Anthropic微微发力，AI中转站的天就要塌了？

Anthropic微微发力，AI中转站的天就要塌了？

你付钱调用的那个 AI，真的是商家承诺的那个模型吗？

比如，一个第三方平台声称接入了旗舰模型，后台却换成便宜的小模型、旧模型，光看回答的语气和质量，我们很难判断；又或者是同一道题目，官网能做出来，用中转站却卡住了。

不少通过第三方 API、聚合平台或中转服务调用模型的国内用户来说，这大概是经常需要面对的问题。

一个看起来简单的模型请求，背后需要经过「用户—中转站—上游服务商—模型」多个环节，只要其中一环缺少透明度，我们就很难确认自己买到的，是不是标价对应的模型。

Anthropic 近日发布的一项研究，试图把这个只能靠口碑、截图和体感争论的问题，变成一个可以数学验证的问题。

这套名为 FlashProve 的开源研究原型，可以为模型推理生成密码学证明。它尝试让服务商为模型的计算结果提供密码学证明，用户不用拿到模型权重，也不用自己再跑一遍大模型，就能核验。

不公开模型，也能证明「你就是你」

除了使用模型厂商官方的应用，和从官网调用 API 进行对话，我们能确认使用模型的情况。在大多数的 API 调用里，我们提交问题，服务器返回回答，模型世界上是跑在了远程的机器上，我们无法得知后台究竟进行了那些计算。

斯坦福大学的研究项目《Model Equality Testing》曾经就测试过 2024 年四款 Llama 模型的 31 个商业 API 端点，发现其中 11 个端点的输出分布，与 Meta 发布权重的参考分布存在统计差异。

同一个模型名字，有时候并不能对应同一种表现。即便在服务页面挂着的都是 Opus 5.5，但根本无法保证用户获得完全相同的模型。

有时候我们想着可以靠几个问题来鉴别模型，就像最近内测 Opus 5.5 一样，有网友说问他 2026 年 5 月，Karpathy 去了哪里，如果模型答不出他去了 Anthropic，那就是没有被测试到。

但靠这些问题来鉴别模型，还会遇到模型厂商自己路由的问题，往往很难直接定位原因。像是碰巧答错、参数不同、上下文没传完整，和后台换了模型，最后都可能表现成一句「怎么变笨了」、「这不是我想要的模型吧」。

FlashProve 的核心，是一种名为 zkSNARK 的零知识简洁证明技术。

首先，模型服务商为权重生成一个「承诺」，它类似一组密码学指纹，能够唯一锁定特定权重，却不会公开权重本身。

随后，服务商针对给定的输入与待检查输出，生成一份证明，核验这些输出是否符合事先约定的模型计算。用户拿到模型承诺、提示词、回答和证明文件，就可以在自己的电脑上检查：这套被锁定的权重处理这段输入时，是否确实会产生这些输出。

如果中转站偷偷换了一套模型，或者有人修改了输出，证明便无法与原来的模型承诺对应。

这里用到的零知识证明也很重要，目的是为了让验证者在确认计算结果时，却不会因此获得模型权重、中间计算值，以及 MoE 模型在各层调用了哪些专家。

这也解释了它为什么比「让 AI 自报家门」可靠，回答里写了什么模型名字，不再充当身份证明，检查的是输出与指定权重之间的计算关系。

一台笔记本就能核验

过去，为大模型生成零知识证明的最大障碍是成本，证明过程可能比普通推理慢上几个数量级，证明文件也可能非常大。

Anthropic 使用公开 4-bit 权重的 Llama 4 Maverick 进行实验。这是一个拥有 4000 亿参数的混合专家模型，每个 token 实际激活约 170 亿参数。根据 Anthropic 公布的数据：

- 单张 H100 生成证明的吞吐量约为 110 tokens/秒；

- 每个 1,024-token 请求的证明约为 19 MB；

- 验证不需要 GPU，在 24 线程 CPU 上约需 17 秒，单线程约需 21 秒；

- 模型权重的初始承诺只需生成一次，耗时约 39 分钟。

不过这里的 110 tokens/秒是证明生成速度，不是用户聊天时的模型输出速度。证明依然昂贵，在 Anthropic 的对比条件下，其 GPU 时间约为普通 vLLM 推理的 70～95 倍。

即便不是免费，但这套方案，以及把一种过去近乎难以承受的验证方式，推进到了开始具有实际想象空间的阶段。

但解释不了「降智」

对于中转站用户，这项技术最直接的吸引力，当然是识别模型替换。但这里有一个关键前提，是我们必须提前知道正品模型的承诺是什么。

如果中转站拿出一份有效证明，却只能证明回答来自它自己选择的模型 B，而用户无法确认模型 B 与自己购买的模型 A 是否相同，那么这份证明仍然解决不了身份问题。

真正有效的使用方式，应当是由模型厂商、可信机构或公开透明的登记系统发布模型承诺，用户验证时固定检查这个预期指纹。在这个前提下，FlashProve 才能从「某次计算确实发生过」，升级为「我们购买的那次计算确实发生过」。

而在社交媒体上，网友们对这项技术更多的评论就是「如果这能最终终结那些 他们是不是悄悄削弱了模型 的帖子，那就太好了。」

毕竟对我们来说，最想要的结果一定是，「你们不要再吵了，把证明拿出来就好了。」

但即使权重身份已经确认，「降智」也还有其他可能。

模型权重没有变化，并不意味着服务完全没有变化。系统提示词、安全策略、上下文截断、检索内容、量化方式和解码参数，都可能影响最终体验。要排查这些问题，需要明确每项条件是否也被核验覆盖。一个绑定权重的证明，不能自动回答所有产品层面的问题。

Kimi 团队在介绍 Kimi Vendor Verifier 时就提到，自 K2 Thinking 发布后，他们收到了社区关于跑分异常的反馈，调查确认，其中相当一部分案例来自解码参数误用。团队随后在 Thinking 模式约束相关参数，并检查思考内容是否被正确传回。

要让商家拿证明，还得先有人愿意出

尽管距离消费级普及仍有距离，这项技术展示的方向已经足够重要。

Anthropic 这次同时公开了代码、技术报告和 Lean 形式化证明。按照技术博客的介绍，Claude 参与了系统构建和优化，协议文档与部分代码也由 AI 生成。

对于中转服务，实际接入还需要上游参与。模型厂商或持有权重的运营方要建立可信的模型承诺、生成证明，中转平台再把相关内容交给用户。

但如果服务商将来能够持续提供这类证明，我们投诉「你是不是换了模型」，就有机会得到一份可以自己检查的答复。

对模型厂商而言，它也可以帮助发现被入侵的推理服务器，确认实际运行的权重是否经过授权。

对评测机构和监管方而言，它则可能用于确认接受测试的模型与正式提供服务的模型是否一致，或者检查服务商是否使用了未经批准的模型。

当然，所有这些应用都还需要更低的证明成本、更长的上下文支持、覆盖真实推理配置，以及一套可信的模型承诺发布机制。

FlashProve 不会立刻终结网上那些「他们是不是悄悄削弱了模型」的帖子。即使未来权重可以验证，人们仍然可以继续争论系统提示词、解码策略和产品设计是否发生了变化。

但至少，对于模型有没有被掉包这件事，我们有机会从过去靠几个问题猜测、凭感觉争论，变成拿出一份证明，直接验证。

毕竟，我们花钱购买了指定模型的服务，确认自己收到的确实是它，本来就不应该是一件需要靠猜的事情。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Anthropic micro-drives, and the sky's about to collapse at the AI transit station?

The AI you paid to call, was it really the model that the merchant promised?

For example, a third-party platform claims to have access to the flagship model, but instead replaces the back stage with a cheap, small model, an old model, the tone and quality of the answer alone, which makes it difficult to judge; or the same subject, the official network can make it, but it is stuck in a transit station.

For many domestic users who call on models through third-party API, polymer platforms or transit services, this is probably a recurring problem.

A simple-looking model requires multiple links to the User-Transit-Upstream Servicer-Model, which, in the absence of transparency, makes it difficult to make sure that we bought it, or that it was a price-fixing model.

Anthropic ' s recent study of publish seeks to turn this issue into a mathematically verifiable one that can only be argued on the basis of slogans, screenshots and body feelings.

This open source research prototype, called FlashProve, can generate a password certificate for model reasoning. It attempts to provide the service provider with a password certificate for the model ' s calculation, and the user does not need to get the model weight or run LLM again.

Without a model, you can prove that you are you.

In addition to using model manufacturers for official applications and calling API for dialogue from official networks, we can confirm the use of models. In most API calls, we submit questions, the server returns, the model is on a remote machine, and we don't know what the calculations were.

The University of Stanford research project, Model Equity Testing, had tested 31 commercial API endpoints for four Llama models in 2024 and found statistical differences in the output distribution of 11 of these endpoints with the reference distribution of Meta publish weights.

The same model name sometimes does not correspond to the same expression. Even if it's on the service page, Opus 5.5, there is no guarantee that users will get exactly the same model.

Sometimes we think we can use a few questions to identify the model, like the recent internal survey of Opus 5.5, and some netizens say to him where Karpathy went in May 2026, and if the model doesn't answer him for Anthropic, it's not tested.

However, these problems are used to identify the model and to identify its own path, which is often difficult to locate directly. It's like the wrong answer, the different parameters, the incomplete transmission of context, and the change of the backstage model, which could end up as a "how stupid" or "this is not the model I want."

At the heart of FlashProve is a zero-knowledge proof technique called zkSNARK.

First, a model service provider generates a "commitment" for weights, similar to a set of password fingerprints, that locks a specific weight, but does not disclose weights per se.

The service provider then produces a certificate to verify whether the given input and output are in accordance with the previously agreed model calculation. When a user has access to a model commitment, prompt, answers and supporting documentation, it can check on its own computer whether these outputs actually occur when this locked weighting input is processed.

If the transit station secretly changes a set of models, or if the output is modified, the proof cannot match the original model commitment.

The zero-knowledge evidence used here is also important in order for the certificationer, when confirming the calculation, not to obtain model weights, intermediate calculations, and what experts the MoE model uses at various levels.

And that explains why it's more reliable than "Ai's Self-Reporter" and what's a model name written in the answer, which no longer acts as an identity document, and checks the computational relationship between output and assigned weights.

A notebook can be verified.

In the past, the biggest obstacle to generating zero-knowledge proof for LLM was cost, and the process of proof could be several orders of magnitude slower than normal reasoning, and the documentation could be very large.

Anthropic is experimenting with Llama 4 Maverick, a public 4-bit weight. This is a hybrid expert model with 40 billion parameters, each token actually activates about 17 billion parameters. According to Anthropic:

- Single sheet H100 generating proof that the amount of throughput is approximately 110 tokens per second;

- Proof of approximately 19 MB per 1,024-tokeen request;

- Validation does not require GPU, which takes about 17 seconds on the 24-line CPU and 21 seconds on the one-line;

- The initial commitment of the model weights can only be generated once and take about 39 minutes.

But 110 tokens/seconds here are proof of the speed of generation, not the speed of model output when users talk. Proofs are still expensive, and under the comparison conditions of Anthropic, the GPU time is about 70 to 95 times the normal vLM reasoning.

Even if not free, the package, together with a form of certification that was almost unbearable in the past, moved to a stage where there was a real imagination.

But it doesn't explain "demented."

For transit station users, the most direct attraction of this technology is, of course, the identification model replacement. But here's a key premise: we have to know in advance what the commitment is.

If the transit station produces a valid proof that the answer comes from model B of its own choice, and the user is unable to confirm whether model B is the same as model A that it purchased, then the certificate still does not solve the identity problem.

A truly effective use should be made by a model manufacturer, a credible institution or an open and transparent registration system publish model commitment to check this expected fingerprint regularly at user validation. On this premise, FlashProve was able to move from "some calculations do happen" to "the calculations we bought do happen".

And on social media, more commenters on this technology are saying, "It would be great if it ended with those posts that they quietly weakened the model."

After all, for us, the most desired result must be, "Stop arguing and bring out the proof."

But even if the weight of power has been identified, there are other possibilities for “mention”.

The fact that the weight of the model has not changed does not mean that the service has not changed at all. System prompt, security strategy, context cut-off, retrieving content, quantization mode decoder parameters may all affect the final experience. For these issues to be addressed, it needs to be clear whether each condition is also covered by the verification. A certificate of weighting does not automatically answer all product-level questions.

In introducing Kimi Vendor Verifier, the Kimi team mentioned that, since K2 Thinking publish, they had received community feedback on running anomalies, and the survey confirmed that a significant proportion of the cases had resulted from the misuse of decoded parameters. The team then binds the parameters in the Thinking mode and checks if the reflections are sent back correctly.

To get the evidence from the merchant, someone has to be willing. Out

Although there is still a distance to consumer-level universalization, the direction this technology is showing is important enough.

Anthropic published both the code, the technical report and the Lean formalization certificate. According to the technical blog, Claude is involved in system construction and optimization, and protocol documents and some codes are generated by AI.

For transit services, physical access also requires upstream involvement. Model manufacturers or owners of weights need to establish credible model commitments, generate certification, and the transit platform gives the content to the user.

But if the service provider can provide such evidence on a continuous basis in the future, our complaint that you have changed the model gives us an opportunity to get a response that can be examined by yourself.

For model manufacturers, it could also assist in the discovery of the invaded reasoning server and confirm whether the actual operating weights were authorized.

For evaluation agencies and regulators, it may be used to confirm whether the tested model is consistent with that of the formal service delivery, or to check whether the service provider uses unauthorized models.

Of course, all these applications require lower costs of proof, longer context support, coverage of true reasoning configurations, and a credible model commitment to publish mechanisms.

FlashProve will not immediately close the post "Did they quietly weaken the model?" Even if future weights can be validated, one can continue to argue whether systems prompt, decoded strategies and product designs have changed.

But at the very least, we have an opportunity to move from speculation on a few questions in the past to a perception argument to a proof that we can verify directly.

After all, we have paid for the services of the specified model to make sure that we have received it, and that it should not have been a guess.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.