Anthropic的新原型证明了哪个模型在不暴露其重量的情况下写出了AI响应。
Anthropic拥有发布 FlashProve，是一种使用密码学来验证AI响应是否实际来自声称的模型的研究原型。 该系统仍有重大局限性。
任何人向今天的AI模型发送查询，都无法证实所选模型实际生成了响应。 线路服务可以悄悄地以更便宜的模式进行互换，以减少成本。 攻击者可能篡改数据流。 Anthropic 称其新的开源研究原型FlashProve旨在解决这一问题。
FlashProve使用一种名为zkSNARK的密码技术。 简言之，模型提供者首先创建了模型重量的数字指纹。 在每次响应后，提供者都会提供一份紧凑的证明，证明这个特定的模型产生了输出。 揭示秘密模型的证明完全没有影响自己
证明生成速度足够实用
根据技术报告，FlashProve为Meta的Llama 4 Maverick，一个4000亿参数的型号，在单个H100 GPU上以大约每秒110个令牌生成证明。 每个证明大约是19兆字节，可以在17秒内在一个标准的CPU上被验证。 新增与正常推论相比大约为70到95倍
这听起来很多，但它是一个重大跳跃从早期的系统。 此前唯一可比较的开源系统用了14个小时处理1000个令牌，Anthropic 称。 它出具了93.6-gigabyte的证明，几乎用了一整天的时间来核实。
监管机构可以核实哪些模型供应商实际运行
Anthropic看到多个使用案例。 监管者可以检查供应商是否实际上只运行经批准的型号，公司可以证明它们的代码是由特定的安全型号审查的，供应商可以检测其服务器的篡改情况，比如攻击者或更先进的型号滑落到无人注意的地方。
Anthropic在边界安全路线图中确定了在2026年9月之前建立推论核查原型的目标。 称公司已经通过一个单独的项目击中了这个目标，该项目会标出推断流量，并在一个可信赖的服务器上追踪计算结果。 FlashProve追求同一目标，但采取纯粹加密的方法，不需要信任的硬件。
上下文窗口和采样限制
Anthropic强调FlashProve是研究原型。 该系统目前仅证明了多达1,024个令牌的上下文，远低于当前模型的上下文windows. 它隐藏了模型的权重而不是其基础建筑。 而证明只有在模型选择最有可能的下一个符号时才有效，而不是与聊天人通常在日常使用中产生的随机输出。
根据Apache 2.0许可证，可在GitHub上获取完整的代码，精益证和文件。
AI News Without the Hype – 由人类治愈
订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。
现在订阅
读取全照。
订阅无韵报道。
- 全面查阅THE DECODER的每篇文章
- 没有广告
- 加入评论和社区讨论
- 每周通过邮件转载AI新闻
- 6x/年："AI雷达"——对AI最重要的话题进行深度潜水。
- 每日AI新闻，总是最新的
- 我们完整的十年档案
- 由一个在AI工作10年以上的团队负责
订阅到 The Decoder
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anthropic's new prototype proves which model wrote an AI response without exposing its weights
Anthropic has released FlashProve, a research prototype that uses cryptography to verify whether an AI response actually came from the claimed model. The system still has significant limitations.
Anyone sending a query to an AI model today has no way to verify that the chosen model actually generated the response. A routing service could quietly swap in a cheaper model to cut costs. An attacker could tamper with the data stream. Anthropic says its new open-source research prototype FlashProve is designed to tackle this problem.
FlashProve uses a cryptographic technique called zkSNARK. In simple terms, the model provider first creates a digital fingerprint of the model's weights. With every response, the provider then delivers a compact proof showing that this specific model generated the output. The proof reveals nothing about the secret model weights themselves.
Proof generation is fast enough to be practical
According to the technical report, FlashProve generates proofs at roughly 110 tokens per second on a single H100 GPU for Meta's Llama 4 Maverick, a 400-billion-parameter model. Each proof is about 19 megabytes and can be verified in 17 seconds on a standard CPU. That adds overhead of roughly 70x to 95x compared to normal inference.
That sounds like a lot, but it is a significant jump from earlier systems. The only comparable open-source system previously available took over 14 hours to process 1,000 tokens, Anthropic says. It produced a 93.6-gigabyte proof that took nearly a full day to verify.
Regulators could verify which models providers actually run
Anthropic sees several use cases. Regulators could check whether a provider is actually running only approved models, companies could prove their code was reviewed by a specific safety model and providers could detect tampering on their servers, like an attacker or a more advanced model slipping in unnoticed.
In its Frontier Safety Roadmap, Anthropic had set a goal of building an inference verification prototype by September 2026. The company says it already hit that target through a separate project that signs inference traffic and traces the computation on a trusted server. FlashProve pursues the same goal but takes a purely cryptographic approach and doesn't need trusted hardware.
Context window and sampling limits hold it back
Anthropic stresses that FlashProve is a research prototype. The system currently only proves contexts of up to 1,024 tokens, far below the context windows of current models. It hides the model's weights but not its underlying architecture. And the proof only works when the model picks the single most likely next token, not with the randomized outputs that chatbots typically produce in everyday use.
The full code, Lean proofs, and documentation are available on GitHub under the Apache 2.0 license.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Read on for the full picture.
Subscribe for hype-free coverage.
- Full access to every article on THE DECODER
- No ads
- Join the comments and community discussions
- A weekly AI news recap via mail
- 6x/year: "AI Radar" — deep dives on the AI topics that matter most
- Daily AI news, always up to date
- Our full ten-year archive
- Covered by a team with 10+ years in AI
Subscribe to The Decoder
Auto-fetched and translated by AI Atlas. All rights belong to the original author.