Paper 2026/199

zkAgent: Verifiable LLM Agent Execution via One-Shot Transcript Proofs

Hancheng Lou, Shanghai Jiao Tong University

Chongrong Li, Shanghai Jiao Tong University

Yu Yu, Shanghai Jiao Tong University

Yuncong Hu, Shanghai Jiao Tong University

Abstract

LLM-based agents, which interleave large language model inference with external tool calls, are increasingly deployed in high-stakes settings. In real-world deployments, each model inference and provider-hosted tool execute behind the provider's API. Even when the agent loop runs on the user's device, these provider-executed steps still remain opaque to the user. This opacity creates an end-to-end integrity gap: a malicious provider may substitute the advertised model or fabricate tool observations to steer subsequent agent behavior. Existing zero-knowledge proof systems for LLMs prove only the Transformer computation of a single inference, leaving the rest of the inference pipeline, long-form autoregressive generation, and external tool interactions outside the proof. We present zkAgent, the first SNARK system for verifiable agent execution. zkAgent proves the complete inference pipeline, from token-to-embedding lookup and positional encoding to Transformer computation and decoding. It further binds each tool observation to an authenticated execution via zkTLS or zkVM subproofs, yielding a single end-to-end proof. To scale beyond per-token proving, we introduce one-shot transcript proving: by exploiting the Transformer's causal attention mask, zkAgent proves an entire multi-step agent transcript in a single forward pass, avoiding the substantial overhead incurred by one-proof-per-token generation. We make this batched proof sound with a weight-dependent quantization scheme that is both input-independent and unconditionally complete. On GPT-2 with a 512-token transcript, zkAgent achieves a $767\times$ prover speedup over the state of the art (zkGPT, USENIX Security~'25), amortizing to $0.40$s/token, and reduces verification time by $10{,}384\times$ ($0.42$s vs. $4{,}361.09$s). On a real-world coding-assistant execution, zkAgent completes end-to-end proving in $99.74$s with $0.28$s verification, making verifiable agent execution practical.

@misc{cryptoeprint:2026/199,
      author = {Lizheng Wang and Hancheng Lou and Chongrong Li and Yu Yu and Yuncong Hu},
      title = {{zkAgent}: Verifiable {LLM} Agent Execution via One-Shot Transcript Proofs},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/199},
      year = {2026},
      url = {https://eprint.iacr.org/2026/199}
}