Anthropic proposes cryptographic proof of which model produced an answer

Anthropic published a research post on “provable inference”, describing a prototype called FlashProve that lets a user check that a language model’s output was produced by a specific, committed set of weights. The work is listed under Anthropic’s Frontier Red Team and includes authors from EPFL and MIT.

The problem it addresses is that users generally cannot tell which model answered them. A provider could route requests to a cheaper model, or someone could alter a response in transit, and judging output quality does not settle the question. The post lists independent evaluators checking a served model, clients of third-party routers, regulators enforcing approved-model rules, and tamper detection on inference servers as uses.

The scheme has two stages. Offline, the model’s operator publishes a short commitment, described as a fingerprint, that pins down one set of weights without revealing them. Online, it produces a zero-knowledge proof (a zkSNARK) that the committed model generates the given output tokens for the given prompt. Anyone holding the commitment, prompt and reply can verify the proof without access to the weights. Proofs are generated in batches after the fact, not as responses are served.

The authors report figures from a demonstration on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with 4-bit weights. Proving ran at about 110 tokens a second on one H100, with proofs of about 19 MB for a 1,024-token request. Proving cost about 70 to 95 times the GPU time of serving the same requests with vLLM. Verification took about 17 seconds on a 24-thread CPU. Setup for a model took about 39 minutes, once. The post gives no dollar costs.

The limits are stated in the post. The proof covers an integer version of the weights under greedy decoding, so floating-point or sampled outputs may diverge. Context is capped at 1,024 tokens, the design assumes a mixture-of-experts architecture, the model’s architecture is not hidden, only its weights, and side channels such as proof timing are out of scope. The authors also say the fast C++ implementation carries no formal guarantee of matching the Lean proofs and the paper. They call it a research prototype.

The post also says Claude contributed to the design and wrote the protocol specification, and that because Claude “often makes decisions that are hard to evaluate”, the security claims are stated in Lean so they can be audited. Anthropic released the code, Lean proofs, a protocol specification and a technical report under the Apache 2.0 licence, and said it wants others to “take it, and improve it”. Adoption would require labs to publish a commitment for each model and to produce proofs on request. The post is a research result and announces no Anthropic product or policy commitment.