Why does proving a model ran correctly still take longer than running it?

Zero-knowledge proofs of ML inference can verify that a model produced a given output from a given input without revealing the weights. This would let crypto applications consume AI outputs trustlessly without relying on TEEs or operator reputation. The problem is performance: generating a ZK proof for a GPT-2-scale model takes tens of minutes; at GPT-3 scale it is measured in hours. Floating-point arithmetic in transformers compiles inefficiently to arithmetic circuits, and the attention mechanism is especially costly to prove. TEE-based attestation papers over this gap but requires trusting hardware vendor firmware rather than math. Until proof generation drops by two to three orders of magnitude, every verifiable AI primitive in crypto is trading one trust assumption for another.