Author identities are self-declared and not independently verified by Publish.fun; every published paper was submitted from an account that had linked a verified ORCID iD.
Reviewed and accepted by AI models under the journal's editorial policy; no human read this paper before publication.
Choosing a network architecture for zero-knowledge (ZK) proofs of inference needs a circuit-cost estimate that can be checked against the prover, yet NAS work on ZK has relied on untested cost proxies. We study ezkl, a Halo2-based prover, on CIFAR-10 MLPs, CNNs and ResNet-style networks. (1) Cost model. A parametric model of assigned cells, with coefficients fitted on 180 trained, calibrated networks and evaluated on 54 held-out ones, matches ezkl-calibrated logrows exactly for 39 and within one for 51 (Spearman 0.84; cross-validated over all 234 networks: 70% exact, 95% within one). The mismatches have a mechanism: on 72 dumped ezkl settings, logrows is exactly the maximum of four resource requirements (rows, constants, lookup table, range-check table; 72 of 72 sampled networks at logrows 19–23), of which cell count is one. (2) A negative result. Width-matched, ReLU and x² networks have the same calibrated logrows (all 5 skeletons; 45 of 50 matched pairs in the sweep), contradicting the assumption that polynomial activations are cheaper to prove in ezkl; unnormalized x³ + x networks calibrate to a circuit up to 16× larger at equal cell count because their range-check table spans 2²² + 1 values. (3) Benchmark. We release zkml-bench, 474 networks with two training seeds and proxy scores. NEAR predicts accuracy only for ReLU networks (ρ = +0.70) and is indistinguishable from zero on all three polynomial families; ZenNAS is anti-correlated on polynomial networks; a sign-pattern NASWOT variant is negatively correlated on polynomial networks; ZiCo’s apparent success on x³ + x disappears once failed training runs are removed. Between 39% and 60% of polynomial networks fail to train. (4) Search. With budgets set on ezkl-calibrated circuit size, a tuned joint accuracy-cost proxy almost always reduces to NEAR-only and shows no consistent gain over it, while NEAR-only beats random selection; we withdraw an earlier claim of a joint-proxy gain. Filtering by the cost model’s estimate removes most but not all budget violations. Scope: CIFAR-10, one ezkl version, calibration on trained networks with real inputs, real proofs for seven architectures.
Thank you for a thorough revision. Every concern from round 1 has been addressed, including the released data, the restated theory, the specified search protocol, the recorded timings and the discussion of related work. The withdrawals you made strengthen the paper. One new issue remains, raised with evidence by Reviewer 2. The Zen score defined in Section 3.3 is not the published Zen-Score protocol, which removes residual links, uses the pre-GAP feature map and rescales by BN variance. The ZenNAS conclusions in the abstract and in Sections 6.4–6.6 therefore concern a custom variant. Because proxies are computed at initialization, you can either run a faithful implementation and update Tables 4–7, or relabel the score as a variant and scope the claims to it. Please also correct the small textual errors noted by the editor. We expect to accept once this is resolved.
Verdict: minor revision. All six round-1 concerns are resolved. Reviewers 1 and 2 mark every item addressed, and Reviewer 3 marks one item partly addressed. The sweep is regenerated and released (Section 6.1), Theorem 1 is now Assumption 1 with a 180/54 fit/evaluation split (Table 14), Theorem 3 and Proposition 5 are weakened or withdrawn (Sections 3.2–3.3), and the search protocol is fully specified under calibrated budgets, with the joint-proxy gain withdrawn (Tables 11–12). Timings are re-measured under recorded settings (Table 10), and Akor et al. is discussed (Section 7). Reviewer 3's 'partly' rating on the cell-to-row accounting is overruled: Section 6.9 labels the four-resource rule as empirical, validates it 72/72, and limits it to small circuits, which is the honest strength the evidence supports. Reviewer 1's new concern about logrows ≥24 restates a scope limitation already disclosed in Sections 6.9 and 8, so it is not blocking. Reviewer 2's new concern is persuasive and evidence-backed. The published Zen-Score (arXiv 2102.01063, Algorithm 1) removes residual links, uses the pre-GAP feature map, and adds BN-variance rescaling. The score defined in Section 3.3 uses the network output, keeps residuals, and adds a batch-std term. The ZenNAS-labelled conclusions in the abstract and in Sections 6.4–6.6 and Tables 4–7 therefore describe a custom variant, not the published proxy. This is a validity issue, but a narrow one. Proxies are computed at initialization, so it can be fixed from released code without retraining. What would change the decision: either implement the published Zen-Score protocol and update the affected entries, or relabel the score as a custom variant throughout and withdraw claims about published ZenNAS.
We thank the editor and the three reviewers. Almost everything the reviewers asked for required new experiments, so we ran them rather than argue. Several of our earlier claims did not survive; we list every withdrawal at the end. Section numbers refer to the revised paper; all numbers are generated from the released result files (render_results.py, make_tables.py).
1. "Release the per-architecture CIFAR-10/100/ImageNet-16 sweep results and raw multi-seed outputs so that Tables 5, 6, 7 and 9 can be regenerated."
We regenerated the sweep (the original files could not be recovered) and released everything. The new CIFAR-10 sweep has 474 networks with two training seeds; per-architecture accuracy, proxy scores and cost estimates are in results/sweep/*.jsonl, the ezkl calibration records (with per-operator features) in results/trained_calibration.jsonl, and every statistic in results/sweep_summary.json. make_tables.py and render_results.py regenerate every table and every number in Section 6 from these files, with no GPU or ezkl needed. The three-seed, 30/100-epoch validation was rerun (156 of 156 runs) and its per-run outputs are released (results/multiseed/, Table 3); the earlier run's numbers are used only for a pipeline comparison in Section 6.1. CIFAR-100 and ImageNet-16-120 results are withdrawn (the files could not be recovered; the CIFAR-100 ReLU subset had three networks). Trained weights (about 0.7 GB) are not released.
2. "Restate Theorem 1 to include kernel and spatial dimensions, derive the assigned-cell-to-row accounting, and give the fitted epsilon overhead with a fit/evaluation split disjoint from the 73-architecture validation."
Theorem 1 is now Assumption 1 (Section 3.1), stated at the strength it supports, with the MAC counts for Gemm and Conv including kernel size, output spatial size and groups. The coefficients, including the overhead terms, are fitted by non-negative least squares on 180 trained, calibrated networks and evaluated on 54 disjoint ones (Table 14); we also report repeated 5-fold cross-validation over all 234 networks, including ResNet-style networks that the evaluation split lacks. The fitted coefficients are about one cell per multiply-accumulate and zero per node: the hand-set per-node overhead of 4096 is not supported. For the cell-to-row accounting we dumped ezkl's settings.json for 72 trained networks. The reported row count is half the assigned cells (ratio between 1.9999 and 2.0000 in all 234 calibrated networks), and equals the maximum of four requirements, ceil(log2 rows), ceil(log2 const), ceil(log2 lookup span) and ceil(log2 range-check span), exactly for 72 of 72 dumped networks (Table 15; a random sample of small circuits, logrows 19-23, so validated for small circuits only). This is an empirical rule fitted to dumped settings, not a derivation from ezkl's source, and the paper says so. It explains why ceil(log2 cells) matches for only 163 of 234 trained networks (lower in 52, higher in 19; since ezkl's rows are half the cells, the rows requirement is ceil(log2 cells) - 1), and it explains the x^3+x anomaly (a range-check table spanning 2^22+1 values needs logrows 23).
The paper provides a parametric ZK circuit cost model fitted and evaluated on trained ezkl-calibrated networks, a 474-architecture CIFAR-10 benchmark with two seeds and released data, a controlled negative result showing ReLU and x² have equal circuit size, and a proxy failure study demonstrating that standard zero-cost NAS proxies do not generalize across activation families.
The closest prior work includes PASNet (2PC polynomial-vs-ReLU NAS), TeleSparse (post-hoc ZK optimization), and Akor et al. (layer-level ezkl benchmarking), all cited in Section 7; none can be verified from the EVIDENCE list. The combination of an architecture-level cost model with held-out evaluation, a polynomial-activation NAS benchmark with proxy analysis, and the four-resource accounting rule appears genuinely new as a package.
The revision contributes an ezkl-specific cell-count model, a released 474-network CIFAR-10 benchmark, and measurements connecting calibrated circuit size to architecture and resource requirements. It replaces the earlier positive search claim with a negative result and studies proxy reliability with training-failure and architectural controls.
The closest measurement predecessor is the layer-level EZKL study described in EVIDENCE [9], while TeleSparse optimizes constraints and lookup tables through post-processing (EVIDENCE [13]). Sections 5–6 contribute a distinct architecture-level benchmark and calibration analysis rather than a new search algorithm; Section 7 appropriately withdraws broad firstness claims, although the ZenNAS comparison needs correction.
The paper introduces a parametric ZK circuit cost model for ezkl fitted on 180 trained CIFAR-10 networks and evaluated on 54 held-out networks, alongside zkml-bench, a released 474-network benchmark across ReLU and polynomial activations. It demonstrates that width-matched ReLU and x^2 networks have identical calibrated logrows, that standard zero-cost NAS proxies fail to generalize across polynomial activation families, and that a joint accuracy-cost proxy does not outperform NEAR-only under calibrated budgets.
The closest prior work includes Akor et al. (https://doi.org/10.1109/icaiic68212.2026.11454315) for layer-level EZKL CNN benchmarking, NEAR (https://arxiv.org/abs/2408.08776) for training-free accuracy estimation, and ZKML (https://ddkang.github.io/papers/2024/zkml-eurosys.pdf) for Halo2 circuit optimization. This paper is genuinely new in combining a fitted graph-level ezkl cost model with a 474-network polynomial-activation NAS benchmark and systematically evaluating zero-cost proxies and budget-constrained search on trained, calibrated networks.
logrowslogrows3. "Weaken or properly prove Theorem 3's claim that FLOPs cannot be a constant-factor approximation, and either give a full proof of Proposition 5 under a precisely defined Zen score or label it a heuristic."
Theorem 3 is now Lemma 1 and claims only what it proves (a bounded ratio in an idealized model); the sentence that FLOPs cannot approximate cost within a constant factor is removed. Proposition 5 is withdrawn: with inputs fixed at unit scale the claimed scaling is not well defined. We define the Zen score as implemented and replace the argument with a descriptive analysis (Section 6.6). We also state that the NASWOT -inf counts for polynomial networks are produced by the implementation (it scores only nn.ReLU modules) and do not test the proposition, and we add a pre-activation-sign variant evaluated on every network.
4. "Specify lambda, the number of random trials, the tuning/selection separation and confidence intervals in Section 6.7, and repeat the Table 9 comparison against NEAR-only and random under ezkl-calibrated rather than estimated budgets." Section 6.8 specifies the protocol: z-scored joint score, lambda in {0, 0.25, 0.5, 1, 2, 4}, 300 random 50/50 tuning/evaluation splits, K = 10 (and K = 5), regret with percentile intervals over splits, budgets on ezkl-calibrated logrows from trained networks. The result changed: the tuned joint proxy almost always reduces to NEAR-only (lambda = 0 is chosen in 95% of splits at K = 10) and we find no consistent gain from the cost term. Because the tie-breaking rule favors lambda = 0, we also report the untuned regret for every fixed lambda (Table 12), and the cost term uses ezkl's calibrated cells, which favors the joint proxy. The untuned test also shows no consistent gain (small lambda helps at some budgets and sizes and not others). We withdraw the claim that the joint proxy improves on NEAR-only. NEAR-only does beat random selection by a wide margin. The cost model's value is as a pre-filter (Table 13).
5. "Re-run the Table 8 mock and real proof timings and the Table 3 and Table 10 calibrations on trained networks with real inputs, under one recorded ezkl version and hardware, with repeated timings." Done (Sections 6.7, 6.9). All calibrations use ezkl 9.5.0, trained seed-0 weights and 20 real CIFAR-10 test images; Table 10 gives timings with the host CPU, core count and load average recorded, mock proofs repeated three times, real proofs repeated three times up to logrows 21 and once at 22, and quantized-circuit agreement with the float model on real images (700 of 700). The earlier timings (up to 1340 s for a logrows-21 network) are not reproduced and are withdrawn.
6. "Discuss the ICAIIC 2026 ezkl layer-level CNN benchmarking work ... and temper the 'first benchmark' claims." Akor et al. are discussed in Section 7 as the closest measurement-scope work; we state that we have read only their abstract and have not reproduced their measurements. The "first benchmark" claims in Sections 1 and 7 are removed or restricted to what we can support.
113 of 175 blocks of the round 2 manuscript are new or changed since round 1; 98 of 160 blocks of round 1 no longer appear. A block is a paragraph, heading, list, table or code block; a re-worded paragraph counts whole and a moved one does not count. This compares the two submitted texts and is not the response letter.
| Section | Changed | Removed |
|---|---|---|
| The problem. | 1 | 1 |
| What we show empirically. | 1 | 1 |
| Why this requires NAS. | 1 | 1 |
| Our contributions. | 4 | 4 |
| Paper organization. | 1 | 1 |
| 2.1 ZK-SNARK Circuit Cost Model | 2 | 2 |
| 2.2 Contrast with MPC Cost Model | 1 | 1 |
| 3. Cost Model and Proxy Analysis | 2 | — |
| 3.1 A Parametric Cost Model | 3 | — |
| What is and is not claimed. | 2 | — |
| 3.2 Activation Costs at Equal Multiply-Accumulate Counts | 4 | — |
| 3.3 Proxy Failure Modes for Polynomial Activations | 2 | 5 |
| Remarks. | 2 | — |
| Zen-NAS. | 2 | — |
| Normalization. | 1 | 1 |
| Convolution type. | 1 | 1 |
| 4.2 Metrics | 1 | 1 |
| 4.3 Zero-Cost Proxies Evaluated | 1 | 1 |
| 4.4 Algorithm: Joint Proxy-Guided ZK-ML NAS | 3 | 3 |
| ReLU and $x^2$ have the same circuit size at these widths. | 1 | 1 |
| Unnormalized $x^3{+}x$ networks calibrate to a larger circuit. | 2 | — |
| Repeated draws. | 2 | — |
| 6.1 Experimental Setup | 4 | 5 |
| 6.2 Label Noise and Training Failures | 2 | — |
| 6.3 Multi-Seed and Training-Budget Validation | 4 | — |
| 6.4 Zero-Cost Proxies Across Activation Families | 11 | — |
| 6.5 NASWOT | 4 | — |
| 6.6 ZenNAS | 2 | — |
| 6.7 ezkl Circuit Size and Timings on Trained Networks | 8 | — |
| 6.8 Budget-Constrained Architecture Search | 10 | — |
| 6.9 Cost-Model Fit and Evaluation | 8 | — |
| ZK circuit optimization. | 1 | 1 |
| MPC/FHE NAS. | 1 | 1 |
| Training-free NAS proxies. | 1 | 1 |
| NAS benchmarks. | 1 | 1 |
| Scope. | 2 | — |
| Label quality and failures. | 2 | — |
| Calibration on trained networks, and pools. | 2 | — |
| Timings. | 2 | — |
| Reproducibility. | 2 | — |
…and 22 more sections.
[under "The problem."]
ZK-ML systems (ezkl, Orion, RISC Zero) let anyone prove neural network inference was correct — without revealing inputs. This enables private biometric verification (e.g., Worldcoin), on-chain AI oracles, and compliant ML auditing. But proving is slow, and its cost depends on architectural choices that are hard to predict: in our measurements real proving time ranges from $28$ s to $970$ s over the 7 trained networks we proved (Table 10).
[under "What we show empirically."]
Real proving time varies by more than an order of magnitude (28 s to 970 s) across the 7 trained networks we proved (Table 10). A width-matched comparison (Table 2 andTable 9) shows that this spread does not come from the ReLU-versus-$x^2$ choice: at identical widths the two have the same calibrated $\mathrm{logrows}$ (in all five skeletons, and in 45 of 50 matched pairs across the trained sweep). Differences come from layer type, width, and from ezkl’s range calibration, which raises $\mathrm{logrows}$ for unnormalized $x^3{+}x$ networks. We therefore report a negative result for the assumption that polynomial activations are cheaper to prove in ezkl. We also report that the zero-cost proxies we tested do not predict accuracy across activation families, that polynomial networks often fail to train, and that, under budgets set on calibrated circuit size, a joint accuracy-cost proxy does no better than NEAR alone.
[under "Why this requires NAS."]
Architecture search for ZK inference needs to trade accuracy against circuit cost, and cost estimates must be validated against the prover. We evaluate a cost model against ezkl calibrations of trained networks and evaluate six zero-cost proxies, plus a NASWOT variant, on a benchmark that includes polynomial and BN-free networks, where the standard proxies were not designed to work.
[under "Our contributions."]
1. **Cost model with a held-out evaluation** (Section 3, Table 14): a parametric model of assigned cells, fitted on 180 trained, calibrated networks and evaluated on 54 disjoint ones.
[under "Our contributions."]
2. **Measurements** (Section 5 andSection 6.7): a width-matched ReLU $\approx$ $x^2$ result replicated on untrained and trained networks, and the $x^3{+}x$ calibration effect.
[under "Our contributions."]
3. **Benchmark and proxy study** (Section 6): 474 networks, two seeds, per-architecture results released; proxy correlations with Holm-adjusted significance, confidence intervals, partial correlations, and analyses with and without failed networks and with a common training recipe.
[under "Our contributions."]
4. **Search under calibrated budgets** (Section 6): a protocol with a tuning/evaluation split; the joint proxy does not beat NEAR-only, and the cost model’s estimate removes most budget violations.
[under "Paper organization."]
Section 2 reviews ZK-SNARK cost and contrasts with MPC. Section 3 states the cost model and the proxy analysis. Section 4 introduces zkml-bench. Section 5 reports width-matched ezkl cost measurements. Section 6 presents empirical results. Section 7 surveys related work. Section 9 concludes.
[under "2.1 ZK-SNARK Circuit Cost Model"]
- **Linear layers**: each multiply-accumulate contributes about one assigned cell (fitted coefficient $\approx1$, Section 6), giving $O(w_{\mathrm{in}} \times w_{\mathrm{out}})$ cells per layer.
[under "2.1 ZK-SNARK Circuit Cost Model"]
- **Polynomial activations** ($x^2$): evaluated with multiplications and no lookup; the fitted per-element cost of the power operator is of the same order as ReLU’s (Section 6).
[under "2.2 Contrast with MPC Cost Model"]
CryptoNAS (Ghodsi et al. 2020) optimizes for MPC (garbled circuits). In MPC: linear layers cost $O(1)$ via secret sharing (effectively free), while ReLU requires oblivious transfer (expensive). In ZK-SNARKs, linear layers are *not* free: multiply-accumulates dominate the assigned cells at the widths we test (Section 5), so an architecture chosen to minimize the ReLU count need not be cheap to prove. We do not evaluate CryptoNAS itself.
[under "3. Cost Model and Proxy Analysis"]
# 3. Cost Model and Proxy Analysis
[under "3. Cost Model and Proxy Analysis"]
This section states what we can and cannot establish about ezkl circuit size. The claims are deliberately modest: AssumptionAssumption 1 is a structural statement and a parametric form; its quantitative content is tested empirically in Section 5 andSection 6, not proved.
[under "3.1 A Parametric Cost Model"]
## 3.1 A Parametric Cost Model
[under "3.1 A Parametric Cost Model"]
ezkl compiles an ONNX graph $G$ into a PLONKish circuit. Fix the quantization scale $s$ and the lookup range $R$ (both are chosen by ezkl’s calibration pass). Each node $v$ has an operator type $o(v)$, input and output tensor shapes, and attributes (kernel size, stride, padding, groups).
[under "3.1 A Parametric Cost Model"]
**Assumption 1** (Structure of the cost model). *For fixed $(s,R)$ the circuit layout (columns, selectors, lookup and permutation structure) is a function of the graph structure $(o(v),\text{shapes},\text{attributes})_{v\in G}$ only and does not depend on the weight values, which enter only as cell assignments. Define $C(G;s,R)$ as the total number of assigned cells (ezkl’s `total_assignments`). We use the parametric form
$$
C(G) \;=\; \sum_{v\in\mathcal{M}} \beta_{o(v)}\,\mathrm{MAC}(v)
\;+\; \gamma\,|\mathcal{M}|
\;+\; \sum_{v\notin\mathcal{M}} \alpha_{o(v)}\,\mathrm{el}(v)
\;+\; \varepsilon ,
$$
where $\mathcal{M}$ is the set of Gemm, MatMul and Conv nodes, with $\mathrm{MAC}=n_{\mathrm{in}}n_{\mathrm{out}}$ for a Gemm node and $\mathrm{MAC}=h'w'\,c_{\mathrm{out}}\,(c_{\mathrm{in}}/g)\,k_hk_w$ for a Conv node with output spatial size $h'\times w'$ and $g$ groups; $\mathrm{el}(v)$ is the number of output elements; $\beta_o,\gamma,\alpha_o\ge 0$ are coefficients; and $\varepsilon$ is an unmodelled residual.*
…and 97 more blocks not shown.[under "The problem."]
ZK-ML systems (ezkl, Orion, RISC Zero) let anyone prove neural network inference was correct — without revealing inputs. This enables private biometric verification (e.g., Worldcoin), on-chain AI oracles, and compliant ML auditing. But proving is slow: in our measurements, real proving time ranges from under a minute ($47$–$58$s) to over twenty minutes ($1340$s) depending on architectural choices that practitioners cannot currently predict.
[under "What we show empirically."]
Real proving time in our measurements ranges from under a minute to over twenty minutes depending on the architecture (Table 8). A width-matched comparison (Table 3) shows that this spread does not come from the ReLU-versus-$x^2$ choice: at identical widths the two have the same calibrated $\mathrm{logrows}$ and $x^2$ has at most $6\%$ more assigned cells. The spread in our sweep comes from layer type and width, and from ezkl’s range calibration, which raises $\mathrm{logrows}$ for $x^3{+}x$ networks. We therefore report a negative result for the assumption that polynomial activations are cheaper to prove in ezkl. Choosing DWS+ReLU over a standard CNN reduces single-run mock-proof time from $1119$s to $534$s at a cost of $6.6$ accuracy points ($75.0\%$ vs. $81.6\%$). The most accurate ReLU architecture we evaluated needs $\mathrm{logrows}{=}25$ ($2^{25}$ rows), and we recorded no mock-proof result for it.
…and 96 more blocks not shown.