Anthropic uses cryptography to verify model outputs without exposing weights

Anthropic has unveiled FlashProve, an open-source cryptographic system designed to verify whether an AI model actually generated a response without revealing its proprietary weights. The system uses zero-knowledge cryptography, specifically a zkSNARK technique, to generate mathematical proofs that a specific committed model produced given output tokens in response to a particular prompt. It works by first publishing a cryptographic commitment to the model weights, creating a fingerprint while keeping the weights private; the provider can then prove that the committed model produced the corresponding output. Anthropic demonstrated the approach using Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, generating proofs at roughly 110 tokens per second on a single NVIDIA H100 GPU, with each proof around 19 MB for a 1,024-token request, and verification taking about 17 seconds on a 24-core CPU without a GPU. Potential applications include detecting tampering with responses, supporting independent evaluations, and letting regulators verify which models providers are serving. However, FlashProve remains a research prototype: proof generation takes roughly 70 to 95 times the GPU time of vLLM, it currently supports contexts up to 1,024 tokens and proves an integer version of the model under greedy decoding (not all floating-point or sampled results), and it hides weights but not architecture. Anthropic released the executable code, technical report, protocol specification, and formal verification proofs under the Apache 2.0 license to encourage further research.

(Source：Interesting Engineering)