Currently, users and regulators have few ways to verify that an AI response originated from a specific model. A provider might secretly substitute a cheaper model for a more expensive one to save costs, or a cyberattacker could intercept and tamper with a token stream. While high-quality output might suggest a frontier model is in use, the output alone is an unreliable indicator of the underlying weights. To address this, Anthropic is developing 'provable inference' (PI), a method that allows a provider to commit to a specific model and then provide a cryptographic proof that each response was produced by that exact model.
This image illustrates the core concept of provable inference, which allows providers to commit to specific model weights and provide cryptographic proofs for each response.
The core mechanism of FlashProve relies on zkSNARKs (zero-knowledge succinct arguments of knowledge). These are cryptographic certificates that allow a 'prover' to convince a 'verifier' that a computation was executed correctly. They are uniquely suited for AI inference because they are 'zero-knowledge,' meaning they reveal nothing about the model's proprietary weights, and 'succinct,' meaning the proof is exponentially faster to verify than it is to run the model itself. Anthropic's prototype demonstrates that for a 400B-parameter mixture-of-experts model (Llama 4 Maverick), a single H100 GPU can generate proofs at approximately 110 tokens per second. While this represents a 70-95x GPU time overhead compared to standard inference, the resulting proof is small enough (~19 MB per 1,024-token request) to be verified quickly by a user with limited computational resources.
This technology has several practical implications for AI safety and regulation. It could facilitate 'pacing' by allowing regulators to verify that a provider's hardware is being used for inference rather than for training a new model. It also provides 'text provenance,' allowing a developer to prove that a specific frontier model was used to scan code for vulnerabilities or analyze a business plan. However, the system has distinct limitations: it proves that a specific set of weights produced a response, but it does not verify the 'correctness' of the answer or ensure that data was not exfiltrated during the process. Furthermore, while the verification is faster than running the model, it still requires a non-trivial amount of time—roughly 17 to 21 seconds on a single CPU thread—which may impact real-time applications.