Anthropic open-sources FlashProve, a research prototype for cryptographic proof of AI model inference, validated on Llama 4 Maverick
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 05/11/2026 00:13; os links antigos trazem para cá.
Anthropic released FlashProve, an open source research prototype for "provable inference": a cryptographic proof that a specific AI model produced a specific output (techcrunch.com). According to helpnetsecurity.com, it was built by Anthropic's Frontier Red Team with EPFL, MIT and StarkWare, and it targets the trust gap in hosted inference APIs, where callers cannot tell whether a cheaper model was substituted or the token stream was tampered with, and outside evaluators cannot confirm the tested model matches the served one. It also lets third parties verify that a task, such as a security scan, was actually performed by the claimed model (techcrunch.com). The code and specification are published on GitHub under Apache 2.0 (helpnetsecurity.com). This is a research preview, not a production security control, and Anthropic says it has no current plans to deploy it at Anthropic or any other lab (techcrunch.com, helpnetsecurity.com).
Detalhes técnicos
- Design: labs publish a cryptographic fingerprint for each released model, which is later matched to outputs and verified without exposing model weights, so closed-model vendors such as Anthropic and OpenAI could participate (techcrunch.com). Verification is light enough to run locally on a user's device (techcrunch.com).
- Repository contents: a prover, a fast C++ verifier, a Lean-based reference verifier with formal proofs of completeness, soundness and zero-knowledge, a protocol specification and an interactive visualizer (helpnetsecurity.com).
- Validation target: Llama 4 Maverick, a 400-billion-parameter Mixture-of-Experts model. Weights are not included and must be pulled separately from Hugging Face under Meta's license (helpnetsecurity.com).
- Prover: works on only the ~17 billion parameters active per token, streaming weights in layer-sized segments. It needs a single 80GB GPU and about 290GB of host memory, and reaches about 110 tokens/second on one H100 with 24 CPU cores (helpnetsecurity.com).
- Proof and verification: a proof for a 1,024-token request is ~18.78MB and verifies in about 17 seconds on 24 threads (21 seconds single-threaded). A one-time offline commitment step takes about 39 minutes per model and covers roughly 16 million requests; clients then download a 6.5MB commitment plus one proof per request (helpnetsecurity.com).
- Overhead: about 72x per GPU on average and up to 94x under heaviest load, compared with vLLM running the same model in FP8 on eight H100s (helpnetsecurity.com).
- Limitations: the prover lacks formal verification tooling and must be audited manually, unlike the Lean-verified components. Anthropic notes gaps between the paper, the formal Lean protocol and the running code that still need manual review (helpnetsecurity.com).
Linha do tempo
-
Anthropic Open-Sources FlashProve, a Cryptographic Proof-of-Inference Prototype for MoE Models
ler a análise desta fonte ocultar
Anthropic's Frontier Red Team, working with EPFL, MIT and StarkWare, released FlashProve, an open-source prototype that generates a cryptographic proof confirming a specific language model produced a specific reply to a prompt. The project addresses a trust gap in hosted inference APIs, where callers cannot verify whether a cheaper model was substituted or the token stream was tampered with, and where outside evaluators cannot confirm the model they tested matches the one actually served in production. The repository, published under the Apache 2.0 license, includes a prover, a fast C++ verifier, a Lean-based reference verifier with formal proofs of completeness, soundness and zero-knowledge properties, a protocol specification, and an interactive visualizer. This is a research release, not a production security control, and Anthropic explicitly notes gaps between the paper, the formal Lean protocol, and the running code that still require manual review.
Technical Details
FlashProve was validated against Llama 4 Maverick, a 400-billion-parameter Mixture-of-Experts model (model weights are not included and must be pulled separately from Hugging Face under Meta's license). The prover operates on only the ~17 billion parameters active per token, streaming weights through in layer-sized segments, and runs on a single 80GB GPU with roughly 290GB of host memory. On one H100 with 24 CPU cores it achieves about 110 tokens/second; a proof for a 1,024-token request is ~18.78MB and verifies in about 17 seconds on 24 threads (21 seconds single-threaded). A one-time offline commitment step takes about 39 minutes per model and covers roughly 16 million subsequent requests, after which clients download a 6.5MB commitment plus one proof per request. Compared to vLLM running the same model in FP8 across eight H100s, overhead measured about 72x per GPU on average and up to 94x under heaviest load. The prover itself lacks formal verification tooling and must be audited manually, unlike the Lean-verified components.
-
Anthropic Previews FlashProve, Open Source Cryptographic System for AI Model Output Verification
ler a análise desta fonte ocultar
Anthropic published a blog post describing FlashProve, a research project building an open source system for 'provable inference' — cryptographic proof that a given AI output was generated by a specific model. The system aims to let users verify a model's identity in a way similar to cryptographic email signatures, preventing impostor scenarios including a lab secretly swapping in a cheaper or more capable model than advertised. It also allows third parties to verify claims that a specific task (e.g., a security scan or business plan review) was actually performed by a claimed model. This is a research preview, not a production deployment, with code and a technical specification released on GitHub for community feedback and improvement.
Technical Details
FlashProve requires AI labs to publish a cryptographic fingerprint for each released model, which can later be matched to specific outputs and verified without exposing the underlying model weights. This design allows closed-model vendors like Anthropic and OpenAI to participate without disclosing proprietary internals. The system is built to be lightweight enough for verification to run locally on a user's device. Anthropic has released working code and a detailed spec under an open source license, but stated there are no current plans to deploy the system at Anthropic or any other lab.