Anthropic has personally put an end to "wrapper AI", stripping off the disguise of fake models in just 17 seconds, with a verification speed 5000 times faster.

You pay the price for a top-tier flagship model, but are routed to a resold API, while the model actually running in the background may be a cut-down small model.

This kind of under-the-table operation of false labeling used to be the most hidden gray area in the entire large model API supply chain.

With no access to model weights or server rooms, developers can only suffer in silence even if their service provider secretly swaps the model for an inferior one in the middle of the night.

Today, this opaque chain has been completely cut off!

Just now, Anthropic, in partnership with a pioneer scholar of zero-knowledge proofs, announced a major breakthrough in "provable inference" for large models, and officially open-sourced the cryptographic verification system FlashProve!

From now on, developers do not need to trust any centralized institution, nor do they need service providers to hand over a single line of weight code. Every response generated by the large model will be forcibly attached with a mathematical-level "birth certificate".

Even if you only have an ordinary home CPU and run it for 17 seconds, you can accurately verify in a purely mathematical way whether each Token is "genuinely generated" by the target model, and any trick of swapping models or tampering midway will be exposed on the spot!

What's even more impressive is that the core team that built FlashProve is none other than Claude itself.

This time, all codes, Lean proofs, and technical documents are fully open-sourced under the Apache 2.0 license.

Portal: https://github.com/anthropics/FlashProve

Fingerprint Registration, Proof Generation, Second-level Verification

Put an End to "Shell Swapping" of Large Models

When people feel that a large model suddenly "gets dumber", many will question the model "Who on earth are you?" or throw several math problems to test it.

But the self-introduction sentence output by the model itself is generated by the background, and tiny fluctuations in computing power load and sampling configuration will also change the response, so users can never get irrefutable evidence that can nail the service provider.

The even more unsettling scenario is written in Anthropic's blog —

As models become more powerful and capable of self-deployment, a more advanced model can completely replace an approved weak model to work, and pretend to be the weak model to evade the monitoring that should be imposed on it.

To verify the authenticity, the traditional way is only to get the weights and re-run the model by yourself, but the weights of cutting-edge models are the lifeline of every company, and ordinary people cannot afford the server room required to run a 400-billion-parameter model at all.

To solve this deadlock without accessing the weights or re-running the model, FlashProve splits the verification process into three interconnected steps.

Step 1: Offline "Fingerprint Registration".

Before the model goes online, the service provider spends about 39 minutes on a single H100, uses zero-knowledge encoding to generate a unique commitment ID for the model weights and makes it public to the entire network. This ID is like a digital DNA fingerprint of the weights — even if you secretly change one parameter, it will not match; but outsiders can never reverse-engineer what the weights look like just by looking at the fingerprint.

Step 2: Online "Proof Generation".

After processing each dialogue request, the service provider's GPU will automatically generate a cryptographic proof of about 19MB, to confirm that this output is indeed calculated by the model that has completed the fingerprint registration.

Step 3: Client-side "Authenticity Verification".

After any user or audit institution gets the response, they can run the verification program cp_verify on an ordinary CPU, and get a "True" or "False" verdict in 17 seconds. The entire process requires neither weights nor a GPU.

The underlying engine that powers this magic is the well-known zkSNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) in the cryptography community.

Verifiers only need to randomly check a few parts like a teacher checking homework, and they can catch any flaw with a very high probability.

To split a single inference into a form that can be spot-checked, about 2000 sub-protocols named sumcheck need to be run behind each request.

What's more hardcore is that its security only relies on the hash function BLAKE2, does not depend on algebraic structures such as elliptic curves, and is even considered to be able to resist attacks from future quantum computers. This cryptographic route has long been proven in practical scenarios on Ethereum Layer 2 networks such as Starknet.

Now that the principle is clear, the real difficulty comes next: can such a heavy proof run on a large model with 400 billion parameters?

Single H100 Surges 5500x in Performance

80GB VRAM Accommodates the 400-Billion-Parameter Giant

The answer is: Yes, and it only takes one H100.

The team tested Meta's Llama 4 Maverick, a 400-billion-parameter Mixture of Experts (MoE) model that actually activates about 17 billion parameters for each Token.

FlashProve makes full use of this feature: when the prover generates the computation trace, the workload is only proportional to the 17 billion parameters that are actually doing the work, saving more than 95% of the invalid redundant computation.

What's even more clever is that, to prevent outsiders from reverse-engineering the secret of model weights through "which experts are activated", the system uses zero-knowledge encoding to hide the routing selection in an indicator vector. When verifying, the verifier performs weighted summation on all experts, which not only saves a huge amount of computing power, but also keeps the internal operation path of the model confidential.

The 4-bit quantized weight of the model is as large as 232GB, while the VRAM of a single H100 is only 80GB, and forcing it to load will immediately cause a VRAM overflow.

If the computation trace of the entire inference process is packaged at one time, even the most high-end graphics card cannot handle it.

Therefore, the team places the weights in the host memory, sends them to the GPU in segments, and completes the computation and proof for each segment one by one.

When working, the H100 works like an assembly line: it only reads a segment of weights from the memory in a streaming manner each time, immediately completes encoding, hashing and reduction in the VRAM after the computation is finished, and only retains a very small amount of data that needs to be passed to the next segment.

With this streaming relay of "process one segment, finish one segment", a single 80GB graphics card managed to handle the 232GB behemoth.

114-Page Paper That No Human Can Read Through

Claude Completes 400MB of Mathematical Proofs

At this point, you may be curious: how many cryptography PhDs have devoted their efforts to such a precise and complex cryptographic protocol and GPU acceleration project.

When you open the GitHub open-source homepage of FlashProve, the language statistics bar on the right immediately reveals the unusual nature of this project.

In the entire repository, C++ code only accounts for 1.4%, Python accounts for 1.3%, CUDA accounts for 0.9%, and as high as 95.2% of the code (a full 398MB) is written entirely in the Lean 4 mathematical proof language.

Why is a large model inference repository stuffed with nearly 400MB of mathematical proofs? The 114-page protocol specification paper attached to the repository gives the answer on page 51.

Human scholars are only responsible for pointing out the direction in this project. From this 114-page cryptography paper, 23-page technical report, to the underlying C++ and CUDA code, and then to the nearly 400MB of Lean formal proofs, almost all of them are completed by Claude.

Not only writing code and papers, every test, run, comparison, calculation and code review in the project is also done by AI; wherever the text says "read through", "manually calculated" or "reported", the reader, calculator and reporter are all AI.

Cryptographic code has always been the most fragile restricted area in software engineering. Even if one symbol is written backwards or one random number mask is omitted, the entire security building will collapse instantly.

Claude is very good at finding optimization paths in huge systems, but human experts cannot possibly review thousands of complex decisions it makes at the bottom line by line with naked eyes.

Since humans cannot review all the content, Anthropic simply invites Lean 4, the impartial judge in the mathematics field.

Here, every step of mathematical derivation written in must be checked line by line by the compiler kernel, and you cannot pass if there is even one mistake.

Throughout the entire project, human scientists have saved the hard work of reviewing hundreds of millions of lines of intermediate derivations, and only worked with AI to finalize the top 6 security definitions, making three things ironclad rules.

• Completeness. As long as the service provider runs the model honestly according to the promised weights, the generated proof will definitely pass the verification, and the probability of being mistakenly rejected is less than one in a trillion.
• Soundness. If the service provider pretends to use a fake model, or even modifies one Token, the probability of the fraud passing the verification is less than 1 over 2 to the power of 100, which is mathematically equivalent to impossible.
• Zero-knowledge. No matter how many times the client verifies with the proof, the proof file will never leak any information about the model weights.

As long as these top-level theorems are "correct", even if humans don't look at the nearly 400MB of tedious reductions at all, the kernel of Lean 4 has already taken charge of the verification for humans.