Building ZK-Powered AI Guardrails with Wyatt Benno

Wyatt Benno is the technical founder of ICME Labs, which originated from a grant approved by Jens Graf while Graf was at Aztec. Benno entered the ZK space through the ZK Hack Discord and the Justin Thaler study group, which ran for approximately three years working through the book chapter by chapter three times. He claims to have been the first person to implement SuperNova folding, described as the first non-interactive incrementally verifiable computation folding scheme. ICME Labs differentiated itself early by focusing on local client-side proving, memory efficiency, and privacy rather than ZK for blockchain scaling, and Srinath Setty has held monthly sessions with the team for over two years.

ICME Labs has built three products: Novanet, a decentralized proof network using Shapley value-based economic incentives for provers to collaborate rather than race; ICME Preflight, described as ZK-powered guardrails for AI agents; and Jolt Atlas, a production-ready zero knowledge machine learning framework. The company paused token plans over a year ago to focus on ICME Preflight as its core product. Jolt Atlas uses ONNX as its base format rather than RISC-V because converting AI workloads to RISC-V introduces excessive overhead. Over 80 percent of AI inference computation is matrix multiplication, and Jolt Atlas uses a direct matrix multiplication approach drawn from the Thaler 2013 paper, which avoids the constant factor overhead present in GKR-based systems used by competitors like Modulus.

Benno identifies two core advantages ZK offers for AI guardrails: succinct verification allowing large computations to be checked in under a second, and privacy preservation of policies and data. Current guardrail approaches including heuristics, LLM judges, and human-in-the-loop methods achieve at best around 80 percent accuracy and require stopping transactions, making them unable to operate at machine speed. ICME Preflight converts natural language guardrail policies into formal logic using a small model, producing SMT files via automated reasoning, then wraps those proofs in ZK so they can be folded together and verified in under one second without human intervention. A paper on automated reasoning showed SMT conversion from natural language to formal logic is 88 percent effective as a baseline and can reach 99 to 100 percent, compared to Lean-based conversion which was shown to be only about 30 percent accurate. A ZK proof is generated on every individual guardrail run, not only at setup, and human sign-off is still required before production deployment to confirm intent matches the formal verification files.

Benno contrasts ZK guardrails with Claude Code's Hookify mechanism, which relies on regex and a local coding file that an attacker could simply modify, making it adequate for non-adversarial settings but not adversarial ones. He cites an incident where a skill file designed to evolve a Claude Code agent over time was poisoned to send data to a server in China. He also notes that LLM judges are vulnerable to the same prompt injection attacks that can compromise the primary LLM, and that one guardrails company built on observability was acquired last year for 500 million dollars while Coinbase paid Datadog 65 million dollars to log information, illustrating the cost of reactive approaches. ZK guardrails are proactive, with logging occurring only when a guardrail is violated rather than for every interaction. A key privacy advantage is that current non-ZK systems require sharing the policy with third parties to verify compliance, whereas ZK allows hiding the policy while still enabling third-party verification.

On the cryptographic backend, Benno identifies lattices and isogenies as the two areas targeted for the next 10x performance improvement. Lattices have smaller field sizes that fit natively inside GPUs, potentially eliminating the large CPU-to-GPU data transfer overhead present with elliptic curve MSMs, which he identifies as the key bottleneck preventing one GPU from proving one CPU core in real time. His goal for the year is to have one GPU proving one CPU core in real time for ZKML, a target shared by the Jolt team. Because lattices are not inherently privacy preserving, the team applies the NOVA blindfold trick to add zero knowledge back into the proving system. He describes a proposed architecture that would run fast operations on lattices and port to isogenies when succinctness is needed, though he acknowledges isogenies take a long time to prove and the field remains unsettled.

The team's go-to-market strategy is to integrate into cloud provider marketplaces rather than explaining ZK directly to end users, targeting large anchored providers who already serve millions of customers using guardrails and need cryptographic verification that agents are not taking prohibited actions. A paper with a major cloud provider is described as coming out soon showing how adding ZK improves an existing assistant guardrail system. Benno acknowledges that even with guardrails, agents remain probabilistic and cannot be made fully deterministic, but frames ZK as replacing probabilistic assurance with cryptographic assurance. He argues that agent-to-commerce at scale will not happen unless it is made secure, and that ZK guardrails represent the best available approach to that problem. He also notes that most ZK domain experts have little knowledge of AI and most AI practitioners have little knowledge of ZK, which he says creates favorable conditions for cross-disciplinary founders at this moment in the space.