Verifiable On-Chain AI: Proving an LLM Inference or Market Resolution Without a Trusted Oracle

Q: Is this better than a Chainlink-style AI oracle?

It's different, and better on one specific axis: arbiter trust. A Chainlink AI oracle is a mature, heavily-secured node network — reportedly securing on the order of $61B in value as of 2026 — and it's the right choice when you're comfortable trusting that economically-secured node set. The zkTLS + commit-reveal approach adds cryptographic provenance (proof the data came from your chosen source) on top of agreement (proof independent operators concurred), which minimizes what you have to trust per resolution. For AI-drafted, adversarial, medium-latency markets like Mentat's, that stronger per-resolution guarantee is worth the younger tooling; for other workloads a battle-tested oracle network may be the pragmatic pick.

You can prove an AI produced a specific output — or that a real-world event actually happened — without asking anyone to trust the party that ran the model or read the data. The three primitives that make this work are zkTLS attestation (which cryptographically binds a TLS response to the server that sent it), commit-reveal with optional Schnorr zero-knowledge proofs (which stops a network of operators from copying each other’s answers), and decentralized replicated inference (many independent nodes run the same model and the outliers get slashed). Cryptuon’s SolanaLM, Mentat, and DFPN combine these into a settlement pattern where the on-chain contract accepts a verdict only when the cryptography — not a company’s reputation — vouches for it.

TL;DR

The problem: On-chain systems that consume AI outputs (prediction market resolution, agent decisions, content moderation) usually depend on a trusted arbiter — a company API, a multisig, or a single oracle node. That arbiter is the single point of failure and the single point of capture.
zkTLS produces a cryptographic attestation that a specific HTTPS response came from a specific domain, so a smart contract can verify “ESPN’s API said Team A won 3-1” without trusting the relayer who fetched it. Mentat (mentat.cryptuon.com) uses this to resolve prediction markets with no trusted arbiter.
Commit-reveal (commit-reveal.cryptuon.com) is a pure-Python primitive that forces every operator to commit to a hash of their answer before anyone reveals, defeating collusion and free-riding. With Schnorr ZK proofs on secp256k1 you can even prove properties of the committed value without revealing it.
SolanaLM (solanalm.cryptuon.com) is a hybrid decentralized AI network: many operators serve OpenAI-compatible LLM inference and contribute GPU cycles, earning SOL, with settlement and node incentives on Solana. Replicated inference plus commit-reveal gives you a “run the model N times, slash the outliers” trust model.
The tradeoff: You do not yet get a succinct proof that a specific set of model weights produced a token. zkTLS proves provenance of a network response; replication proves agreement, not correctness in an absolute sense. Understand what each primitive actually attests.
Business impact: Verifiability is what unlocks high-stakes, automatable decisions. A wrong oracle on a $10M market is a $10M loss plus reputational collapse; cryptographic resolution turns “trust us” into “check the proof.”
Explore how these fit together on /solutions, see the autonomous-agent side on /agents, and talk to us via /contact.

Why “trust the oracle” is the weakest link in on-chain AI

Every blockchain application that reacts to the outside world has an oracle problem, and every application that reacts to an AI decision has the same problem twice over. The contract is deterministic and auditable. The thing feeding it — a price, a match result, a “is this deepfake” verdict, an LLM’s answer — is not. If a single API, a single node, or a single multisig decides what the contract sees, then that party can lie, be coerced, be hacked, or simply be wrong, and the contract will faithfully execute on the falsehood.

This matters more for AI than for prices. A price feed can be cross-checked against dozens of exchanges; disagreement is loud and cheap to detect. An LLM inference is non-deterministic across hardware, temperature, and quantization, so “did the model actually say this?” has historically been unanswerable on-chain. The naive fix — “call OpenAI from an off-chain worker and post the result” — reintroduces exactly the trusted arbiter you were trying to remove. Now the worker, the API key holder, and OpenAI itself all sit inside your trust boundary.

The interesting engineering question is: what can we actually prove, cryptographically, about an output that originated off-chain? There are three distinct claims, and conflating them is the most common mistake in this space:

Provenance — “This data came from api.espn.com over an authenticated TLS session.” (zkTLS solves this.)
Agreement — “N independent operators, who could not see each other’s answers, produced the same result.” (Replicated inference + commit-reveal solves this.)
Correct execution — “These exact weights, run on this exact input, deterministically produce this exact output token.” (zkML aspires to this; it is not yet practical at LLM scale.)

Most production “verifiable AI” systems in 2026, including Cryptuon’s, prove (1) and (2) and are honest that (3) remains open. That honesty is the whole design. Let’s build each primitive.

zkTLS: binding a real-world fact to the server that stated it

zkTLS (also called TLS attestation, TLSNotary-style proving, or “web proofs”) lets a prover convince a verifier that a particular byte string was received over a genuine TLS connection to a named domain — without the verifier having to connect to that domain themselves, and without the prover being able to forge the transcript. The cryptographic trick is that TLS session keys are derived from a handshake; if you split knowledge of the session so the prover never holds the full server-authentication material alone, the prover cannot fabricate a transcript that verifies.

What zkTLS actually attests

The attestation is a signed (or SNARK-wrapped) statement of the form: “Over an authenticated TLS 1.3 session to api.espn.com, the following HTTP response body was received: {...}.” A smart contract that trusts the attestation scheme’s verification key can then parse that body and act on it. Crucially, the content of the API is still whatever the API says — zkTLS proves the server said it, not that the server is honest. You choose sources you’re willing to treat as authoritative (a sports data provider, an exchange, a government feed), and zkTLS removes every intermediary between that source and the chain.

Here is the shape of a zkTLS resolution flow as Mentat runs it — an AI-native prediction market on Solana where markets are drafted by AI agents, curated by humans, and resolved by zkTLS proofs with no trusted arbiter:

# mentat/resolver/zktls_resolve.py
# Resolve a market by proving what an authoritative HTTPS endpoint returned.

import json
from mentat.zktls import TLSProver, verify_attestation
from mentat.solana import ResolutionTx

async def resolve_market(market_id: str, source_url: str, jsonpath: str, expected):
    # 1. The prover performs a real TLS session to the source and records a
    #    transcript it cannot later alter. The notary co-signs the session
    #    without ever seeing the plaintext request/response.
    prover = TLSProver(notary="https://notary.mentat.cryptuon.com")
    session = await prover.fetch(source_url, redact=["authorization", "cookie"])

    # 2. Produce a portable attestation over the response body.
    attestation = session.attest(
        reveal_paths=[jsonpath],      # selectively disclose only the outcome field
        domain_binding=True,          # bind proof to api host + cert chain
    )

    # 3. Anyone can verify the attestation offline before it touches the chain.
    body = verify_attestation(attestation)          # raises if forged/altered
    observed = json_extract(body, jsonpath)          # e.g. "$.competitions[0].status.winner"

    outcome = "YES" if observed == expected else "NO"

    # 4. Settle on Solana. The program re-checks the attestation's verifier
    #    key and the domain binding on-chain before releasing escrow.
    return await ResolutionTx.submit(
        market_id=market_id,
        outcome=outcome,
        attestation=attestation,     # posted as calldata / account data
    )

The key line for a skeptical engineer is verify_attestation(attestation) — it is a pure function of the proof. It does not call the network, does not trust the prover, and fails closed if a single byte of the disclosed body was tampered with. The relayer that fetched the data has no discretion; it either produces a valid attestation of the real response or it produces nothing.

Why “no trusted arbiter” is a real claim, not marketing

In an optimistic-oracle design (UMA-style), a proposer asserts an outcome and a dispute window opens; if nobody bonds against it, it’s accepted. That works, but it has a liveness-of-honest-disputers assumption and a multi-hour latency, and the final backstop is a token-holder vote — a trusted-arbiter-of-last-resort. In a zkTLS design, there is nothing to dispute: the proof either verifies against the named domain’s certificate chain or it doesn’t. The human curators in Mentat choose which source is authoritative and what question to ask, but they cannot forge the answer. That is a categorically stronger property for the resolution step itself.

Commit-reveal: stopping operators from copying each other

zkTLS handles “did this server say this.” It does nothing for “did N independent operators genuinely each run a model.” When you replicate inference across a network — which is the whole point of a decentralized inference network like SolanaLM — you face two adversarial behaviors: collusion (operators agree in advance to report a chosen answer) and free-riding / copying (a lazy operator waits to see what others submit and echoes the majority to earn rewards without doing work). Both collapse the security of replication, because “10 operators agreed” is worthless if 9 of them copied the 1st.

The fix is commit-reveal. Every operator must commit to a cryptographic hash of their answer (salted with a secret nonce) before anyone reveals. Once all commitments are locked, operators reveal their answer and nonce; the coordinator checks each reveal against its commitment. Because nobody could see anyone else’s answer at commit time, copying is impossible and collusion requires out-of-band coordination that slashing can be tuned to punish.

Cryptuon’s commit-reveal library is a pure-Python, zero-dependency implementation of exactly this, with optional Schnorr zero-knowledge proofs on secp256k1:

# Using cryptuon/commit-reveal to run a collusion-resistant inference round.
from commit_reveal import Commitment, Scheme
import secrets, hashlib

def commit_answer(answer: str) -> tuple[Commitment, bytes]:
    """Operator side: hide the answer behind a salted hash."""
    nonce = secrets.token_bytes(32)
    # H(answer || nonce) — binding (can't change answer) and hiding (can't peek).
    c = Commitment.create(value=answer.encode(), nonce=nonce)
    return c, nonce

def verify_reveal(c: Commitment, answer: str, nonce: bytes) -> bool:
    """Coordinator side: enforce the operator revealed what they committed."""
    return c.verify(value=answer.encode(), nonce=nonce)

# --- One inference round across N operators ---
scheme = Scheme(curve="secp256k1")           # enables optional Schnorr ZK proofs
commitments = {}                              # operator_id -> Commitment (phase 1)
reveals = {}                                  # operator_id -> (answer, nonce)  (phase 2)

# Phase 1: everyone posts H(answer||nonce). No answer is visible yet.
# Phase 2 opens only after all commitments are on-chain.
def tally(commitments, reveals, slash):
    valid = {op: a for op, (a, n) in reveals.items()
             if verify_reveal(commitments[op], a, n)}
    # Operators who committed but never revealed a matching value are slashed.
    for op in commitments.keys() - valid.keys():
        slash(op, reason="no-show-or-mismatch")
    # Majority answer wins; statistical outliers are slashed for divergence.
    winner = max(set(valid.values()), key=list(valid.values()).count)
    for op, ans in valid.items():
        if ans != winner:
            slash(op, reason="outlier")
    return winner

The optional Schnorr layer matters when the answer itself is sensitive. On secp256k1 you can prove knowledge of the committed value — or a predicate over it, like “my committed classification is one of {SAFE, UNSAFE}” — without revealing which, until the reveal phase. That prevents an operator from committing to garbage now and inventing a plausible answer later. This is the same primitive that powers DFPN, Cryptuon’s decentralized deepfake-detection network: independent operators each run a detection model, commit-reveal stops them from colluding or copying, and the aggregated verdict is anchored on Solana with the outliers slashed. It is the canonical “many operators run the same model, slash the divergent ones” pattern, and it generalizes to any classifier or LLM judge.

Decentralized inference: SolanaLM’s replicated-compute network

SolanaLM is a hybrid decentralized AI network combining LLM inference and federated learning, with settlement and node incentives on Solana. Operators earn SOL by serving inference and contributing GPU cycles. Critically for developers, it is OpenAI-compatible — you point your existing client at a SolanaLM endpoint and the request fans out to the operator network instead of a single centralized data center. It’s built in Python and Solana, MIT-licensed, with source on GitHub.

SolanaLM resources: solanalm.cryptuon.com · Documentation · Source on GitHub

Because the API surface is OpenAI-compatible, adopting verifiable inference costs you almost nothing at the call site:

# Drop-in OpenAI-compatible call to the SolanaLM decentralized endpoint.
from openai import OpenAI

client = OpenAI(
    base_url="https://api.solanalm.cryptuon.com/v1",
    api_key="sk-solanalm-...",          # settles against your Solana account
)

resp = client.chat.completions.create(
    model="solanalm/llama-3.1-70b-instruct",
    messages=[
        {"role": "system", "content": "You are a market-resolution judge. "
         "Answer strictly YES or NO."},
        {"role": "user", "content": "Given this attested article, did the "
         "central bank cut rates at the July meeting?\n\n" + attested_article},
    ],
    temperature=0,                       # determinism aids cross-operator agreement
    extra_body={
        "replication": 5,                # run on 5 independent operators
        "aggregation": "commit-reveal",  # collusion-resistant tally
        "min_agreement": 0.8,            # require 4/5 to concur, else no-result
    },
)

print(resp.choices[0].message.content)   # e.g. "YES"
print(resp.model_dump()["x_solanalm_proof"])  # attestation + per-operator commits

The replication, aggregation, and min_agreement fields are the entire verifiability story expressed as request parameters. Setting temperature=0 maximizes the chance that honest operators running the same weights converge on identical tokens, which makes divergence a strong signal of either a faulty operator or a genuinely ambiguous input — in which case returning “no-result” is the correct, safe behavior for a high-stakes automation rather than guessing.

Anchoring the verdict on-chain

Once you have an aggregated, attested result, you settle it. The on-chain program’s job is narrow and auditable: re-verify the proof material, check the agreement threshold, and move funds. Here is the shape of that settlement step (Anchor / Rust):

// programs/mentat/src/resolve.rs — settle a market from a verified result.
pub fn resolve(ctx: Context<Resolve>, args: ResolveArgs) -> Result<()> {
    let market = &mut ctx.accounts.market;
    require!(!market.resolved, MentatError::AlreadyResolved);

    // 1. Verify the zkTLS attestation against the pinned notary/verifier key
    //    and the market's declared source domain. Fails closed.
    require!(
        verify_zktls(&args.attestation, &market.source_domain, &VERIFIER_KEY),
        MentatError::InvalidAttestation
    );

    // 2. Verify replicated-inference agreement: enough distinct, staked
    //    operators revealed matching commitments.
    require!(
        args.agreement_bps >= market.min_agreement_bps,
        MentatError::InsufficientAgreement
    );

    // 3. Record outcome and release escrow to the winning side.
    market.outcome = args.outcome;
    market.resolved = true;
    market.resolution_slot = Clock::get()?.slot;

    // 4. Slash operators whose reveals diverged from consensus.
    for op in args.outliers.iter() {
        slash_operator(ctx, op, market.slash_bps)?;
    }
    emit!(MarketResolved { market: market.key(), outcome: args.outcome });
    Ok(())
}

Notice what the contract does not do: it does not call an LLM (it can’t — smart contracts have no network access and a per-transaction compute budget measured in microseconds, nowhere near a 70B-parameter forward pass). It verifies proofs about off-chain compute. That division of labor — heavy inference off-chain, cheap verification on-chain — is the only architecture that scales, and it’s the same principle behind rollups and zkML.

Comparison: four ways to get a trustworthy AI output on-chain

Approach	Trust model	What’s actually proven	Latency / cost	Failure mode	Maturity
Centralized inference API (call OpenAI, post result)	Trust the API vendor + your relayer + the key holder	Nothing on-chain; the contract trusts a posted string	Lowest latency, low cost	Vendor lies/errs, relayer censors or forges, key leaks	Production, but zero on-chain trust
Chainlink-style AI oracle	Trust a decentralized node network + its slashing/reputation	Multiple nodes ran a model and a threshold agreed (agreement, not provenance)	Seconds; per-call node fees	Correlated node failure; shared upstream data source	Production for high-stakes, low-volume. Chainlink reportedly secures ~$61B in value (as reported, 2026) and is pushing multi-node AI oracles that slash outliers
Optimistic oracle (UMA-style)	Trust that ≥1 honest disputer is watching + token-vote backstop	Nobody profitably disputed the asserted outcome within the window	Minutes–hours (dispute window)	No honest disputer online; governance capture of the final vote	Mature for slow, high-value settlement
zkTLS-attested + commit-reveal replication (SolanaLM + Mentat)	Trust the cryptography + your chosen authoritative source	Provenance: a named domain sent this response; Agreement: N independent operators concurred, none copied	Sub-minute; proving + N-way replication overhead	Chosen source is itself wrong; weights not proven (see Limitations)	Emerging; strongest per-resolution guarantee, youngest tooling

The honest reading of this table: there is no universally dominant row. An optimistic oracle is excellent for a weekly, nine-figure settlement where an hours-long dispute window is acceptable and human judgment is a feature. A Chainlink AI oracle is battle-tested and appropriate when you’re comfortable trusting a large, economically-secured node set. The zkTLS + commit-reveal approach gives the strongest cryptographic per-resolution guarantee and the lowest arbiter-trust, which is why it’s the right choice for automated, adversarial, medium-latency decisions like AI-drafted prediction markets — but its tooling is the newest and it inherits the honesty of whatever source you point it at.

Business outcome: verifiability is what makes high-stakes automation insurable

The reason to care about any of this is not ideological decentralization — it’s that verifiability is the precondition for automating decisions that carry real money. Consider the cost function of a wrong oracle. A prediction market resolves incorrectly on a $10M pool: you don’t just lose the $10M, you lose every future user who now assumes your resolution can be gamed, and you may inherit legal exposure for distributing funds against a false outcome. In DeFi, a manipulated price oracle has repeatedly caused eight- and nine-figure losses in a single block. The expected cost of an oracle failure is not the transaction value — it’s the transaction value multiplied by the blast radius of lost trust.

Cryptographic resolution changes the risk math in three ways:

It caps the trust surface. With a centralized arbiter, your worst case is “the arbiter is fully malicious” — unbounded. With zkTLS + replication, an adversary must either compromise your chosen authoritative source (a well-defined, auditable target) or corrupt a slashing-secured supermajority of operators (economically bounded). You can price those risks; you cannot price “our API vendor might one day lie.”
It removes humans from the hot path without removing accountability. Mentat’s humans curate which questions and sources are legitimate — a slow, low-frequency, high-judgment task — while the resolution itself is automated and proof-gated. That’s the correct division: humans do judgment, cryptography does execution. This is exactly the pattern autonomous agents need, which is why it composes with agent-driven settlement (see /agents and our write-up on agentic payments and x402 on-chain settlement).
It compounds with other on-chain primitives. A verifiable AI verdict is only valuable if the asset it moves is also trustworthy. When you’re settling tokenized real-world value, the same “prove it, don’t trust it” discipline applies end to end — see tokenizing real-world assets with compliance and settlement. Composability of proofs is what lets you build automation that a risk committee will actually sign off on.

For an operator, the incentive alignment is direct: SolanaLM pays SOL for serving inference and contributing GPU cycles, and commit-reveal plus slashing means honest work is the profit-maximizing strategy — copying and colluding lose stake. The network’s security budget scales with the value it secures, which is the property you want. Explore how these pieces assemble into deployable systems on /solutions, and dig into the underlying primitives on /research.

Limitations

Being precise about what these techniques do not prove is what separates engineering from marketing.

Current limitations (real today):

The weights are not proven. Replicated inference proves agreement among operators, not that a specific, audited set of weights produced the token. A colluding supermajority running a different model in lockstep would agree with each other. Commit-reveal raises the cost of collusion; it does not make it cryptographically impossible. Economic security (stake + slashing) is the real backstop here, not a SNARK.
zkTLS proves provenance, not truth. If your authoritative source publishes a wrong number, the attestation faithfully proves the source published a wrong number. Source selection is a human trust decision you cannot cryptography your way out of.
Cost and latency of proving. Generating a zkTLS attestation and running N-way replicated inference is more expensive and slower than a single centralized call. For temperature > 0 or genuinely creative generation, honest operators legitimately diverge, so replication-by-agreement works best for classification and judgment tasks (YES/NO, safe/unsafe, winner selection), not open-ended text generation.
Selective disclosure is fiddly. Revealing only the outcome field of a TLS response (and redacting auth headers) requires care; a misconfigured reveal_paths can leak secrets or, worse, reveal a field the source can manipulate independently of the outcome.

Roadmap items (aspirational, honest about status):

True zkML for inference. Succinct proofs that these exact weights on this exact input yield this output are an active research frontier. At LLM scale (billions of parameters) they remain impractical in 2026 — proving overhead is orders of magnitude beyond real-time. When the cost curve bends, replication-by-agreement can be upgraded to proof-by-construction.
Federated-learning verifiability. SolanaLM’s federated-learning side wants proofs that a contributed gradient came from real, non-poisoned local data. This is an open problem; today it leans on statistical outlier detection and staking, the same commit-reveal-plus-slashing pattern, rather than cryptographic guarantees.
Cross-source corroboration. Requiring zkTLS attestations from multiple independent authoritative sources before resolution would reduce single-source risk. It’s a natural extension of the resolver but multiplies latency and cost, so it’s opt-in per market.

If your use case cannot tolerate the “weights not proven” gap, you should treat these systems as economically-secured, not cryptographically-secured, and size your stake and slashing parameters accordingly.

Frequently Asked Questions

How do you verify an AI model ran correctly on-chain?

You don’t verify a single run cryptographically today at LLM scale — that would require practical zkML, which doesn’t yet exist for large models. Instead you get agreement: run the same inference on N independent, staked operators using commit-reveal so none can copy the others, then require a supermajority to concur before the on-chain contract accepts the result and slashes the outliers. The contract verifies proofs about the off-chain compute (attestations and matching commitments), never runs the model itself. It’s economic + replication security, and honest systems say so plainly.

What is zkTLS?

zkTLS (TLS attestation, sometimes called “web proofs”) is a technique that produces a portable, cryptographic proof that a specific byte string was received over a genuine authenticated TLS session to a named domain. A verifier — including a smart contract — can check the proof offline and be certain the data really came from, say, api.espn.com, without connecting to it and without the prover being able to forge the transcript. It proves provenance (who sent the bytes), not truth (whether those bytes are correct). Mentat uses it to resolve prediction markets with no trusted arbiter.

Can smart contracts run LLM inference?

No. Smart contracts have no network access and a per-transaction compute budget measured in microseconds — nowhere near the billions of floating-point operations a single LLM forward pass requires. The correct architecture is heavy inference off-chain (on a decentralized network like SolanaLM) and cheap verification on-chain: the contract checks attestations, agreement thresholds, and commitments, then settles. This mirrors how rollups and zkML move computation off-chain while keeping verification on-chain.

How does commit-reveal stop operators from cheating?

Every operator must publish a salted hash of their answer — H(answer || nonce) — before anyone reveals a plaintext answer. Because no one can see others’ answers at commit time, copying the majority is impossible, and the commitment is binding so an operator can’t change their answer after the fact. In the reveal phase, each operator discloses their answer and nonce; the coordinator checks it against the commitment and slashes no-shows and mismatches. Cryptuon’s commit-reveal library adds optional Schnorr zero-knowledge proofs on secp256k1 so an operator can even prove a property of the hidden value before revealing it.

Is this better than a Chainlink-style AI oracle?

It’s different, and better on one specific axis: arbiter trust. A Chainlink AI oracle is a mature, heavily-secured node network — reportedly securing on the order of $61B in value as of 2026 — and it’s the right choice when you’re comfortable trusting that economically-secured node set. The zkTLS + commit-reveal approach adds cryptographic provenance (proof the data came from your chosen source) on top of agreement (proof independent operators concurred), which minimizes what you have to trust per resolution. For AI-drafted, adversarial, medium-latency markets like Mentat’s, that stronger per-resolution guarantee is worth the younger tooling; for other workloads a battle-tested oracle network may be the pragmatic pick.

What’s the difference between an optimistic oracle and zkTLS resolution?

An optimistic oracle accepts an asserted outcome unless someone disputes it within a window (hours), with a token-holder vote as the final backstop — so it assumes an honest disputer is watching and trusts governance as arbiter of last resort. zkTLS resolution has nothing to dispute: the proof either verifies against the source domain’s certificate chain or it doesn’t, in sub-minute time, with no arbiter and no dispute window. The trade is latency and human-judgment flexibility (optimistic oracles handle fuzzy, subjective outcomes better) versus cryptographic finality and lower trust (zkTLS wins on objective, source-attestable facts).

Verifiable on-chain AI isn’t one technology — it’s a discipline of proving exactly what you can and refusing to hand-wave the rest. zkTLS proves provenance, commit-reveal proves independent agreement, and decentralized inference distributes the compute so no single operator is a point of capture. Together they let you automate high-stakes decisions that would otherwise demand a trusted human in the loop. See how Cryptuon assembles these into shippable systems on /solutions, explore the autonomous-agent angle on /agents, and get in touch if you’re building something where a wrong answer is expensive.