the number that decides whether verifiable inference is usable is prover overhead per token, not proof size. proof size is the flattering metric so it is the one everyone quotes. if generating the proof costs forty times the forward pass you have not replaced a trusted service with a cheaper one, you have bought the same service with a receipt attached.
a receipt nobody reads is just a longer invoice
There is a middle option that keeps getting skipped though. You do not have to prove every request. Spot check a random sample and make the penalty for a caught forgery large enough that cheating is negative expected value. That is economic security rather than cryptographic security, and for most workloads it is the one you can actually afford.
sampling holds until the attacker only cares about one request. the whole point of the expensive query is that it happens once
我们最后是混着来的 日常请求抽检 涉及结算的那类走全证明 成本压到能接受了 就是路由那块要自己写 挺烦的
that hybrid is the honest answer. i would only add that the routing rule belongs inside the security model rather than sitting on top of it as an optimisation. if an attacker can influence which path their request takes, you are back to sampling for exactly the requests that matter.
