Anthropic Open-Sources FlashProve: Verifying Model Outputs with Zero-Knowledge Proofs
Anthropic has announced its verifiable inference research FlashProve, enabling developers to verify whether a given response came from a specified model, and has open-sourced the code. The solution is based on a zkSNARK architecture: model outputs come with a mathematical proof attached, and users can complete verification on an ordinary CPU within seconds without leaking model parameters. According to reports, on a 400B MoE Llama 4, a single H100 can generate proofs for 110 tokens per second, with proof files of about 19MB; the code and the Lean formal security proof are open-sourced under the Apache 2.0 license.
Why read this
AI score 74
Anthropic has open-sourced a verifiable inference solution, allowing readers to learn how to use cryptographic proofs to verify whether model outputs come from specified weights.
Topics
View original postNew Anthropic research: progress on provable inference for large language models. Here, we introduce FlashProve. Building on established cryptographic techniques, FlashProve allows developers to verify whether a given response came from a given AI model. It’s substantially more efficient than prior open-source methods for doing so. These proofs have a range of applications. They can, for instance, make it harder for attackers to hijack a chat, or enable safety evaluators to verify that the model they’re testing is the same one being served to customers. For our full write-up, see here: https://t.co/OIZWPb6QZa Further progress in provable inference will likely be an important part of improving trust in AI deployment. To that end, we're open-sourcing FlashProve’s code, here: https://t.co/7ky3Ir8V06 We’re grateful to our collaborators: Alessandro Chiesa, @GiacomoFenzi, @gwberg95, @miranda__christ, Rahul Dalal (https://t.co/pjWKLHWXyz) and Ben Mayer (@transmissions11).
View original
New Anthropic research: progress on provable inference for large language models. Here, we introduce FlashProve. Building on established cryptographic techniques, FlashProve allows developers to verify whether a given response came from a given AI model. It’s substantially more efficient than prior open-source methods for doing so. These proofs have a range of applications. They can, for instance, make it harder for attackers to hijack a chat, or enable safety evaluators to verify that the model they’re testing is the same one being served to customers. For our full write-up, see here: https://t.co/OIZWPb6QZa Further progress in provable inference will likely be an important part of improving trust in AI deployment. To that end, we're open-sourcing FlashProve’s code, here: https://t.co/7ky3Ir8V06 We’re grateful to our collaborators: Alessandro Chiesa, @GiacomoFenzi, @gwberg95, @miranda__christ, Rahul Dalal (https://t.co/pjWKLHWXyz) and Ben Mayer (@transmissions11).
Body · AI translation
Those unscrupulous AI wrapper relay services are done for. Anthropic has officially handed down a demon-revealing mirror: the Claude large-model anti-counterfeiting certificate is here! No more worrying that AI relay services will secretly swap in low-cost models as wrappers to rake in huge profits,
Anthropic has officially open-sourced FlashProve: a 400B giant model achieving ultra-fast zero-knowledge proofs at 110 tokens per second, completely eliminating fake interfaces.
When people normally call various large-model APIs or third-party relay services, the most headache-inducing thing is that there is simply no way to verify authenticity: relay providers charge the price of top-tier models while secretly swapping in cheap small models to arbitrage, and you cannot tell; hackers hijack the data stream and tamper with answers, and you cannot tell from the surface of the text either.
Today, this system released by Anthropic directly stamps every model call with an unforgeable cryptographic seal.
It is based on a zero-knowledge proof (zkSNARK) architecture. While the large model outputs an answer, it also attaches an extremely small mathematical proof. You can complete verification in just a few seconds on your own ordinary computer CPU. It can 100% confirm that this line of text really came from that specific set of official weights, while absolutely not leaking any of the big vendor's underlying commercial secret parameters.
The most explosive part is its engineering performance: on the 400-billion-parameter (400B MoE) Llama 4 giant model, a single H100 GPU can generate proofs for 110 tokens per second, and the proof file is only about 19MB; compared with open-source solutions from two years ago that took more than ten minutes to run a single token at a snail's pace, the speed has soared by several orders of magnitude. The entire codebase and the Lean formal security proof are fully open-sourced directly under the Apache 2.0 license.
Previously, calling APIs depended entirely on the conscience of the relay provider. From today on, every token generation has an undeniable mathematical receipt.
Whoever is secretly swapping models to arbitrage, whoever is passing off a small model as a flagship, as long as this verifier is put in place, all the tricks will be exposed on the spot with nowhere to hide.
The open-source repository and core paper are compiled on the first floor.