cost is one way to address the latter.

ZK circuit optimization.

TeleSparse (Maheri et al. 2025) applies post-hoc sparsification and neural teleportation (to narrow activation ranges and hence lookup tables) to reduce proof time by $46\%$ at roughly $1\%$ accuracy cost. This is complementary to our approach: TeleSparse compresses a fixed ReLU architecture after-the-fact; this work instead measures how circuit cost depends on the architecture and evaluates proxies for accuracy and cost (we do not claim a search method that improves on NEAR-only). ZKML (EuroSys 2024) and ZEN (2021) optimize compiler passes; to our knowledge none searches over architecture space. Two NAS works are close in name but not in goal: PASNet (Peng et al. 2023) searches over polynomial-versus-ReLU activations for two-party-computation private inference, where the cost model is communication and latency rather than ZK circuit size; and zkNAS (Wang et al. 2026) uses zero-knowledge proofs to let a server prove that an outsourced architecture search was run correctly, rather than searching for architectures that are cheap to prove. Closest in measurement scope, Akor et al. (Akor et al. 2026) profile eight CNN layer types (activations, pooling, normalization and linear layers) in ezkl at two precision settings over $26$ experiments, reporting proof time, proof size, circuit complexity and peak memory. Our Section 5 is complementary rather than a replacement: it compares whole networks that differ only in activation, at matched width, and relates a graph-level cost model to ezkl’s calibrated circuit size, and it feeds a NAS benchmark. We have read their abstract but have not reproduced their measurements, so we make no claim about whether our ReLU-versus-$x^2$ result agrees with their layer-level activation measurements.

MPC/FHE NAS.

CryptoNAS (Ghodsi et al. 2020) minimizes ReLU count for MPC (garbled circuits). In MPC, linear layers are free via secret sharing; in ZK-SNARKs they are not. In our fitted cost model multiply-accumulates cost about one assigned cell each while a ReLU element costs about 14.82 cells (Section 6), so at the widths we test the multiply-accumulate cells dominate and ReLU count would be a poor proxy for circuit size; we did not evaluate CryptoNAS itself. LinGCN (NeurIPS 2023) linearizes nonlinear layers for homomorphically encrypted inference, where multiplicative depth is the relevant cost; in our ZK setting the cost model depends on circuit size across all layers.

Training-free NAS proxies.

NEAR (Husistein et al. 2025), AZ-NAS (Lee & Ham 2024), ZiCo (Li et al. 2023), and MeCo (Jiang et al. 2023) were developed and evaluated on standard ReLU-based NAS benchmarks (e.g. NAS-Bench-201 and NATS-Bench). In our benchmark NEAR is $+0.70$ on ReLU networks but $-0.12$ on $x^2$ networks (Table 4), and NASWOT is degenerate on $x^2$ networks (Proposition 2). We are not aware of earlier evaluations of these proxies on ZK-cost search spaces.

NAS benchmarks.

NASBench-201 (Dong & Yang 2020) is the de facto standard, using ReLU+BatchNorm exclusively. NATS-Bench (Dong et al. 2021) likewise focuses on standard activations. Neither includes polynomial activations, BN-free designs, or ZK cost as a metric. Layer-level ezkl measurements exist (see below), but we are not aware of an architecture-level NAS benchmark that records ZK circuit cost alongside accuracy for polynomial and BN-free networks.

8. Limitations and Discussion

Scope.

All experiments use CIFAR-10 inputs, MLPs, CNNs and ResNet-style networks, one ezkl version (9.5.0), and one host. The largest calibrated circuit in the analyses has $\mathrm{logrows}{=}25$ and the largest proved circuit $\mathrm{logrows}{=}22$. We make no claim about transformers, ImageNet-scale inputs, other proving backends, or hardware other than the one used. We expect a ResNet-50 on $224{\times}224$ ImageNet to need on the order of $\mathrm{logrows}{\approx}35$; this is an extrapolation, not a measurement.

Label quality and failures.

Accuracy is measured after 30 epochs with two seeds (median standard deviation 0.24 points; seed-pair Spearman 0.95). A three-seed, 100-epoch validation of 26 architectures (Section 6.3) gives a 30-to-100-epoch Spearman of $0.949$ across architecture means, supporting 30 epochs as a ranking signal, but late learning in some deep polynomial networks means the ordering is not exact. 153 networks, mostly polynomial, end at chance level (170 fail by the definition of Section 6.1); polynomial networks with normalization used the larger learning rate and fail often, so accuracy labels for polynomial networks partly measure trainability under this recipe. We report results with and without the failed networks and with a common recipe, but a different recipe could change the polynomial results.

Calibration on trained networks, and pools.

Circuit-size results use trained seed-0 weights and $20$ real test images for calibration. ezkl’s calibration depends on the network and the calibration data, and we did not study its sensitivity to the number or choice of calibration images. Networks whose seed-0 training failed and networks with estimated $\mathrm{logrows}>25$ are not in the search pools (2 pool members fail in seed 1 or have mean accuracy below $15\%$ and are kept at their mean accuracy). Search results therefore describe a pool of trainable, calibratable networks (ReLU networks are 28–33% of each pool), and they do not penalize methods for selecting networks that would fail.

Timings.

Real-proof timings cover seven architectures, were run on a host shared with other jobs, and use one real proof at logrows 22 (Table 10). They are indicative; circuit size ($\mathrm{logrows}$, assigned cells) is the measure we rely on.

Reproducibility.

Per-architecture results for both seeds, calibration records with fitting features, and the scripts that generate every table are released. Trained weights (about 0.7 GB) are not.

What we do not claim.

We make no claim about the published Zen-Score (our Zen-style score is a variant that differs in four respects, Section 3). We do not claim that polynomial activations are cheaper to prove, that the joint accuracy-cost proxy improves search, that the cost model is exact, or that any tested proxy predicts accuracy across activation families.

9. Conclusion

We evaluated ZK circuit cost and zero-cost accuracy proxies against ezkl on trained CIFAR-10 networks. A parametric cell-count model fitted on 180 networks matches ezkl-calibrated $\mathrm{logrows}$ exactly for 39 of 54 held-out networks and within one for 51, with weak agreement for $x^3{+}x$. Width-matched, ReLU and $x^2$ networks have the same circuit size, which contradicts the common assumption that polynomial activations are cheaper to prove in ezkl; the largest cost differences we found come from layer type, width and ezkl’s range calibration. NEAR predicts accuracy for ReLU networks only, a Zen-style score (our variant of Zen-NAS) and a NASWOT variant are anti-correlated on polynomial networks, and under budgets set on calibrated circuit size a joint accuracy-cost proxy does not improve on NEAR-only. The cost model is most useful as a pre-filter: it removes most, not all, budget violations without running ezkl.

The zkml-bench code, per-architecture results for both seeds, calibration records, and the scripts that regenerate every table are at https://github.com/npow/zk-circuit-aware-nas (tag v2). Trained weights (about 0.7 GB) are not released.

References

• Abdelfattah, M. S., Mehrotra, A., Dudziak, Ł., and Lane, N. D. Zero-cost proxies for lightweight nas. In International Conference on Learning Representations, 2021.

• Dong, X. and Yang, Y. NAS-Bench-201: Extending the scope of reproducible neural architecture search. In International Conference on Learning Representations, 2020.

• Akor, G. C., Ahakonye, L. A. C., Lee, J.-M., and Kim, D.-S. Benchmarking CNN components in EZKL: A layer-level analysis for EVM-compatible deployment. In International Conference on Artificial Intelligence in Information and Communication (ICAIIC), pages 645–650, 2026. doi:10.1109/ICAIIC68212.2026.11454315.

• Dong, X., Liu, L., Musial, K., and Gabrys, B. NATS-Bench: Benchmarking NAS algorithms for architecture topology and size. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021.

• Ghodsi, Z., Veldanda, A. K., Reagen, B., and Garg, S. CryptoNAS: Private inference on a relu budget. In Advances in Neural Information Processing Systems, 2020.

• Husistein, R. T., Reiher, M., and Eckhoff, M. NEAR: A training-free pre-estimator of machine learning model performance. In International Conference on Learning Representations, 2025.

• Jiang, T., Wang, H., and Bie, R. MeCo: Zero-shot NAS with one data and single forward pass via minimum eigenvalue of correlation. In Advances in Neural Information Processing Systems, 2023.

• Lee, J. and Ham, B. AZ-NAS: Assembling zero-cost proxies for network architecture search. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024.

• Li, G., Yang, Y., Bhardwaj, K., and Marculescu, R. ZiCo: Zero-shot nas via inverse coefficient of variation on gradients. In International Conference on Learning Representations, 2023.

• Lin, M., Wang, P., Sun, Z., Chen, H., Sun, X., Qian, Q., Li, H., and Jin, R. Zen-NAS: A zero-shot nas for high-performance image recognition. In International Conference on Computer Vision, 2021.

• Mellor, J., Turner, J., Storkey, A., and Crowley, E. J. Neural architecture search without training. In International Conference on Machine Learning, 2021.

• Maheri, M. M., Haddadi, H., and Davidson, A. TeleSparse: Practical privacy-preserving verification of deep neural networks. Proceedings on Privacy Enhancing Technologies, 2025(4):861–880; arXiv:2504.19274.

• Peng, H., Zhou, S., Luo, Y., Xu, N., Duan, S., Ran, R., Zhao, J., Wang, C., Geng, T., Wen, W., Xu, X., and Ding, C. PASNet: Polynomial architecture search framework for two-party computation-based secure neural network deployment. In ACM/IEEE Design Automation Conference (DAC), 2023; arXiv:2306.15513.

• Peng, Z., and others. A survey of zero-knowledge proof based verifiable machine learning. arXiv preprint arXiv:2502.18535, 2025.

• Tanaka, H., Kunin, D., Yamins, D. L. K., and Ganguli, S. Pruning neural networks without any data by iteratively conserving synaptic flow. In Advances in Neural Information Processing Systems, 2020.

• Wang, H., Zhang, D., Jiang, T., Wang, D., Guo, F., Wang, J., and Guo, Y. zkNAS: Secure and efficient outsourced-NAS with zero-cost proxies. Springer Nature Singapore, 2026. doi:10.1007/978-981-92-0375-8_31.

• zkonduit. ezkl: zero-knowledge machine learning inference toolchain (software). https://github.com/zkonduit/ezkl.

Disclosure of AI use

Claude (Anthropic; Claude Code with Sonnet and Opus-class models) was used throughout this work: writing and debugging the code in the linked repository, running experiments, drafting and revising the manuscript, and simulated peer review. The human author directed the research, reviewed the results, and is responsible for the content.

Reproducibility scope: the per-architecture results for the regenerated CIFAR-10 sweep (two seeds), the ezkl calibration records on trained networks, the ezkl timing records, the multi-seed validation outputs and the scripts that generate every table are in the linked repository. Trained network weights (about 0.7 GB) are not released.