ZKAP: An Enforcement Protocol for Verifiable Regulatory Compliance of Machine-Learning Inference via Certified Stack Binding

This paper introduces ZKAP (Zero-Knowledge Audit Protocol), a cryptographic protocol in which a machine-learning inference is coupled to a zero-knowledge proof of constraint satisfaction in such a way that the output of the inference cannot be released on any observable channel unless the proof verifies. The protocol rests on two principal technical contributions: The Certified Stack — a composite object that cryptographically binds the model weights, a mandatory bit-integrity policy (integer quantisation), the inference runtime stack and the hardware configuration under a single commitment (RootHash), which is included as a public input to every proof produced by the system. Prove-before-output enforcement — a family of four embodiments (hardware output gate, trusted-execution-environment release path, silicon-level embodiment, syscall-intercepting software runtime) in which the output of the inference is physically blocked from leaving the system until the accompanying proof has verified against the Certified Stack commitment and against a constraint set signed by an external authority. Three supporting mechanisms are described: authority-signed formal constraints with a five-type taxonomy, a per-inference hash chain with external anchoring, and a three-party cryptographic separation of duties. The paper further discusses practical relaxations of the strict release semantics for real-time workloads. A soundness theorem is stated against a polynomial-time adversary controlling the operator of the inference, and regulatory implications for high-risk AI systems under Regulation (EU) 2024/1689 (Artificial Intelligence Act) are discussed. Priority declaration. The inventive mechanisms described in this paper are the subject of Bulgarian patent applications BG/P/2026/114317 (filed 30 March 2026) and PTBG202600000316742 (filed 12 April 2026). This preprint establishes the academic priority of the author, as of the date of the deposit timestamp, over the specific technical constructions described in Sections 3 and 4 of the paper. Access note. This deposit is under embargo until 31 March 2027. During the embargo, metadata (title, abstract, author, keywords, references) are publicly visible; the full text is not publicly accessible. The embargo date coincides with the Paris Convention priority deadline of the underlying Bulgarian patent application BG/P/2026/114317. The DOI assigned at deposit time serves as a timestamp for academic priority purposes, independent of the file's accessibility.