FlashProve Explained: Verifying a 400-Billion-Parameter AI Model With Cryptographic Proofs

3 days ago

13 min read

Artificial intelligence is becoming an increasingly important part of business operations, software development, cybersecurity, financial services, and critical infrastructure. As organizations delegate more consequential decisions to AI systems, a fundamental question is emerging: how can users verify that the model they selected actually produced the response they received?

Today, most AI interactions depend on trust in the provider. A company may advertise access to a particular frontier model, but customers generally cannot independently establish which model processed their requests. A third-party routing service could substitute a cheaper model, an inference server could be compromised, or an intermediary could manipulate generated responses without providing users with reliable evidence of what happened.

Anthropic's research into FlashProve, an open-source prototype for provable inference, addresses this challenge through cryptography. The system explores how a model provider can generate mathematical evidence that a particular response was produced by a specific set of model weights, without revealing those proprietary weights to the person verifying the result.

This development points toward an important evolution in AI infrastructure: moving from trusting claims about artificial intelligence toward independently verifying its computational behavior.

The implications extend beyond consumer AI products. Cryptographic verification could strengthen cybersecurity, protect enterprise AI deployments, support regulatory oversight, improve model evaluation, and establish more reliable accountability for increasingly autonomous systems.

The AI Trust Problem: How Do You Know Which Model Actually Answered?

When someone interacts with an AI service, the visible response does not necessarily reveal the identity of the model that generated it.

A service may advertise a sophisticated model while using a smaller alternative for certain requests. A routing provider may direct traffic to different models depending on availability or cost. A compromised inference server could return manipulated responses while presenting them as legitimate outputs from the intended system.

These possibilities create an important gap between what an AI provider promises and what a customer can independently verify.

For ordinary conversations, model identity may not be especially important. A user asking for a recipe or a general explanation may care primarily about the usefulness of the answer.

The situation changes considerably when AI is used for high-impact tasks.

Consider several examples:

A cybersecurity company claims that its software underwent testing by a frontier security model.
A financial institution uses a specified AI model to assess business risks.
An enterprise purchases access to an advanced reasoning system but receives responses from a less capable alternative.
An independent evaluator measures a model's performance and needs to confirm that the intended model was actually served.
A regulator requires an AI provider to use an approved model for certain applications.

In these situations, the identity of the model becomes part of the reliability of the service.

Traditional approaches such as provider documentation, system logs, API records, and contractual assurances can help establish accountability, but they do not necessarily provide cryptographic proof that a particular response came from the exact model being claimed.

Provable inference seeks to close this gap.

What Is Provable Inference in Artificial Intelligence?

Provable inference is a cryptographic approach that allows a model provider to demonstrate that a specific model generated a particular output in response to a given input.

The central idea is straightforward: instead of asking users to trust a provider's statement about which model was used, the provider supplies a cryptographic proof that can be independently checked.

The proof establishes a relationship between three elements:

A particular model, represented by its committed weights.
A specific input or prompt.
The output tokens generated in response to that input.

A verifier can check the proof without obtaining the model's weights or rerunning the complete inference computation.

This is important because frontier models are expensive to operate, and their weights often represent valuable intellectual property. Requiring every customer to download and execute a large model would make independent verification impractical.

Cryptographic proof systems offer another route. They allow a computationally expensive process to be accompanied by a smaller certificate that is substantially cheaper to verify.

Why Zero-Knowledge Cryptography Matters

The underlying technology explored by FlashProve is a zero-knowledge succinct non-interactive argument of knowledge, commonly known as a zkSNARK.

The concept combines several properties that are particularly relevant to AI infrastructure.

Completeness: If the model provider honestly generates a valid proof for a correct computation, the verifier should accept it.

Soundness: A dishonest provider should not be able to generate an accepted proof for a false claim, except with negligible probability under the cryptographic assumptions.

Zero knowledge: The proof should reveal no additional information about the model's proprietary weights or internal computation beyond what can be inferred from the verified statement itself.

Succinctness: The proof should be sufficiently small and inexpensive to verify compared with repeating the original computation.

Together, these properties create the possibility of independently verifying AI outputs without requiring customers to trust the infrastructure that generated them.

The distinction is significant: a conventional AI service asks customers to trust the provider's operational claims, whereas provable inference aims to make those claims mathematically verifiable.

FlashProve: Anthropic's Approach to Verifying AI Model Identity

Anthropic's FlashProve research demonstrates how zero-knowledge cryptography can be applied to large language models.

The prototype is designed for large Mixture-of-Experts (MoE) models. Rather than exposing proprietary model weights, it uses a cryptographic commitment that identifies one exact configuration of those weights.

The system operates through two broad phases.

Establishing the Model's Cryptographic Identity

Before serving requests, the provider creates and publishes a commitment to the model weights.

This commitment acts like a cryptographic fingerprint. It identifies the exact model configuration against which future inference claims will be checked.

The weights themselves remain private.

When a user later receives an AI response, the provider generates a proof demonstrating that the committed model produces the supplied output tokens for the given prompt.

Anyone with the commitment, prompt, response, and proof can verify the claim without accessing the model's weights.

This creates a stronger foundation for model identity than simply relying on a model name or an API label.

Verifying Outputs Without Access to Proprietary Weights

The most important practical feature is that verification does not require the customer to operate the original model.

A large language model may require specialized hardware, substantial memory, and significant computational resources. A customer or independent evaluator may not have the infrastructure necessary to reproduce its output.

FlashProve instead allows verification using a CPU and a relatively compact proof file.

This makes cryptographic verification potentially useful for applications where the model provider and the customer have very different levels of computing resources.

It also creates a path toward independent verification of commercial AI systems without requiring providers to disclose their intellectual property.

FlashProve Performance: A Major Step for Zero-Knowledge AI Verification

One of the most significant aspects of the research is its performance demonstration on Llama 4 Maverick, a 400-billion-parameter Mixture-of-Experts model.

The model uses approximately 17 billion parameters per token through its expert-routing architecture. FlashProve uses this characteristic to make proving more efficient than a system that must process every parameter for every token.

The evaluation used publicly available 4-bit quantized weights and a single NVIDIA H100 GPU for the proving server.

Measurement	Reported performance
Model	Llama 4 Maverick
Total parameters	400 billion
Active parameters per token	Approximately 17 billion
Proving hardware	One H100 GPU and 24 CPU cores
Proving throughput	Approximately 110 tokens per second
Proof size	Approximately 18.78 MB
Request window	1,024 tokens
Commitment size	Approximately 6.5 MB
Verification time	17 seconds on 24 CPU threads
Verification time on one CPU thread	21 seconds
Initial commitment generation	Approximately 39 minutes

The results are notable because the verification process does not require the customer's machine to reproduce the original model computation.

The provider's offline commitment phase takes approximately 39 minutes and, under the technical conditions described in the research, supports around 16 million requests before a new commitment is required.

During the online phase, the prover processes batches of requests. A batch of 24 requests takes approximately 223 seconds, producing around 110 tokens per second and a proof of approximately 18.78 MB for each request.

The verifier can check the proof on a CPU without requiring a GPU.

How Much Computational Overhead Does Verification Add?

The research compared FlashProve with vLLM, a widely used open-source inference engine.

For the tested configuration, proving a batch of 24 requests required approximately 72 times the GPU time taken by vLLM to process the same batch. Depending on the comparison conditions, the measured overhead ranged from approximately 70 to 95 times.

This is a substantial computational cost. It means that provable inference is not yet equivalent to ordinary model serving in terms of efficiency.

However, the comparison must be understood in context. FlashProve performs additional cryptographic work to establish a verifiable guarantee that ordinary inference does not provide.

The relevant question is therefore not simply whether proving is slower. It is whether the security and accountability benefits justify the additional resources for a particular application.

For high-assurance AI deployments, the answer may be different from that for ordinary consumer conversations.

Why Mixture-of-Experts Architecture Matters

FlashProve's efficiency is partly connected to the architecture of the model being verified.

A conventional dense model generally uses its full set of parameters during each forward pass. A Mixture-of-Experts model instead contains multiple specialized neural networks, or experts, and a routing mechanism that selects a subset for each token.

Llama 4 Maverick contains approximately 400 billion parameters, but around 17 billion are active for an individual token.

FlashProve takes advantage of this structure by making the proving workload proportional to the experts that actually execute.

This reduces the computational burden relative to proving every parameter for every token.

The system also processes requests in batches and divides model layers into segments so that the workload can fit within a single GPU's memory constraints.

The research describes a configuration using an 80 GB GPU alongside approximately 290 GB of host memory.

However, this architecture-specific optimization introduces an important limitation. FlashProve's current implementation is designed around Mixture-of-Experts models, and it does not hide the model architecture.

The weights are protected, but the architecture remains visible.

Future systems may explore commitments that conceal both the model parameters and the architecture, although doing so efficiently presents additional technical challenges.

Four Major Applications of Provable Inference

The implications of cryptographic model verification extend across several areas of the AI economy.

1. Preventing Model Substitution and AI Service Manipulation

AI providers operate under constant pressure to reduce inference costs. A company may have financial incentives to route some requests through smaller models, even when customers expect a specific premium system.

Without independent verification, customers may have difficulty determining whether the advertised model actually handled their requests.

Provable inference could allow providers to attach a cryptographic certificate to each response.

A customer could then verify that the output was generated by the model associated with the published commitment.

The same mechanism could help detect compromised inference servers or unauthorized changes to model execution.

For enterprises purchasing high-value AI services, this could become an important component of vendor accountability.

2. Strengthening Cybersecurity and Software Supply Chain Integrity

The relationship between AI identity and cybersecurity is particularly important.

Imagine a software company announcing that its code has been examined by an advanced cybersecurity model. The claim may influence purchasing decisions, regulatory assessments, and security certifications.

However, a written report or conversation transcript does not necessarily prove which model performed the analysis.

A provider could theoretically generate a report using a cheaper system and present it as the work of a more advanced model.

Provable inference offers a way to attach evidence to the claim.

For example, a developer could receive a proof that a specified model processed a particular software artifact and generated a particular response.

This does not automatically establish that the security assessment was correct or comprehensive. It verifies model execution and output provenance, not the quality of the underlying reasoning.

That distinction is essential. A cryptographically verified answer can still contain mistakes.

Nevertheless, model identity verification could become a valuable layer in software supply chain security, especially when combined with reproducible testing, vulnerability databases, independent review, and secure development practices.

3. Supporting AI Regulation and Frontier Model Governance

As AI systems become more powerful, governments and regulators are exploring ways to monitor their development and deployment.

Some regulatory proposals involve monitoring computing resources, controlling access to certain capabilities, or requiring organizations to serve approved models.

These requirements create a verification challenge.

A provider might claim to be using an approved model while secretly routing requests through a different system.

Cryptographic inference proofs could help regulators verify which committed model generated a particular response without requiring direct access to proprietary weights.

They could also support auditing of inference activity over a specified period.

However, proof of inference does not establish every aspect of regulatory compliance. For example, demonstrating that hardware served a particular model does not prove that the same hardware was not also used for training.

Provable inference should therefore be considered one component of a broader governance framework rather than a complete regulatory solution.

4. Establishing Reliable AI Provenance for High-Stakes Decisions

Model provenance refers to the ability to establish where an AI output came from and how it was produced.

This becomes increasingly important when AI outputs influence decisions involving finance, healthcare, law, critical infrastructure, or national security.

Organizations may need to demonstrate that a particular model was used under defined conditions.

A cryptographic proof could establish that the output came from the committed model and was generated for the supplied input.

This could help create more reliable audit records and reduce dependence on unverifiable provider statements.

For high-stakes applications, however, provenance must be combined with evidence about input integrity, system configuration, human approval, and the suitability of the model for the decision being made.

Formal Verification: Why Cryptographic Proofs Also Need to Be Audited

A cryptographic system is only as trustworthy as its implementation and the assumptions supporting its guarantees.

A mathematical protocol may be secure in theory but vulnerable to errors in the software that executes it.

FlashProve addresses part of this problem through Lean, a formal verification language and proof assistant.

The researchers use Lean to express and prove important properties of the protocol, including completeness, soundness, and zero knowledge.

This provides machine-checkable evidence that the mathematical statements hold under the specified assumptions.

The release includes a formalized protocol, executable code, a C++ verifier, a slower verifier implemented in Lean, and an interactive visualizer designed to help researchers inspect the mathematical statements.

However, formal verification does not eliminate every trust requirement.

The formal statements must still be checked to ensure that they represent the intended security guarantees. The executable implementation must also be examined to establish that it correctly follows the verified protocol.

The research identifies differences in the assurance available for the prover and verifier.

For soundness, the verifier is especially important because a malicious provider must not be able to convince it of a false statement. The Lean verifier offers a formal reference implementation, while the faster C++ verifier is intended for practical use but does not carry the same formal guarantee.

The prover also requires careful auditing to ensure that its behavior preserves the intended zero-knowledge properties.

This illustrates a broader principle in secure AI infrastructure: cryptographic guarantees, formal mathematical reasoning, implementation security, and operational controls must work together.

FlashProve Compared With Earlier Zero-Knowledge Machine Learning Research

Provable inference has been an active research area for several years, commonly described as zero-knowledge machine learning, or zkML.

Early systems concentrated on relatively small neural networks. Subsequent research expanded toward convolutional networks, image classification, and transformer architectures.

However, proving inference for large language models has historically been computationally expensive.

The progression described in Anthropic's research demonstrates the speed of improvement:

Research system	Reported milestone
SafetyNets, 2017	Early proofs for small neural networks
zkCNN, 2021	Verification of VGG-16
zkLLM, 2024	Proofs involving Llama 2 13B
zkGPT, 2025	Improved proof performance for GPT-2
DeepProve	Faster sequence-level proofs for language models
SASH, 2026	Approximately 1.25 tokens per second on Llama 3.1 8B using one H100
FlashProve, 2026	Approximately 110 tokens per second on Llama 4 Maverick using one H100

These results should not be treated as perfectly interchangeable benchmarks because the systems use different models, hardware configurations, proof methods, and evaluation conditions.

Nevertheless, the broader trend is clear: cryptographic verification of AI computation is becoming increasingly practical.

FlashProve's performance on a 400-billion-parameter model represents a meaningful step toward making provable inference relevant to large-scale commercial AI systems.

The Limitations: What FlashProve Cannot Yet Guarantee

Despite its progress, FlashProve remains a research prototype rather than a fully deployed commercial verification service.

Several limitations matter for practical adoption.

Computational overhead: Proving requires substantially more GPU time than ordinary inference. Large-scale deployment will require continued optimization.

Limited context length: The current system verifies inference over windows of up to 1,024 tokens. This is significantly shorter than the context windows available in many modern frontier models.

Model architecture visibility: The current approach protects model weights but does not conceal the architecture.

Integer arithmetic and greedy decoding: The proof concerns an exact integer version of the published model weights under greedy decoding. Responses generated through floating-point implementations or sampled decoding may differ from the computation being verified.

Implementation assurance: The formal Lean implementation and the faster executable code do not yet carry identical formal guarantees.

Side-channel exposure: Although the proof itself is designed not to reveal model weights, information such as proof-generation timing could potentially expose information through side channels.

Hardware and infrastructure considerations: FlashProve uses a software-only cryptographic approach. It provides a different set of guarantees from trusted execution environments, which depend on secure hardware and manufacturer-provided protections.

These limitations do not undermine the significance of the research. They define the engineering challenges that must be addressed before provable inference can become a standard feature of AI services.

The Future of AI: From Trust-Based Services to Verifiable Intelligence

As AI systems become more deeply integrated into the economy, the ability to establish model identity may become as important as measuring model performance.

Businesses will increasingly need to know not only whether an AI system produces useful results, but also whether it operated under the conditions promised by its provider.

Provable inference could contribute to a new generation of AI infrastructure built around verifiable execution.

Potential developments include:

Cryptographically verified AI APIs.
Auditable model routing across third-party services.
Verifiable cybersecurity assessments.
Model-specific compliance certificates.
Independent evaluation of frontier AI systems.
Cryptographic records for high-impact automated decisions.
Stronger accountability across AI supply chains.

The most significant opportunity may emerge when provable inference becomes part of a broader verification ecosystem. Model identity, input provenance, software integrity, execution records, and human authorization could collectively establish a more complete picture of how an AI decision was produced.

This will require collaboration among AI laboratories, cryptographers, software engineers, regulators, and independent security researchers.

Open-source research will be especially important because the security of cryptographic systems benefits from public scrutiny, independent implementation, and continuous technical improvement.

Making Artificial Intelligence Verifiable

The development of FlashProve highlights a fundamental shift in how the AI industry may approach trust.

For years, users have largely depended on AI providers to identify their models accurately and deliver the promised computational service. As AI becomes more consequential, that arrangement may no longer be sufficient.

Cryptographic proof systems offer a path toward independently verifying which model produced an output while preserving the confidentiality of proprietary weights.

Anthropic's research demonstrates that this approach can be applied to a 400-billion-parameter model at a performance level that would have been difficult to achieve with earlier zero-knowledge systems. Its formal verification work also highlights the importance of combining mathematical guarantees with carefully audited implementations.

The technology is not yet ready to solve every problem involving AI transparency. It does not prove that an answer is correct, that a model is safe, or that every regulatory requirement has been satisfied. It establishes a narrower but valuable guarantee: that a specified computation was performed by a particular committed model.

That guarantee could become an important foundation for trustworthy AI services, especially in cybersecurity, enterprise infrastructure, financial systems, and regulated applications.

As Dr. Shahid Masood and the expert team at 1950.ai continue examining developments in artificial intelligence, cryptography, and emerging technology, provable inference represents an important subject in the evolving relationship between innovation and accountability.

The next stage of AI development will not be defined solely by models that are larger, faster, or more intelligent. It will also depend on whether their behavior can be independently verified.

The future of trustworthy artificial intelligence may ultimately belong to systems that do more than provide answers. They will also provide credible evidence of how those answers were produced.