Anthropic has introduced FlashProve, a fully software-based system designed to verify that a cloud AI service provider is indeed running the advertised model. The company thus enters the field of so-called zKML (Zero-Knowledge Machine Learning) research, which relies on zero-knowledge proofs, a technique that allows demonstrating a computation was performed without revealing its internal elements.
- Anthropic introduces FlashProve, a software-only system that verifies a cloud provider runs the advertised model.
- The system proves a response comes from the model without revealing its weights.
- Proof generation needs 72 to 94 times more computation than inference, so continuous use is impractical.
- Proofs are generated after inference, and clients wait 223 seconds per batch of 24 sequences.
The mechanism makes it possible to establish that a response is indeed the result of a given model’s computation, without the weights of the model—its learned parameters—being disclosed. The server first generates a “commitment,” a fingerprint that locks in the exact choice of weights. Upon a client’s request, it then produces a proof file.
Performance measured in a specific configuration
Anthropic reports results obtained with a well-defined configuration: a MoE (Mixture of Experts) model, Llama 4 Maverick, quantized to 4 bits, meaning reduced to lower precision. The server used has an H100 GPU and 24 CPU cores, and output sequences of 1024 tokens are processed in batches of 24.
According to these measurements, generating the initial fingerprint takes about 39 minutes, and its size reaches a few MB. It can be reused for about 16 million queries before needing recalculation. The proof generation throughput is around 110 tokens per second, and a proof weighs on average 18.78 MB. Its validation on a single CPU core takes 21 seconds.
A computation time far exceeding inference
To run the system on a single GPU, Anthropic stores the weights in the host’s RAM, then splits the neural network layers into segments that the GPU processes sequentially. The company works in 4-bit precision, thus using integer arithmetic, which is simpler to translate into cryptographic equations. FlashProve also leverages the MoE architecture to only prove the computation path taken by the actually active experts.
These choices are not enough to make the process fast. Proof generation still requires 72 to 94 times more computation time than raw inference performed with the vLLM software. According to the source, this overhead precludes continuous use.
Context and latency constraints
Anthropic chose to generate the proof after the fact rather than on the fly. This option degrades the user experience less and allows delegating the computation to dedicated machines, but it imposes constraints. Since the inference occurred earlier, the server must re-inject the inputs and outputs to recompute the internal states and extract the cryptographic execution trace. The client, for its part, does not get the proof immediately: for a batch of 24 sequences of 1024 tokens, they must wait 223 seconds.
The source also notes a risk of divergence for responses stemming from a floating-point implementation or sampling-based decoding, rather than greedy decoding. Beyond a certain position, these responses might no longer exactly match the proven computation. The context size, currently limited to 1024 tokens, is another limitation. FlashProve nonetheless offers intrinsic post-quantum resistance, linked to the absence of classical elliptic curves, and draws inspiration from Ethereum layer 2 rollups, mechanisms that batch transactions off the main chain.
