When using a cloud AI service, one might want to ensure that the provider actually ran the model that was intended.
A substantial amount of research has implemented zero‑knowledge proofs to serve this objective. They are commonly grouped under the acronym zKML (Zero‑Knowledge Machine Learning).
Anthropic has experimented with this through a fully software-based system called FlashProve.
A system viable on MoE architectures
The mechanism makes it possible to demonstrate that a given response is indeed the result of computing a specific model, without revealing its weights.
The server first generates an “engagement”; in other words, a fingerprint that states its exact choice of weights. It then, on a client’s request, produces a proof file.
Anthropic reports performance for a configuration that is well defined. In broad terms:
- MoE model (Llama 4 Maverick) quantized to 4 bits
- Server with 1 H100 GPU and 24 CPU cores
- Output sequences of 1024 tokens processed in batches of 24
The generation of the initial cryptographic fingerprint takes about 39 minutes. This fingerprint weighs a few MB. It is reusable for roughly 16 million requests before needing to be recalculated.
The proof generation throughput is around 110 tokens per second. A proof weighs on average 18.78 MB. Its validation on a single CPU core takes 21 seconds.
Still considerably more compute time than brute-force inference
To enable operation on a single GPU, Anthropic stores the weights in the host RAM, then slices the neural network’s layers into segments on which the GPU acts successively.
The company chose to operate in 4-bit precision, i.e., integer arithmetic, quicker to translate into cryptographic equations. FlashProve also leverages the MoE architecture to prove only the actual computation path taken by the active experts.
Despite these properties, the generation still requires 72 to 94 times more compute time than a brute-force inference with vLLM. This precludes sustained use.
A context limited to 1024 tokens
Anthropic preferred to generate the proof a posteriori rather than on the fly. This option degrades the user experience less while allowing the mechanism to be delegated to dedicated machines. But it introduces technical constraints. For example, since the inference occurred upstream, the server must re-inject inputs and outputs to recalculate internal states and extract the cryptographic execution trace. As for the client, they do not receive the proof instantly (here, for a batch of 24 sequences of 1024 tokens, they must wait 223 seconds).
There is also a risk of divergence for responses produced by floating‑point implementations or by sampling-based decoding (rather than greedy decoding). They could, beyond a certain point, no longer match exactly the proven calculation.
Another limitation: the context size, currently limited to 1024 tokens. FlashProve nonetheless offers intrinsic post‑quantum resistance due to the absence of conventional elliptic curves. It indeed draws on Ethereum Layer 2 rollups.
* With the exception of the commercial Attestable solution, which is proprietary, notes Anthropic.
