ZK-SR117 Tests a Private Audit Trail for Fair-Lending AI

A new arXiv preprint proposes a practical use for zero-knowledge proofs beyond blockchain scaling: allowing banks to demonstrate selected properties of a credit model without handing auditors the model weights or row-level customer data.

The paper, titled “ZK-SR117,” divides a committed validation set into fixed-size chunks and proves aggregate statistics for each chunk. In its reported demonstration, the system processed 32,768 rows from 2022 HMDA mortgage data through 32 independently verified zkSNARK proofs. The resulting demographic-parity gap was 0.06243, compared with 0.06532 on the full holdout set, an absolute difference of 0.00289. Each chunk took approximately 3.7–4.0 seconds to prove.

The same architecture also attested expected calibration error across ten probability bins. Per-chunk proving took about 14.72 seconds, while the reported circuit-precision difference against the exact committed sample was 0.00037. The design publishes aggregate counts rather than individual records, so a verifier can check the computation without seeing the underlying rows.

The engineering choice is the paper’s most useful lesson. A flat circuit became impractical at larger sizes, while a tree-reduction design was difficult to compile. Chunking kept the circuit small and reusable, but it introduced a linear proof-size cost: the 32-proof demographic-parity run produced approximately 24.2 MB of proofs.

The experiment also caught a real data-quality problem. One sentinel-like loan-to-value value produced an extreme standardized score and caused a chunk to time out. The authors say they fixed it through a deterministic, published clipping specification applied before nonce-controlled sampling. That detail matters: a private audit is only as credible as its data-preparation rules.

There is an important regulatory caveat. The paper maps its design to Federal Reserve SR 11-7 and OCC Bulletin 2011-12, but the Federal Reserve’s April 17, 2026 SR 26-2 letter says the agencies’ revised model-risk guidance supersedes SR 11-7. The preprint therefore should be read as a technical prototype, not as evidence that a regulator accepts ZK proofs as sufficient compliance evidence. Its authors explicitly state that only two controls, one model class, and one task were implemented end to end; the remaining seven proposed control mappings are future work.

For ZK developers, the new angle is not simply “privacy-preserving AI.” It is the conversion of an audit request into a composable statement: commit the model, commit the validation data, let an examiner control sampling, and prove only the aggregate properties that matter. The next test is whether this pattern can handle multiple models, drift monitoring, independent validators, and the proof-size and operational requirements of real supervisory workflows.