When you talk to a friend in person, you can see them, hear them, shake their hand. When you talk to an AI model, you have almost none of those assurances. Anthropic's new research takes aim at exactly that gap: the company has published progress on cryptographic proofs of inference, including a system called FlashProve that can prove — mathematically, not contractually — that a response really came from the model it claims to be.
The problem FlashProve addresses is quietly structural. A user querying a model today cannot check that the responses came from the specific model a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream. Judging from the output alone is unreliable, even if the answers look excellent. In an industry where the same chat window can silently route to a cheaper model under load, that is not a hypothetical concern — it is the default trust model. For more coverage of work like this, see our AI research news.
Why Provable Inference Is Hard
The goal of provable inference is to let a user with limited computational resources — and no access to a model's private weights — verify that a given response was genuinely produced by that model. The obvious approach, re-running the model yourself, is a non-starter: frontier models' weights are kept private, and checking a response against them would require compute far beyond what a typical user, or even a well-funded evaluator, can afford.
Anthropic's approach leans on zkSNARKs, a family of zero-knowledge proofs with strong hiding and efficiency properties that make them uniquely fit for the task. A provider commits to a model once, then generates a compact proof for each response that the answer was computed by the committed model — while the proofs themselves hide the model's weights. Hiding the architecture is not a goal of the system; hiding the weights is.
The Numbers
The efficiency figures in the post are the story's technical core, because proof generation for large models has historically been orders of magnitude too slow to matter. For Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, a single NVIDIA H100 GPU generates proofs at around 110 tokens per second, with a proof size of roughly 19 MB per 1,024-token request, using 4-bit quantized weights and integer arithmetic in prefill.
That speed comes at a cost: proof generation takes roughly 70 to 95 times the GPU time of simply running the model itself on vLLM, a widely used open-source inference library. Expensive, in other words — but for the first time in the same order of magnitude as the thing being proven, and, according to Anthropic, substantially faster than prior open-source systems, which lag by orders of magnitude.
Claude Built It — and Lean Audits the Claims
There is a second story folded inside the first. According to the post, Claude itself produced the improvements on zkSNARKs for inference, finding novel ways to apply state-of-the-art tools from the cryptography and security literature while relying on well-established design principles for cryptographic proof systems.
Anthropic is candid about the risk that comes with that workflow: Claude is good at optimization, but often makes decisions that are hard to evaluate, especially in large complex systems. The countermeasure is formal verification. The company provides top-level auditable statements in Lean, a formal verification language, for the claimed security guarantees — machine-checked mathematics standing between an AI's clever optimizations and the users who have to trust them.
The full stack is being released under the Apache 2.0 license: the blog post, a technical report explaining the system's details, a protocol description, executable code including a prover and two verifiers — a fast verifier in C++ and a provably correct verifier in Lean — plus the Lean proofs themselves and an interactive visualizer to aid auditing.
From Compliance to AI Pacing Treaties
Anthropic sketches use cases that range from routine to geopolitical. Independent evaluators who test AI models before and after release need to know the model they are evaluating is the model being served. Clients who access a model through a third-party routing service want assurance that the tokens came from the model they paid for. And in the security scenario, a cyberattacker who modifies the token stream while impersonating a given model becomes detectable in a way that output inspection alone can never achieve.
The most ambitious application named in the post is verification of compliance with AI pacing requirements — the emerging class of agreements, voluntary and governmental, that attempt to govern how fast frontier capabilities advance. Today such commitments rest on trust and paperwork. Cryptographic proofs of inference offer something closer to inspection: a way to demonstrate, rather than assert, which model is serving a given workload.
The researchers are explicit that this is intermediate progress, not a completed research agenda, and they are publishing with the stated goal that others take the work and improve it. That framing is itself a signal: provable inference has moved from cryptography-seminar thought experiment to an engineering problem that a frontier lab is now openly racing to make cheap enough to deploy.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
