智东西（公众号：zhidxcom）
编译 | 孙小雯
编辑 | 程茜
智东西11月4日消息，今天凌晨，Anthropic开源大模型可证明推理系统FlashProve，详细技术报告于11月2日发布。服务商可通过该系统为模型回答生成密码学证明，用户无需获取模型权重或自行运行大模型，就能在CPU上核验输出是否符合指定模型的计算结果。
模型调用API的机制类似黑箱，发送提示词后，用户仅能查看生成的Token，但无法验证为自己提供服务的是否为所选模型。此次开源的FlashProve旨在解决这一问题，上可抓“模型掉包”，下可验“回答篡改”，还可为监管机构提供监测服务商和企业AI使用合规性的渠道。
该模型一经发出，X上的外网网友就火速贡献梗图。
▲X上网友评论：FlashProve揭开面具，旗舰模型竟是廉价模型（图源：X）
根据Anthropic公布的测试结果，FlashProve已在Meta发布的4000亿参数模型Llama 4 Maverick上完成测试，使用单张H100 GPU生成证明，单个请求的证明文件约19MB，用户端使用24线程CPU核验约需17秒，无需GPU。
此前，开源系统VerInf也曾为Llama 4 Maverick生成证明。据其公布的测试结果，在单台DGX Spark上，为1000个Token的前向计算生成证明约需14.3小时，证明文件达93.6GB，使用20个CPU核心核验约需17.7小时。
虽然两项测试的硬件与证明任务设置不同，但从各自公布的结果来看，FlashProve的证明文件更小，用户端核验耗时也大幅缩短。
不过，FlashProve目前仍是需要服务方配合的研究原型，生成证明的GPU时间开销约为普通推理的70—95倍。也有网友疑虑：谁会愿意为此高昂价格付费？
▲X上网友的评论（图源：X）
FlashProve的核心技术是零知识简洁非交互式知识论证（zkSNARK），即在不额外泄露模型权重信息的情况下，用户可以用较小文件、较低开销，独立核验推理过程的正确性。
▲证明系统的完备性、可靠性、简洁性与零知识性（图源：Anthropic）
Anthropic此次同步公开了技术报告、协议规范、证明生成器、C++与Lean两种验证器以及用Lean编写的形式化证明。其中，代码、Lean证明和文档均以Apache 2.0许可证开源。
Anthropic透露，Claude也参与了用于推理的zkSNARK技术优化。此次FlashProve的开源旨在展示当前可证明推理技术的阶段性进展，供其他研究者复现和改进。
▲FlashProve开源主页（图源：Github）
开源地址：
https://github.com/anthropics/FlashProve
一、单张H100可批量生成24份证明，耗时不到四分钟
FlashProve的运行分为离线准备和在线证明两个阶段，由模型服务方准备权重承诺、生成证明，再由用户通过验证器核验。
据技术报告介绍，离线阶段，服务方先对模型权重进行编码，生成密码学承诺。密码学承诺相当于为一组权重建立“指纹”，后续证明均与这份承诺绑定，确保核验对应同一组权重。
▲FlashProve离线准备流程（图源：Anthropic）
在线阶段，服务方根据输入和待检查输出，记录模型推理中的计算轨迹，包括矩阵乘法、取整、非线性运算等，再生成证明，说明这些运算使用了承诺中的权重，并按指定规则得到了相应输出。
用户持有权重承诺、输入、输出及对应证明，就可以通过验证器检查输出是否符合这组权重的计算结果。这份密码学证明同时具有零知识性（Zero knowledge）和简洁性（Succinctness）：前者使证明不额外泄露权重、中间计算值和专家选择等信息，后者让客户端以远低于自行运行模型的计算开销完成核验。模型架构本身不隐藏。
▲FlashProve在线证明与核验流程（图源：Anthropic）
在Llama 4 Maverick测试中，离线准备耗时约39分钟，服务方保存约2.15GB文件。客户端首次下载权重承诺、离线证明及一个链接证明，共6.24MB。这些准备工作可以复用，之后再为每个请求下载证明文件。
在降低证明开销方面，FlashProve主要从模型结构、显存使用和批处理三方面进行优化。
Llama 4 Maverick采用混合专家（MoE）架构，每个MoE层从128个路由专家中选择1个运行，另有1个共享专家。因此，每个Token约激活4000亿参数中的170亿。FlashProve只在计算轨迹中记录实际运行的专家及其选择，使相应证明工作量随激活参数规模变化，同时核验路由器是否选对专家。
▲FlashProve利用MoE稀疏激活减少证明计算，同时检查路由选择，并隐藏实际运行的专家（图源：Anthropic）
系统还将模型层和计算轨迹分段处理，约232GB权重保存在主机内存中，再逐段加载至GPU。按公告披露，一张80GB显存的GPU配合约290GB主机内存，即可运行系统。
在批处理方面，FlashProve一批最多可处理64个客户端请求。各请求的部分证明步骤在GPU上并发执行，整批请求共享用于核验权重承诺的查询数据，减少重复工作。
技术报告显示，研究团队在单张H100及24个CPU核心上测试了批处理效果，使用第三方公开的4比特权重，并将其转换为整数模型。每个请求包含1024个Token的窗口，主测试每份证明只检查紧随提示词之后的一个输出Token，确认它是已承诺模型在该位置得分最高的选择。测试以128位安全强度为目标。
逐个处理请求时，生成一份证明约需58秒；每批处理24个请求时，总耗时约223秒。按请求窗口中的全部Token统计，证明生成的处理吞吐由每秒17.6个Token提高至110个Token。
研究团队还测试了检查回复中每个Token的情况，证明生成耗时未出现可测差异。若只统计该测试中被检查的回复Token，吞吐约为每秒39.1个Token。
二、防止模型被“掉包”、输出遭篡改，四类情形分别怎么验？
Anthropic在公告中提出，模型服务中有几类难以核实的情况。例如，开发者声称用前沿模型检查过软件漏洞，但聊天记录不足以证明实际调用的是哪款模型；推理服务器遭到入侵后，攻击者还可能将恶意内容混入正常回答。
Anthropic设想，FlashProve可通过密码学证明，辅助确认模型有没有被“掉包”、回答有没有被篡改、服务商是否使用通过安全审批的模型，以及企业是否执行了申报的推理任务。
第三方API客户和独立评测者可以据此核对实际使用的模型，监管机构则可检查服务商是否遵守模型使用要求。对于要求企业将硬件用于推理、而非训练更强模型的政策提案，监管机构还可要求企业提交某段时间的推理证明，辅助管控AI发展节奏。但这些证明只能说明相关推理确实发生，不能排除企业同时训练其他模型。
此外，模型未能取得指定结果时，服务方也可以证明相应尝试确实发生过。Anthropic在公告中举例设想，代码发布前，服务方可以提供“未取得指定结果的证明”：例如证明某款模型针对指定补丁尝试了至少100万Token，仍未发现漏洞。
三、证明耗时仍为普通推理数十倍，三方面限制尚待解决
要将上述核验方式用于实际服务，FlashProve还面临证明生成开销、验证范围和安全实现三方面限制。
限制一：生成证明开销高，事后核验存在延迟
相比直接运行模型，生成密码学证明需要更多算力。技术报告显示，研究团队在8张H100上，通过vLLM运行同一模型的8位浮点（8-bit floating point，FP8）版本进行对照。
按每张GPU折算，FlashProve为24个请求生成证明的GPU时间开销约为vLLM处理相同请求的预填充（Prefill）阶段所用GPU时间的72倍；在测试的最高负载下约为94倍。
为避免用户等待证明生成，FlashProve采用事后证明（Post-hoc proving）方式，先返回回答，再由独立硬件根据完整记录重新计算、生成证明。
但事后核验存在延迟，用户可能在发现篡改前就收到恶意回答；已经通过回答泄露的信息，也无法撤回。
▲FlashProve采用事后方案，先返回回答，再生成证明，核验结果存在延迟（图源：Anthropic）
限制二：上下文最长1024个Token，计算方式差异影响核验
FlashProve目前支持的上下文最长为1024个Token，而前沿模型的窗口通常达到数十万乃至数百万Token，长对话等场景仍难以覆盖。
此外，FlashProve验证的是整数模型（Integer model）在指定位置选择得分最高Token的结果。实际服务采用浮点推理（Floating-point inference）或采样解码（Sampled decoding）时，可能产生不同输出。因此，发现输出不一致时，还需区分计算方式差异与回答篡改。
▲浮点模型回答“煮7分钟”，整数模型选择“煮8分钟”（图源：Anthropic）
限制三：实际代码和批量处理的安全性尚未得到完整证明
技术报告显示，高性能可执行代码尚未获得与Lean协议同等的形式化安全保证。因为现有证明针对Lean描述的协议，而实际运行的GPU和CPU代码由AI据此生成，两者的等价性尚未得到证明。
此外，批量处理请求时的零知识性（Zero knowledge）尚未完成形式化证明（Formal proof）。目前，已完成的相关证明只覆盖逐个请求处理的情形，尚未扩展至多个请求共同处理的情况。
▲Lean协议、形式化证明与可执行代码的关系（图源：Anthropic）
结语：FlashProve补齐推理核验，有望增强企业客户信任
模型身份核验已吸引多家公司入局。今年2月3日，美国AI隐私服务商Tinfoil介绍了Modelwrap方案，通过安全硬件与权重承诺核验模型身份。今年8月，以色列AI安全公司Attestable公开了面向大模型的零知识推理证明方案，目前公布的测试结果已覆盖Gemma 4 31B。
Anthropic推进这项研究，也有自身的安全考虑。该公司此前在安全路线图中提出，要确认模型输出对应的是指定权重，降低攻击者入侵后修改模型的风险。此次开源FlashProve，就是尝试通过纯软件的密码学方案解决这一问题。
对企业客户来说，付费调用的模型有没有被替换、评测时的版本和实际服务是否一致，都会影响采购和使用决策。如果后续能降低证明开销、接入实际服务，FlashProve就能让客户和评测者多一种独立核验的手段。这也有望成为Anthropic争取企业客户的一项优势，尤其是对服务可靠性和审计有较高要求的客户。
来源：Anthropic
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Intellectual (WeChat Official Account:zhidxcom)
Compiled by Sun Xiaoxuan
Editor, Concubine.
In the early morning hours of today ' s morning, the source LLM of Anthropic proved the reasoning system FlashProve, with a detailed technical report dated 2 November publish. The service provider can generate a password certificate for the model response through the system, and users can verify on the CPU that the output is consistent with the calculation of the specified model without having to obtain model weights or run LLM on their own.
The model calls an API-like black box, sending prompt, and the user can only view the generated Token, but is not able to verify whether the model is selected for service. This open-source FlashProve is designed to address this problem by capturing “model swaps” under which “response tampering” can be tested and by providing regulators with channels for monitoring service providers and business AI to use compliance.
Once the model has been sent out, the offline Internet users on X contribute at speed.
▲XA: FlashProve unmasked and the flagship model is a cheap model (source: X)
According to tests published by Anthropic, FlashProve has completed testing on Llama 4 Maverick, a model of 4000 billion parameters of Metapublish, using a single H100 GPU to prove that the individual requested documentation is approximately 19MB and that the user-end uses a 24-line CPU to verify approximately 17 seconds without GPU.
Previously, the open-source system VerInf also produced certificates for Llama 4 Maverick. According to the results of its published tests, it took approximately 14.3 hours for 1,000 Token's forward calculation certificates to be produced on single DGX Spark and 93.6 GBb for documentation and 17.7 hours for core verification of 20 CPUs.
Although the hardware for the two tests differs from the supporting tasks set, the results of the respective releases show that FlashProve has smaller supporting documents and significantly shorter user-end verification time.
However, FlashProve is still a prototype of research that requires the cooperation of service providers, generating proof that GPU time costs about 70-95 times the normal reasoning. On the other hand, there is a doubt among the netizens: who would like to pay a high price for paid?
Comments from online users (source: X)
The core technology of FlashProve is the zero-knowledge, non-interactive knowledge demonstration (zkSNARK), whereby users can independently verify the validity of the reasoning process with smaller documents and lower costs without additional disclosure of model weight information.
Proof of completeness, reliability, simplicity and zero knowledge of the system (source: Anthropic)
Anthropic simultaneously released the technical report, protocol specifications, certification generator, C++ and Lean certifiers, as well as formalized certificates prepared by Lean. Of these, codes, Lean certificates and documents are open with Apache 2.0 license.
Anthropic revealed that Claude was also involved in the technical optimization of zkSNAK for reasoning. The open source of this FlashProve is intended to demonstrate the current state of progress in supporting reasoning techniques for replication and improvement by other researchers.
Open Source Home Page of FlashProve (source: Github)
Open source address:
https://github.com/anthropics/FlashProve
I. A single H100 batch generated 24 certificates, which took less than four minutes
FlashProve operates in two stages, offline preparation and online certification, with model service providers preparing weight commitments, generating certificates, and users verifying through the certification.
According to the technical report, during the offline phase, service providers code the weight of the model to generate a password commitment. Password commitments are equivalent to the creation of “fingerprints” for a set of weights, and subsequent certifications are tied to that commitment to ensure that the same weights are matched by verification.
▲FlashProveoffline preparation process (source:Anthropic)
In the online phase, service providers record the computational tracks in model reasoning, including matrix multiplication, extraction, non-linear calculations, etc., based on input and output to be checked, and generate evidence that these calculations use the weights in the commitment and are outputed accordingly according to the specified rules.
The user holds a weight commitment, input, output and matching certificate to check whether the output corresponds to the calculation of this weight set by means of a certifier. This cipher certificate is both knowledge-free (Zero knowledge) and concise (Succinctness): the former allows proof of non-disclosure of additional weights, intermediate computations and expert selections, while the latter allows the client to verify the calculation costs far below those of the self-run model. Model architecture itself is not hidden.
▲FlashProve online certification and verification process (source:Anthropic)
In the Llama 4 Maverick test, offline was prepared for approximately 39 minutes and the service kept approximately 2.15 GB files. Client's first download weight commitment, offline certificate and a link certificate totalling 6.24MB. These preparatory work can be reused and the supporting documentation downloaded for each request.
In reducing the cost of certification, FlashProve has been optimized mainly from model structures, the use of VRAM and batch processing.
Llama 4 Maverick uses a hybrid specialist (MoE) structure, each MoE layer selects one of the 128 routers and a shared expert. So each Token activates about 17 billion of the 400 billion parameters. FlashProve records only the actual operating experts and their selection in the computation trajectory, allowing corresponding proof of workload to change with the size of the activated parameters, and verifying whether the router is the expert.
▲FlashProve uses MoE ' s thin-activated reduction certificate calculation, while checking route selection and hiding actual operating expert (source: Anthropic)
The system also handles model layers and computational trajectories with approximately 232 GB weights stored in the host memory and loaded to GPU. As disclosed in the bulletin, a GPU of 80GBVRAM can run the system with approximately 290GB mainframe memory.
For batch processing, FlashProve has a portfolio of up to 64 client requests. Some of the supporting steps requested are carried out on the GPU, and the bulk of requests are for the sharing of query data for the verification of weighting commitments and the reduction of duplication of effort.
The technical report showed that the research team tested batch effects on single H100 and 24 CPU cores, using a third-party public privilege of four times weight and converting them into integer models. Each request consists of 1,024 Token windows, and each certificate from the primary test only checks one output after prompt, confirming that it is the highest score for the promised model in that position. The test targeted 128-bit security intensity.
When processing requests on a case-by-case basis, it takes approximately 58 seconds to generate a certificate; the total time taken to process 24 requests per batch is approximately 223 seconds. The total number of tokens in the requested window shows that the amount of processed vomiting generated increased from 17.6 to 110 to 110 to 110 per second.
The team also tested the situation of each token in the inspection response, proving that there was no measurable difference in the generation time. If only Token, which was examined in the test, was counted, it was about 39.1 Tokens per second.
To prevent the models from being “repacked”, the output from being tampered with, and how are the four categories examined?
In its bulletin, Anthropic suggested several types of model services that were difficult to verify. For example, the developers claimed to have examined the software loopholes using front-line models, but the chat records were not sufficient to prove which model was actually being called; following the invasion of the reasoned servers, the attackers may have mixed malicious content into normal answers.
Anthropic envisages that FlashProve can pass a password certificate to assist in verifying whether the model has been “repackaged”, answering whether it has been tampered with, whether the service provider has used the security clearance model, and whether the enterprise has performed the reasoning of the declaration.
Third-party API clients and independent evaluators can check the models actually used, and regulators can check whether service providers comply with model use requirements. For policy proposals that require companies to use hardware for reasoning rather than training stronger models, regulators may also require firms to submit a time-bound certificate of reasoning to complement the AI development rhythm. These certificates, however, only show that the relevant reasoning does occur and do not preclude the enterprise from training other models simultaneously.
In addition, when the model fails to produce a specified result, the service provider can prove that the corresponding attempt actually took place. In its bulletin, Anthropic envisages, for example, that before code publish, the service provider can provide “certification that no specified result has been obtained”: For example, proof that a model tried at least 1 million Token for a specified patch has still not been found.
III. Proof that time-consuming remains dozens of times the normal reasoning, and the three-pronged limitation remains to be resolved
In order to apply the above-mentioned verification methods to actual services, FlashProve also faces three-fold constraints to certifying the generation of expenses, certification coverage and security.
Limitation 1: Proof of high cost and delay in ex post facto verification
Generating a password certificate requires more computing power than directly operating the model. The technical report showed that the research team compared the eight-bit floating point (8-bit floating point, FP8) version of the same model on 8 H100.
For each GPU, FlashProve spent approximately 72 times on GPU time for the prefilling (Prefil) phase of v LLM processing of the same request for 24 requests for the production of certificates; approximately 94 times under the maximum load tested.
In order to avoid the user waiting for the certificate to be generated, FlashProve returns the answer by means of Post-hoc documentation, which is then recalculated and generated by independent hardware on the basis of complete records.
However, there was a delay in subsequent verification, and the user might have received a malicious reply before the tampering was discovered; the information had been leaked and could not be withdrawn.
▲FlashProve uses an after-action scheme to return the answer and then generate proof that there is a delay in verifying the results (source: Anthropic)
Limitation II: context maximum 1,024 Tokens, effect of variations in calculation Nuclear Check
FlashProve currently supports a maximum of 1,024 Tokens for context, while front-line models typically have windows of hundreds of thousands or millions of Tokens, which are still difficult to cover, such as long conversations.
In addition, FlashProve validated the result of the Integer model selecting the highest Token score at the given location. Different outputs may be generated when the actual service uses floating-point inference or sampling decoded. Therefore, when discrepancies in output are found, it is also necessary to distinguish between differences in methods of calculation and tampering with answers.
The oscillation model answers "Cook 7 Minutes" and the integer model selects "Cook 8 Minutes" (source: Anthropic)
Limitation III: The security of actual codes and batch processing is not fully proven
Technical reports indicate that high performance enforceable codes have not yet received the same formalized security assurances as the Lean agreement. The equivalent value of GPUs and CPUs has not yet been proven because of existing protocols that have been certified against the description given by Lean and because the actual GPU and CPU codes are generated by AI.
In addition, the formalization of the Zero Knowledge certificate (Formal proof) was not completed for the bulk processing of requests. Currently, the completed certificates cover only the case-by-case processing of requests and have not yet been extended to the case of multiple requests.
▲Lean protocol, formalization certificate in relation to enforceable code (source: Anthropic)
Conclusion: FlashProve completes the reasoning check and is expected to increase the trust of business clients
Model identification has attracted many companies. On 3 February this year, Tinfoil, an American AAI privacy service provider, presented the Modelwrap programme, which verified model identities through security hardware and weight commitments. In August this year, Attestable, an Israeli security company, published a zero-knowledge proof programme for LLM, and the test results currently published have covered Gemma 4 31B.
Anthropic advanced the study with its own security considerations. It had previously proposed in the security road map that it should confirm that model outputs correspond to assigned weights and reduce the risk of modifications to the model by the assailants after the invasion. This open source, FlashProve, is an attempt to solve this problem through a purely software password programme.
For business clients, the replacement of the model called by paid, the evaluation of the quality of the version and the consistency of the actual services will influence procurement and use decisions. If subsequent reductions in the cost of proof and access to actual services were to be achieved, FlashProve would allow clients and evaluators to have an additional means of independent verification. This is also expected to be one of the advantages of Anthropic in reaching out to business clients, especially those with high requirements for reliability of services and auditing.
Source: Anthropic
Auto-fetched and translated by AI Atlas. All rights belong to the original author.