Assume, then challenge, versus prove, then trust
Optimistic rollups do exactly what the name says: they assume every batch of transactions is valid and post it to L1 without any upfront cryptographic proof. To keep that assumption honest, they attach a challenge window, typically about seven days, during which anyone watching can submit a fraud proof showing the batch was computed wrong. If nobody challenges it in time, the batch is treated as final. This is why withdrawing funds from an optimistic rollup back to L1 takes so long: L1 has no way to know the withdrawal is legitimate until the challenge window closes, so it waits out the full period before releasing funds.
ZK-rollups take the opposite approach. Instead of assuming validity and leaving a window to catch fraud after the fact, they generate a cryptographic validity proof, typically a zk-SNARK or zk-STARK, that mathematically proves the new state follows correctly from the old state and the given transactions, before anything is posted to L1. L1 just verifies the proof, which is fast and cheap regardless of how much computation it represents. Since there's nothing to challenge, a ZK-rollup withdrawal can be finalized as soon as the proof is verified on L1, often in minutes rather than days.