Anthropic researchers demonstrate faster cryptographic proofs for AI inference

Anthropic published a research post detailing progress on provable inference for large language models through a system called FlashProve. This work addresses the inability of users to verify that responses originate from the specific model claimed by a provider.This system lets users prove that an AI response came from the specific model they paid for.FlashProve leverages zkSNARKs to achieve provable inference speeds significantly exceeding prior open-source benchmarks.

The evidence

Anthropic researchers Roy Rinberg, Alex Allain, Alessandro Chiesa, Miranda Christ, Rahul Dalal, Giacomo Fenzi, Ben Mayer and Guy Weissenberg described how cryptographic proofs can solve verification issues in AI interactions. They noted that current users cannot distinguish between a claimed model and one substituted by a routing service or an attacker.

The team focused on zkSNARKs, a type of cryptographic proof offering strong hiding and efficiency properties. According to the post, FlashProve substantially outperforms prior open-source systems in speed.reported For a large mixture-of-experts model like Llama 4 Maverick with 400 billion parameters, the system achieves specific throughput metrics.reported

The decision

A single H100 GPU generates proofs at around 110 tokens per second for the 400B-parameter model. This performance uses 4-bit quantized weights and integer arithmetic during the prefill phase. Each proof covers a 1,024-token request and results in a file size of approximately 19 MB.

The authors state this speed is roughly 70 to 95 times the GPU time required to run the model itself using vLLM. Prior open-source systems are described as being orders of magnitude slower than this new approach. The system relies on novel applications of existing cryptography tools while adhering to established design principles.

The takeaway

FlashProve hides the model weights within the commitment and inference proofs, but it does not hide the model architecture. The researchers emphasised that concealing the architecture is not a goal of this system. The primary benefit is allowing providers to commit to a model and prove each response came from it.

This capability could enable applications ranging from consumer products to internal security measures. It may also contribute to toolkits for verifying compliance with AI pacing requirements. The system offers a way to cryptographically verify model identity rather than relying on output quality alone.

Building on this

Developers can build verification layers that confirm response origins using zkSNARKs. They can integrate FlashProve to hide model weights while exposing architecture details. Builders must account for significant computational overhead, as proof generation is much slower than inference.

Enterprise IT buyers can use these proofs to prevent model substitution attacks. They can verify that routing services have not swapped models for cost reasons. Developers should note that judging model identity by output quality remains unreliable without such proofs.