From faster data verification and verifiable AI to confidential payments and stronger recursive proofs, Offchain’s research lab, “Offchain Labs” is expanding what zero-knowledge technology can do while strengthening the foundations beneath it.
Cryptographic proofs known as SNARKs often referred to by the shorthand "ZK" or "Zero-Knowledge Proofs", have seen remarkable progress over the last decade. A SNARK is to compute what a digital signature is to identity: a signature certifies that a message comes from a specific sender; a SNARK certifies that a computer program was executed correctly without requiring re-execution.
What makes SNARKs powerful is that verifying one is far cheaper than re-running the program itself. SNARKs already power some Layer 2 rollups and will soon help secure Arbitrum as well. But the applications go well beyond that: private transactions, verifiable AI inference, provable FHE computations, and more.
However, the technology remains early. Proof generation remains computationally expensive, security models have theoretical gaps, and zero-knowledge systems often rely on assumptions that have never been formally verified.
Offchain Labs’ research team is actively solving these bottlenecks across four strategic pillars:
- Accelerating proof generation & verification
- Expanding ZK math beyond finite fields
- Closing foundational security gaps in recursive proving
- Extending ZK into new domains like AI, private execution, and WASM.
Here's where that work stands, why it matters, and how it works.
Making ZK Proofs Faster
Verifying data 4,000x faster
Blockchains and databases frequently need to prove that specific entries within massive datasets are authentic without requiring users to download the entire dataset. This is achieved via vector commitments, which act like cryptographic fingerprints: you store a tiny digest and later verify individual data entries with short proofs.
Previous approaches worked, but combining proofs for thousands of entries simultaneously created severe computational bottlenecks. Proving 64,000 entries from a ~130,000-entry dataset took roughly two minutes.
Offchain Labs redesigned how these proofs combine:
- Point-Addition Aggregation: Rather than performing expensive polynomial division for each entry, the new scheme aggregates proofs using simple point additions (one per entry).
- Linear Complexity: The computational cost grows linearly rather than exploding with dataset size.
- Drop-In Compatibility: It is fully compatible with the KZG polynomial commitment setup Ethereum already uses for blobs, requiring zero changes to existing network infrastructure.
The Result: The same 64,000-entry operation now takes ~32 milliseconds—a ~4,000x speedup. Verification time drops from over two minutes to under a second, complete with open-source distributed proving support.
- 📄 Read the Research Paper: Practical Subvector Commitments with Optimal Opening Complexity
Expanding ZK to Native Integer Math
Most ZK proof systems only work natively over specialized mathematical structures called finite fields. While finite fields cover standard smart contract logic, important cryptographic applications do not fit naturally:
- RSA signatures
- Fully Homomorphic Encryption (FHE)
- Big-integer computations and floating-point/decimal math
Translating integer math into finite fields requires "emulation," which introduces massive overhead, costing roughly 5,000x more computation for operations like RSA signatures.
Offchain Labs designed Zaratan, the first proof system that achieves full succinctness directly over regular integers.
Zaratan compresses large-number calculations into short, random checksums that can be verified cheaply. Before Zaratan, developers had to choose between massive emulation overhead or integer-native schemes where proof size and verification time grew alongside the numbers involved. Zaratan eliminates both trade-offs simultaneously.
- 📄 Read the Research Paper: Fully Succinct Arguments over the Integers from First Principles
Verifiable AI: Proving the AI Model Ran Correctly
When an AI model runs in the cloud on your behalf, how do you verify that the server executed the correct model on your input without altering outputs? Generating full zero-knowledge proofs for AI inference is possible, but takes minutes even for modest, billion-parameter models.
Offchain Labs developed a lightweight, sampling-based verification protocol designed for production environments:
- Execution Trace Commitment: The server locks in a complete, Merkle-tree-based commitment of every calculation performed during inference before knowing which parts will be inspected.
- Random Path Spot-Checking: The client randomly spot-checks a small subset of calculation paths from output to input.
- Refereed Protocol Option: For high-stakes applications, a secondary protocol uses two competing servers to identify and settle discrepancies quickly.
Performance: Verification drops from minutes to milliseconds. The approach has been tested on ResNet-18 image classifiers and Llama-2-7B, confirming common AI architectures have the statistical properties this protocol needs, and that natural adversarial strategies (such as logit swapping or trace reconstruction) fail to evade detection.
- 📄 Read the Research Paper: Towards Verifiable AI with Lightweight Cryptographic Proofs of Inference
ZK in Multi-Prover: How Arbitrum Is Integrating ZK
Arbitrum pioneered scaling Ethereum using optimistic rollups. Rather than replacing optimistic proofs entirely with ZK, Offchain Labs is integrating ZK into a multi-prover architecture alongside fraud proofs and Trusted Execution Environments (TEEs).
Why Multi-Prover Matters
Single-prover ZK rollups create a critical dependency: if a bug exists in the prover circuit or proof system, the entire chain is vulnerable. Combining redundant proving technologies delivers key advantages:
- Defense-in-Depth: Eliminates single points of failure across cryptographic and software assumptions.
- Faster L1 Withdrawals: Substantially shortens settlement windows back to Ethereum Mainnet.
- Reduced Validator Bonds: Lower bond requirements for validators.
- Mitigated Griefing: Disputes are settled in one step with a proof, removing the griefing vectors that multi-round challenge games have.
- Optional Privacy: For chains that need enterprise-level confidentiality with full auditability.
Arbitrum chains will be able to tap into this technology, and integration into Arbitrum One will be put forward for the Arbitrum DAO to discuss.
- 📖 Read the Blog Post: Scaling Ethereum with ZK and the Road Ahead for Arbitrum
ZK for Confidential Enterprise Chains
Public blockchains expose every transaction, a non-starter for regulated institutions. Private ledgers solve confidentiality but leave correctness resting on operator trust and after-the-fact audits.
Offchain is building dedicated Arbitrum chains where compliance is enforced by the infrastructure itself: permissioned participation, role-based access down to contract methods, restricted-address screening, eligibility rules. ZK makes that enforcement verifiable:
- Provable compliance: Every state assertion posted to the parent chain carries a validity proof that the chain's state transition function ran correctly, protocol-level compliance rules included. A violating transaction cannot appear in a validly proven state.
- Confidential data: The validity proof establishes correctness on its own, so the chain never needs to publish transaction data. It stays confidential to the operator and authorized parties such as auditors.
- Settlement proofs: Participants receive cryptographic proofs that their transactions settled correctly, with no delayed reconciliation and no counterparty visibility.
The result: confidential to peers and the public, transparent to oversight, provably correct to everyone.
- Stay tuned for more details.
Why WASM Beats RISC-V for Ethereum
Most zkVMs today prove execution of the RISC-V instruction set. But the field is extremely young, the first production-grade zkVM only shipped in 2022, and it's far from settled that RISC-V is the long-term winner.
Offchain Labs has proposed that Ethereum L1 adopts WASM as the delivery Instruction Set Architecture (ISA) while decoupling it from the underlying proving system:
- Decoupled Architecture: The format used to deploy smart contracts (WASM) does not need to match the format used to generate ZK proofs (e.g., RISC-V).
- Future-Proofing: Proving systems can be upgraded or replaced over time without requiring developers to rewrite or redeploy existing contracts.
- Performance: Early work by Powdr Labs on ZK proving WASM demonstrates a ~1.5x proving speedup and a 5–6x reduction in memory consumption compared to RISC-V.
Arbitrum already works this way: Its ZK proving (via Succinct's SP1 Hypercube) compiles WASM to RISC-V under the hood, proving both the core Arbitrum logic and user-written Arbitrum Stylus smart contracts in Rust, C/C++, Move, and AssemblyScript.
📄 Read the Research Post: Why RISC-V Is Not a Good Choice for an L1 Delivery ISA, and Why WASM Is a Better One
Closing Security Gaps in Recursive ZK
Recursive ZK proofs, where one proof verifies another, which verifies another, and so on, are the backbone of rollups and other large-scale ZK systems. They let you compress arbitrarily long computations into a single short ZK proof. But the security foundations have had gaps.
Are recursive proofs actually secure?
When you stack proofs recursively (as rollups do), the standard security analysis breaks down. The math that proves individual proof systems are secure doesn't compose cleanly when proofs are nested inside each other. In practice, the field has assumed this works. That assumption had never been formally justified for unlimited recursion depth.
Offchain Labs introduced a general methodology that makes the security analysis work no matter how deep the recursion goes. The key technique modifies the proving step so each layer records the previous layer's proof in a traceable way, creating a chain the security analysis can follow to any depth. This covers widely used proof systems like Groth16, Marlin, and PLONK+KZG, which were not addressed by prior work. Beyond recursive proving, the same technique also extends to proof aggregation and aggregate signature schemes.
- 📄 Read Paper: On Composing AGM-Secure Functionalities with Cryptographic Proofs: Applications to Unbounded-Depth IVC and More
Can recursive proofs be tampered with?
There's a second kind of attack beyond forging a false proof: taking a valid proof and tweaking it into a different valid proof without knowing the data behind it. This is called malleability. It's not theoretical. Over 300,000 BTC have been involved in malleability attacks on Bitcoin, and malleability vulnerabilities have been found in Nova, a recursive proof system used in production.
Tamper-resistance was well-understood for single-layer proofs, but nobody had formally studied it for recursive systems. Offchain Labs defined the right security property for recursive proofs and showed that many common systems already satisfy it by design, they just didn't have the formal proof until now. The research achieves this by treating a recursive proof as carrying an entire proof history, and then proving that any valid new proof can be “unwound” layer by layer to recover the underlying witness. This shows an attacker cannot simply reshape an existing recursive proof into another valid one without actually knowing the secret data
- 📄 Read Paper: On the Simulation-Extractability of Proof-Carrying Data
Research That Moves Infrastructure Forward
Zero-knowledge proofs are becoming core infrastructure not only for blockchain scaling, but for privacy, verifiable computation, AI, payments, and systems that must demonstrate they operate correctly.
Reaching that future requires more than applying today’s proof systems to new use cases. It means improving their performance, expanding the computations they can support, and strengthening the security foundations beneath them.
That is where the Offchain research team is focused: advancing the theory, building practical implementations, and creating a clearer path from cryptographic research to production infrastructure.
Frequently Asked Questions
What is a zero-knowledge proof?
A zero-knowledge proof is a cryptographic method that allows one party to demonstrate that a statement is valid without revealing all the information used to prove it. Zero-knowledge proofs can support blockchain scaling, privacy, identity, and verifiable computation.
What is a SNARK?
A SNARK is a short cryptographic proof that can demonstrate a computation or statement is valid. Verifying a SNARK is often substantially faster and less expensive than repeating the original computation. Some SNARK systems also provide zero-knowledge properties, but the two terms are not interchangeable.
How is Offchain advancing zero-knowledge technology?
Offchain Research team “Offchain Labs” is working to make cryptographic proofs faster, support more kinds of computation, strengthen the security of recursive proving, and apply verification technology to areas including AI, confidential payments, Arbitrum, and WASM.
How can cryptographic proofs make AI more verifiable?
Cryptographic protocols can provide evidence that a server ran the agreed AI model on the intended input. Offchain researchers have developed a lightweight approach that uses committed computation records and randomized checks to reduce aspects of AI-inference verification from minutes to milliseconds.
How could Arbitrum use ZK proofs?
Arbitrum is exploring a multi-prover architecture that combines ZK proofs with fraud proofs and trusted execution environments. This is intended to reduce reliance on any single proving system while allowing chains to select different security and performance configurations.
Why are recursive ZK proofs important?
Recursive proofs allow one proof to verify another. This enables long or complex computations to be compressed into a single short proof, making recursion important for rollups and other systems that aggregate large amounts of computation.
About Offchain
Offchain is the core development team behind the Arbitrum Platform, the leading Ethereum Layer 2 ecosystem securing over $18 Billion in total value with over 2.5 billion transactions executed on mainnet. Offchain also develops the Prysm consensus client (securing ~25% of Ethereum mainnet) and ZeroDev (powering 10M+ smart accounts across 130+ chains, and over $1B in monthly volume).
Within Offchain, “Offchain Labs” is the research lab led by Offchain’s Chief Scientist and co-founder Ed Felten (former White House Deputy CTO under President Barack Obama), the Offchain Labs research team continues to pioneer foundational advancements in cryptographic proof systems, L2 scaling, and decentralized security.
