What it is
“Proof of inference” refers to a cryptographic method for verifying that a specific AI model actually produced a specific response, without exposing that model’s internal weights. The technique draws on zero-knowledge proofs (zk-SNARKs) — the same branch of cryptography used in privacy-preserving blockchain systems — adapted to the very different problem of attesting to a neural network’s computation.
The mechanics work in two stages. First, a model provider publishes a “commitment”: a short cryptographic fingerprint that pins down one exact, unchanging set of weights, while the weights themselves stay hidden. Second, for every individual response the provider generates, it also produces a cryptographic proof that the committed model — and no other — generated that specific output from that specific input. Anyone holding the commitment, the prompt, and the response can check the proof mathematically, on an ordinary computer, in seconds. They do not need the weights, and they do not need to re-run the model themselves.
The clearest public demonstration of this to date is FlashProve, a research system Anthropic released on November 2, 2026. Tested against Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, FlashProve generated proofs at roughly 110 tokens per second on a single Nvidia H100 GPU — 70 to 95 times slower than ordinary inference on the same hardware — producing a proof file of about 18.78 megabytes per 1,024-token exchange. Verifying that proof took about 17 seconds on an ordinary 24-thread CPU. Anthropic published the system, its technical specification, and its code openly, and had the core security properties of the proof machine-checked in the formal-verification language Lean.
Why it matters for AI governance and narratives
The technique targets a specific trust gap in the AI supply chain: once a user sends a prompt to an API, they generally have no way to confirm which model actually answered. A provider under margin pressure can quietly substitute a cheaper, lower-quality model for a flagship one it advertises — and nothing in an ordinary API response would reveal the swap. The same gap enables the “shell model” trade the Narrative Observatory’s editorial flagged: a reseller selling access to a premium model’s reputation while actually routing some or all traffic through a cheaper substitute, undercutting both the model owner’s pricing and its users’ expectations.
Proof of inference reframes this as a verification problem rather than a trust problem, which matters for how AI governance debates are framed. It offers regulators and auditors a mechanism to confirm that a deployed system matches what was approved or certified, without demanding that a lab surrender proprietary weights — potentially easing the tension between transparency mandates and trade-secret protection that runs through much of the current AI Act and export-control discourse. It also gives competitive dynamics a new axis: labs that adopt verifiable inference can make authenticity itself a selling point, while resellers that can’t or won’t be verified face a credibility question they didn’t face before.
Key facts and dates
Anthropic published FlashProve and an accompanying research write-up, “Progress on provable inference for large language models,” on November 2, 2026, describing it explicitly as a research prototype rather than a deployable product, with the GitHub repository (anthropics/FlashProve) labeled “not maintained, not accepting contributions.” The work was developed with outside cryptography researchers from EPFL, MIT, StarkWare, and Succinct. Anthropic stated it has no current plans to deploy the system in its own products or require it of other labs.
The prototype carries acknowledged limits: it has only been demonstrated on short, 1,024-token contexts; it proves an idealized integer model under greedy decoding, which may diverge from floating-point production implementations; it does not hide the model’s architecture, only its specific weight values; and only the formal Lean verifier — not the faster production code — has been mathematically checked for correctness. The roughly 70-95x computational overhead over standard inference is the central practical obstacle to real-world deployment, a limitation shared by earlier, related zero-knowledge machine learning (zkML) research efforts cited in the academic literature.
Where to learn more
- Anthropic: “Progress on provable inference for large language models” — the primary research announcement, with full technical detail on the commit/prove/verify scheme and stated limitations.
- GitHub: anthropics/FlashProve — the open-sourced code and technical specification, released under Apache 2.0.
- TechCrunch: “Anthropic is working on a system to prove AI models’ identity” — independent coverage contextualizing the release for a general audience.
- MarkTechPost: “Anthropic Releases FlashProve: Cryptographic Proofs That a Reply Came From Committed Weights” — technically detailed secondary coverage of the release.