Progress on provable inference for large language models

Roy Rinberg (Anthropic), Alex Allain (Anthropic); Alessandro Chiesa (EPFL, StarkWare), Miranda Christ (MIT, RESI), Rahul Dalal (Anthropic STEM Fellows Program, Succinct), Giacomo Fenzi (EPFL), Ben Mayer (Anthropic Fellows Program, MIT), Guy Weissenberg (EPFL)

Executive summary

When you conversation to a companion in person, you have many ways to cognize it is really them: you can see them, comprehend them, tremble their hand. When you conversation to an AI model, you have nearly none. A person querying a example today cannot inspect that the responses came from the particular example that a developer claims is responding, as opposed to one secretly substituted in by a routing assistance for disbursal reasons, or equal by an attacker who has tampered alongside the token stream. Judging from the model’s output solitary is unreliable, equal if it produces high-quality responses. Cryptographic proofs of conclusion resolve this problem: they let a example provider commit to a example and afterward demonstrate that all reply was produced by that model. Such proofs could allow applications ranging from person products to inner security, and could contribute to a toolkit for verifying compliance alongside AI pacing requirements.

Specifically, we have made advancement on a mighty category of cryptographic evidence known as a “zkSNARK”, which is uniquely fit for provable inference (owing to its powerful hiding and effectiveness properties). In this post, we portion several of that progress, chiefly through a scheme we call FlashProve. A concise specialized summary is as follows:

1. Claude has produced improvements on zkSNARKs for inference, construction a scheme that is substantially faster than previous open-source systems.
   1. For a ample example (Llama 4 Maverick, 400B-parameter blend of experts), a sole H100 GPU generates proofs at about 110 tokens/second, alongside a evidence size of ~19 MB per 1,024-token request, whenever in 4-bit quantized weights, using entire figure arithmetic in prefill. This is ~70-95x the GPU period of operating the example itself on vLLM, a average open-source library.
   2. Prior open-source systems are orders of dimension slower, as we conversation in section 6. Claude established novel ways to use state-of-the-art tools in the cryptography and safety literature, during relying on well-established scheme principles for cryptographic evidence systems. The dedication to the model, and consequent conclusion proofs, conceal the weights of the model; hiding the architecture of the example is not a goal of this system.
2. Claude is fine at optimization, but frequently makes decisions that are difficult to evaluate, particularly in ample complex systems. We oppose this by providing top-level auditable statements in Lean (a ceremonial verification language) for the claimed safety guarantees.

Today we are releasing five artifacts:

• The current blog post, which outlines our scheme and its possible applications;
• A technical report explaining the particulars of our system;
• A (Claude-written) protocol specification document;
• Executable code that includes: a prover and two verifiers, a fast verifier in C++, and a provably accurate verifier in Lean; and
• Lean proofs for the top flat mathematical statements, alongside alongside an interactive visualizer of the Lean theorems to aid alongside auditing.

We publish our code, Lean proofs, and records under the Apache 2.0 license. This investigation article is meant to portion intermediate progress, and not a completed investigation agenda. We are sharing this explicitly alongside the goal that others appearance at what we have done, obtain it, and enhance it.

Introduction

When a person sends a petition to an AI model, today they have no way of knowing for certain that the example they selected is the one that generated the response. For mundane uses, in which users mostly attention concerning the output and not necessarily which particular example produced it, this is a small pressing concern. But there are multiple cases anywhere specified assurance would be useful. For example, autonomous evaluators who test AI models before and following publish need to cognize that the example they are evaluating is the example being served. Clients who use a example through a third-party routing assistance desire assurance that the tokens came from the example they paid for. And if a cyberattacker modifies the token stream during pretending to be a stated model, a person has no way to detect it from the output alone.

However, enabling verification of example responses is challenging. Most frontier models’ weights are kept private, and equal if the person had admission to the weights, checking that a stated reply was produced by a example alongside those weights would affect operating the model, which requires computational resources far beyond what a representative person (or equal evaluator) can afford.

The goal of provable inference (PI) is to allow a person alongside constricted computational resources and without any data concerning the weights to verify that a reply came from the requested model. PI is motivated the two by a desire to addition client rely in AI providers, and—because it can be used to provision assurances to autonomous evaluators and allows providers to display that they are gathering certain commitments and lawful obligations—it additionally has implications for pacing the frontier of AI betterment and for AI regulation.

One way to execute PI is via a cryptographic entity called a zero-knowledge succinct argument: the example provider sends, alongside alongside the claimed response, a abbreviated proof (say, a few megabytes) that the person can quickly verify (ideally, in seconds on a CPU). If the claimed reply deviates from the stated model, the user’s inspect volition fail. Importantly, cryptographic techniques justify that the evidence reveals nothing concerning the model’s weights.

Today, we publish FlashProve: an open-source performant prototype for provable inference. For a 400B-parameter mixture-of-experts example (Llama 4 Maverick, 4-bit quantization), we display that a sole H100 GPU generates proofs at complete 100 tokens/second, alongside evidence size of ~19 MB per 1,024-token petition (~70-95 times the GPU period that vLLM, a average open-source library, takes to procedure prompts of the identical length).

The publish comes alongside executable code, Lean formalization, and a specialized clarification of the protocol. Our aim is twofold: (i) accelerating and facilitating the betterment of provable inference; and (ii) demonstrating that zero-knowledge succinct arguments are applicable for provable inference.

We accept that this advancement has meaningful implications for security, in pacing AI development, in providing AI customers alongside integrity guarantees, in facilitating tooling for auditors and regulators, and more.

Trust challenges in AI proliferation

The betterment of synthetic intellect and its expanding function in our digital infrastructure and economics raises trust challenges that AI providers must answer. Addressing these and another challenges is facilitated by relying on tools for provable conclusion (PI).

Tools for PI contain hardware approaches, application approaches, or a blend of both. Here, we concentration on a software-only approach: a cryptographic tool known as a “zkSNARK” (zero-knowledge succinct disagreement of knowledge). Informally, a zkSNARK is a scheme allowing a prover to convince a verifier, by way of a abbreviated “certificate”, that a stated computation was executed correctly; crucially, the certificate is zero-knowledge in that it reveals no data beyond what is implied by the computation’s correctness and is succinct in that it’s exponentially faster to verify compared to the proved computation.

Below we outline multiple challenges and how zkSNARKs assistance in addressing them.

Challenge 1: pacing

Some proposals to regulate and pace AI betterment depend on monitoring hardware and how it is used. For example, a provider power be required to devote its hardware to inference fairly than to training a mighty new model. The provider power try to cheat by serving cheaper models or using compute in an unexpected way, freeing up resources for training. How can a regulator reliably justify that the hardware is used for inference?

How zkSNARKs can help: The regulator can ask the provider for certificates covering the conclusion requests served in a stated period. The certificates must display that the requests were generated by the claimed model. A malicious provider cannot fulfill this petition unless its hardware was genuinely serving the correct model. Using a zkSNARK, the regulator can inspect that the provider claims are valid without needing the detailed hardware setup that the provider may have, and at the identical period the provider has the justify that the regulator does not study proprietary example information. We note that although this verifies that the hardware is serving inference, it does not established that the hardware is not, e.g., training on the side.

Challenge 2: tamper detection

As AI models develop additional valuable, the servers that run them rotate into prime targets. An attacker or rogue delegate may compromise an conclusion server to exfiltrate the weights, assist users malicious responses (such as delivering malware to the user’s computer), and more, all during hiding among genuine responses. The adversary need not be external. As models rotate into capable of improving and deploying themselves, a additional advanced example could run in location of the one that was authorized and current itself as the weaker model, so as to evade the classifiers and monitoring that would use to it. In the two cases the inquiry is the same: how can a business be certain of which weights are really operating on its servers? In our Frontier Safety Roadmap, Anthropic set a public goal to create a prototype for verifying conclusion traffic: “We volition create a prototype by September 30, 2026 of provable inference, a method for reliably, provably ‘signing’ AI example outputs in a way that makes them attributable to a particular set of example weights.” As stated in our RSP updates, we met that goal through a distinct but connected project, which signs our conclusion traffic and recomputes conclusion on a trusted server; the activity in this blog article pursues the identical goal by a distinct method.

How zkSNARKs can help: The provider can necessitate a valid zkSNARK from the server on all response. A evidence is border to a particular dedication to the weights, so it certifies not fair that some example produced the reply but that the committed example did. An attacker who compromises a server, or a example that substitutes itself for another, must afterward create valid proofs for the expected weights to evade detection, which they cannot do. The person may obtain the proofs as well, since they leak no inner data (by zero knowledge) and are cheap to inspect (by succinctness); this limits what an attacker can accomplish through the conclusion API.

Challenge 3: content provenance

One may desire to demonstrate that significant attempt went into understanding/analyzing something. For example, a developer power assertion that their application archive was scanned for vulnerabilities by a frontier cybersecurity model, or a business power assertion that its endeavor scheme was stated the go-ahead by an suitable model. How can a person verify these claims? The person power not have the resources to run the example itself (or they power not have the clearance to do so). Even publishing the conversation logs gives no complete guarantees; a developer power in theory counterfeit them, generating them not alongside a frontier example but alternatively alongside a cheaper one or a degraded version. In general, how can users verify that they are being served by their chosen model?

How zkSNARKs can help: The provider can append, alongside alongside all response, a zkSNARK proving that the output was produced by the claimed example on the stated input. Succinctness lets the person inspect this certificate quickly, without specialized hardware, and zero-knowledge assures the provider that the person learns nothing concerning the proprietary weights. This complements existing mechanisms for verifying which example produced a response.

For example, in a earth anywhere exploits are being established regularly, previous to releasing new code a example provider could provision the code-developer a Proof-of-Failure that the model-provider spent at smallest X tokens on a particular model, and did not accomplish a particular outcome (for example, this particular example did not discover any bugs in a particular patch, following trying for at smallest 1M tokens).

Challenge 4: example approval

Regulation power necessitate providers to serve lone models approved as safe, fairly than models deemed a cybersecurity or safety risk. A provider power have an incentive to circumvent this, since risky models power outperform competitors or be cheaper to serve. How can a regulator justify that only approved models are served?

How zkSNARKs can help: The regulator can necessitate the provider to nexus a zkSNARK to its responses, enforcing the use of approved models. The evidence binds all petition to the used model, so it volition not verify if the provider is using an unapproved model. The regulator can inspect this in a lightweight way gratitude to succinctness without requiring to re-execute all request.

A note on PI from trusted hardware. Prior activity frequently focuses on trusted implementation environments to accomplish PI. These are hardware-based solutions that provision privacy and attestation that depend on the manufacturer producing tamper-resistant hardware. In this research, our concentration is on software-only cryptographic solutions whose safety and privacy relies on the hardness of computational problems. Even in the visage of compromised environments (hardware, functioning scheme and more) an adversary cannot create a invalid evidence without breaking a computationally infeasible problem. Trusted hardware and cryptography are complementary approaches alongside distinct guarantees and tradeoffs. Both volition perform a function in addressing the complete rely challenges.

Our system: FlashProve

FlashProve is a scheme for provable conclusion of ample Mixture-of-Experts (MoE) tongue models. More particulars are in our technical report; current we outline the system.

FlashProve involves two parties: the example provider (the prover) and a person (the verifier). It is divided into two phases:

• In the offline phase, the prover publishes a commitment to the example weights, which is a abbreviated fingerprint to pin downward one exact choice of weights during the weights themselves remain hidden. The afterward conclusion claims volition be checked against that commitment, i.e., the importance example committed to in this phase.
• In the online phase, upon requests from the verifier (i.e., prompts and the corresponding output tokens), the prover produces a evidence document proving the following statement:

The committed example produces these output tokens whenever evaluated.

Anyone who holds the commitment, the prompt, and the answer can inspect it, without the weights and alongside constricted compute power, and be convinced that the committed weights, run on this prompt, create exactly these tokens.

Guarantees

A evidence document satisfies the following “completeness” and “soundness” properties:

• A evidence document is accepted if it is honest (completeness). An honest prover's evidence is accepted by the verifier.
• A evidence document cannot be forged (soundness). It is efficiently unattainable (i.e., tantamount to breaking extensively believed cryptographic assumptions) to create a valid evidence of a false statement, so the verifier does not have to rely the prover.

Completeness and soundness solitary can be achieved by a computationally mighty verifier that knows the example weights (evaluate the example on the immediate and inspect whether the outcome matches the response). The next two properties are what makes the scheme non-trivial.

• A evidence document reveals nothing beyond the declaration (zero-knowledge). The verifier learns nothing concerning the weights, the intermediate values of the computation, or which experts ran at all layer. The example architecture (excluding the weights) is not hidden.
• A evidence document is small and cheap to inspect (succinctness). The attested computation is a run of a 400B-parameter (about 232 GB for a quantized version) example on an H100 GPU, during the verifier receives a evidence document of concerning 19 MB that takes seconds to inspect on a 24-core CPU. An auditor, or a person alongside far small hardware than the provider, can inspect evidence records without admission to detailed infrastructure.

Evaluation

We measured an implementation of the protocol on Llama 4 Maverick (a 400B-parameter blend of experts, alongside ~17B parameters used per token), using the publically accessible 4-bit weights. Each verifier petition is a opening of 1,024 tokens, and all evidence checks one token. The prover runs on a server alongside a sole H100 and 24 CPU cores, and the verifier on a CPU.

• Prover. The prover runs on a server alongside a sole H100 and 24 CPU cores. The offline phase runs formerly per example and takes concerning 39 minutes. (For specialized reasons we conversation in the technical report, the resulting dedication is fine for concerning 16 myriad requests, following which the provider has to commit again.) The online phase, on a lot of 24 requests, takes the prover concerning 223 seconds, which is 110 tokens per second, and all evidence is 18.78 MB.
• Verifier. The verifier runs on the client's CPU. It needs no GPU and lone has admission to a dedication to the weights. The client downloads the commitment, ~6.5 MB in all, and afterward one evidence per request. Checking a evidence takes 17 seconds on 24 threads (and 21 seconds on a sole thread), including the offline phase's checks.

Comparison alongside plain inference: We ran vLLM, a extensively used conclusion engine, alongside the FP8 publish of the identical example on eight H100s, and established that, per GPU, proving a lot of 24 requests takes concerning 72 times longer than vLLM takes to procedure the identical 24 requests at formerly (66 to 77 throughout runs), and concerning 94 times longer whenever vLLM runs at the highest burden we tried.

Inside the system. The underlying scheme rearward FlashProve is a zkSNARK of the benevolent deployed in peer-to-peer systems (e.g., L2 networks specified as Starknet or Mantle for blockchains akin Ethereum). Our zkSNARK is built according to a well-established recipe: an underlying information-theoretic entity called an interactive oracle proof (IOP) is compiled into a cryptographic evidence by relying on hash functions (and offers equal post-quantum security). Our IOP is assembled from state-of-the-art construction blocks using tools specified as code proximity tests alongside linear constraints and lookup arguments, which are according to techniques from coding theory and complexity theory. Combining these pieces into a bespoke IOP for conclusion is a susceptible task; additional particulars concerning the building can be established in the specialized report.

Engineering the system

FlashProve benefits from architectural decisions that we took, and which are discussed in item in the technical report. Here we emphasize a few:

• The prover's activity is proportional to the experts that really ran. In a MoE example a token uses ~17B of the 400B parameters, and the prover's activity per token is proportional to those ~17B alternatively of all parameters (the evidence motionless hides which experts were chosen).
• Requests are proved in batches, following the fact. The prover says completed content in one parallel continue (as in prefill), and it opens the dedication to the weights formerly per lot alternatively of formerly per request.
• The scheme is designed to fit on a sole GPU. The example weights at all tier are divided to segments and are proven one section of layers at a time. The weights are kept in average recollection and streamed in, so a sole 80 GB GPU, alongside ~290 GB of presenter recollection beside it, suffices.

Post-hoc versus in-line

When integrating proving mechanisms into conclusion servers there is a choice: in-line proving (i.e. proving alongside the inference) versus post-hoc proving (i.e. proving after-the-fact, for a subset of tokens). Our scheme follows the latter. In-line solutions are expected to be ultra-fast and may sacrifice safety for efficiency, whereas post-hoc solutions are allowed to be slower and may not endure specified a tradeoff. On the another hand, post-hoc proving has limitations: added complexity of recomputation, the postpone in getting guarantees concerning your traffic, and inherent “non-determinism”. We detailed on the motivation and implications of post-hoc proving in the technical report.

Trustworthiness from ceremonial verification

Cryptographic code is notoriously brittle and error-prone. How can users rely the code we’re releasing today?

The answer is formal verification: we use the Lean evidence aide to define the protocol and the desired safety properties. We demonstrate these properties in a form that is machine-checkable and guaranteed to be accurate (up to compiler errors). We mark three top-level properties:

1. Completeness: if the declaration is correct, the resulting evidence is accepted by the verifier.
2. Soundness: any counterfeit evidence is rejected by the verifier (except alongside negligible probability).
3. Zero knowledge: the evidence reveals no data concerning the weights of the model, beyond what the verifier can infer from the reply itself.

These properties are stated in the so-called random oracle model, an information-theoretic way to analyze cryptographic protocols that depend on hash functions.

Formal verification leaves two crucial rely gaps. First, the ceremonial statements must be audited to justify that they equivalent their intent. This have to be done manually (though it is dramatically small onerous than auditing proofs); we provision an interactive visualizer to assistance alongside this.

Second, the executable code must be audited to justify it matches the formally-defined protocol for which the safety properties are proven. How to finest assistance alongside this depends on the property, since soundness depends solely on the verifier, zero-knowledge depends solely on the prover, and completeness depends on their interaction.

• For soundness, we lone need the verifier code to be accurate (the complete value of having “proofs” is that you can completely distrust the prover if you rely the verifier). We provision an executable Lean verifier, alongside the C++ verifier. The Lean verifier runs additional slowly, but Lean proves that it accepts lone what the verifier in our soundness theorem accepts. Nevertheless, the C++ verifier is the one to use day to day: it carries no ceremonial guarantee, and it agrees alongside the Lean verifier on all evidence in our tests.
• For completeness, the danger example does not assume adversarial attacks (the prover and verifier are honest). Therefore, a Lean verifier lets us acquire confidence through norm application evaluation that the honest prover produces accepting proofs: run the prover on a accurate statement, and afterward the Lean verifier on the resulting proof.
• For zero knowledge, we lone need the prover to be correct. However, dissimilar the verifier, the prover is an costly procedure, and it would be impractical to run a Lean prover. We do not provision facilitations here: we anticipate that any prover that wants to conceal the weights of a example they are serving has admission to adequate resources for careful agentic and/or individual safety audits to justify equivalence to the Lean prover.

Prior work

Achieving provable conclusion is the goal of a row of activity colloquially termed “zkML”. Early works, specified as SafetyNets (2017) verified a two-conv-layer MNIST CNN and a small completely connected address model, zkCNN (2021) reached VGG-16 (15M parameters) at 88.3 s per proof, and Kang et al. (2022) proved MobileNet v2 on full-resolution ImageNet.

Transformer proofs followed: ZKML’s GPT-2 took concerning 159 s per token for 117M parameters (≈0.006 tok/s), and Modulus Labs’ 1.5B-parameter GPT-2 XL needed complete 90 hours. EZKL (2023) proved a 1M-parameter GPT-style transformer in concerning 966 s per token (≈0.001 tok/s). Performance increasingly improved: zkLLM (2024) proved LLaMA-2-13B on a 2,048-token input in concerning 15 minutes on GPU, which is ≈0.001 tok/s per new token, or ~2.5 tok/s in the batch. In 2025, zkGPT reduced GPT-2 to 21.8 s (≈0.05 tok/s), zkPyTorch proved Llama-3 8B at ~150 s per token on one CPU center (≈0.007 tok/s), and ZKTorch proved GPT-J (6B) in concerning 20 minutes (≈0.001 tok/s). VerInf proved Llama 4 Maverick (the identical 400B-parameter MoE example we prove) at ≈0.02 tok/s. DeepProve, a current peer-reviewed province of the art, certifies an complete generated sequence alongside a sole onward pass. It reaches concerning 2.9 tok/s for GPT-2 and 1.4 tok/s for Gemma 3 on one machine, and 31 tok/s distributed. SASH's prover (2026) reached ≈1.25 tok/s on Llama 3.1 8B on a sole H100.

Recently business efforts have reached notable numbers, alongside Attestable proving Gemma 4 31B at 53–77 tok/s on a sole H100; at the period of writing, Attestable has not released a corresponding open origin library.

The complete numbers conversation to the precipitous advancement of provable conclusion in the former years. They should update our priors on what it is imaginable to demonstrate in zero-knowledge.

• In 2024, zkLLM proved a 13B example at concerning 2.5 tokens/second on one A100. The lone before evidence of Llama 4 Maverick that we cognize of, VerInf, reports 14.3 hours for 1,000 tokens on a DGX Spark, alongside a 93.6 GB evidence which took nearly a day to verify.
• FlashProve proves the identical example at 110 tokens/second on a sole H100, alongside 19 MB proofs that can be verified in seconds. Attestable independently reports 53–77 tokens/second for a compact 31B model.

We accept that the advancement should transfer to additional models and architectures, yielding a elastic and mighty tool alongside overhead complete native computation of approximately 2 orders of dimension (about 70 to 95 times in our measurements), much small than earlier expected.

Limitations

This publish is a investigation prototype, and has the following specialized limitations:

• No ceremonial guarantees on accelerated executable code. We provision a Lean implementation of the protocol (including an executable “slow” Lean verifier), alongside alongside safety properties proved in Lean. The document and the accelerated executable code are derived from the Lean protocol, but we do not justify that all three (Lean, paper, code) equivalent all other.
• The evidence is concerning an entire figure example under greedy decoding. We demonstrate an exact entire figure type of the published weights, and a evidence asserts that all checked token is that model’s greedy choice. A answer from a floating-point implementation, or sampled decoding, could depart at several stance and no longer exactly equivalent the computation proved. The entire figure type is mostly expected and empirically tested to be inside several small error charge of true floating-point conclusion generically (even taking into document non-determinism of floating-point computations), although this does not shield adversarially designed prompts.
• Architecture hiding. Our scheme assumes the served example uses a Mixture-of-Experts (MoE) architecture, in which all transformer layer’s feed-forward obstacle is replaced by multiple expert sub-networks and a router that activates lone a small subset of experts for all token and our scheme uses the MoE construction for effectiveness gains. Other architectures, specified as the compact models, are additionally extensively used and its clarification may merge intellectual-property the example provider would akin to keep secret. Indeed, one could additionally ideate a scheme that additional hides the architecture of the model: the prover commits to the two the weights and the architecture (i.e., the “executable code” for inference) via a hiding dedication and the verifier’s assertion is concerning checking the implementation of that committed executable on the dedication model.
• Side conduit attacks. The current justify of the protocol is that the evidence itself reveals nothing concerning the weights of the committed model. However, “side conduit attacks”, specified as measuring the period it takes to create a proof, could possibly disclose data concerning the weights. We regard this out of range for this release.
• Longer contexts. The scheme currently proves conclusion complete contexts of up to 1,024 tokens. This is fairly abbreviated in difference to the contexts accumulated in conversation settings. Ideally, this environment dimension could be risen to complete environment windows for frontier models (which regularly have environment windows of 100s of thousands to millions of tokens).