Welcome Back to XcessAI

Suppose your company buys access to one of the world's most capable AI models. You negotiate the contract, agree the price, complete the security review and approve the model for sensitive work.

Then an employee sends it a prompt. A response appears.

There is one surprisingly difficult question:

How do you know that the model you paid for actually produced it?

Today, in most cases, you don't.

You trust the provider, the cloud platform or the routing service sitting between you and the model. You may know that the endpoint says Model X. You may have an invoice saying Model X. You may even recognise the style of the response.

None of those proves which model actually generated the tokens.

Anthropic has now released an experimental system designed to change that. It is called FlashProve, and behind some formidable cryptography lies a remarkably simple idea:

AI outputs could eventually come with proof of which model produced them.

Think of it as a model identity check.

This issue barely mattered when people interacted directly with a single chatbot. You opened the provider's website, typed your question and received an answer. The chain between you and the model was relatively simple.

Enterprise AI is becoming much more complicated.

A company might access models through a cloud provider, an AI gateway, a routing service, an enterprise software vendor, an internal agent platform or another AI system deciding dynamically which model to call.

That creates layers between the person asking the question and the machine generating the answer. And those layers can have economic incentives of their own.

Imagine paying for a premium frontier model while an intermediary quietly routes some requests to a cheaper one. Perhaps the cheaper model is almost as good. Perhaps most employees never notice. The intermediary saves money on inference while the customer continues paying the premium price.

Anthropic explicitly identifies this kind of silent substitution as one reason model verification could matter. It also points to a more serious possibility: an attacker who compromises an inference server could interfere with the model being served or with the resulting token stream while making the responses appear legitimate.

The underlying problem is familiar:

You know what you requested. You know what you received. You cannot necessarily prove what happened in between.

FlashProve tries to solve that using a class of cryptographic techniques called zero-knowledge proofs.

The name sounds intimidating. The concept does not need to be.

Imagine the provider committing to a cryptographic fingerprint of one exact set of model weights. Later, when the model answers your question, the provider can generate a cryptographic certificate showing that those committed weights, given that input, produced those output tokens.

You can then verify the certificate without possessing the model itself.

That last part matters enormously.

Frontier model weights are among the most valuable intellectual property in technology. Providers cannot simply hand customers a copy so that they can rerun every prompt and check the result themselves. Even if they did, most customers would not have the enormous computing infrastructure required.

FlashProve allows the provider to prove the computation while keeping the underlying weights secret.

The customer gets verification.

The provider keeps its intellectual property.

That is the zero-knowledge part.

Perhaps the easiest mental model is a receipt.

When you buy something with a credit card, several systems create records showing that a particular transaction occurred. You do not need access to the bank's internal infrastructure to verify that the payment happened.

Provable inference could eventually do something similar for AI.

Alongside an important AI output, you could receive a cryptographic receipt saying:

This response was generated by the committed version of this model using this input.

The proof itself tells you surprisingly little about the proprietary model. It does not reveal the weights or the intermediate values of the computation. It simply allows you to verify the claim.

Anthropic's prototype demonstrates this using Llama 4 Maverick, a roughly 400-billion-parameter mixture-of-experts model.

For a 4-bit quantised version, FlashProve achieved a proving throughput of around 110 tokens per second using a single Nvidia H100 GPU. Anthropic reports proof files of roughly 19 MB for the tested 1,024-token requests, with verification taking around 17 seconds on a 24-thread CPU.

Those numbers are impressive because only a few years ago proving computations of this scale looked wildly impractical.

They are still nowhere near ordinary production economics.

More on that later.

For casual AI use, most people probably won't.

If you ask an AI to suggest a restaurant or improve an email, you mainly care whether the answer is useful. The precise model identity may be irrelevant.

Enterprise use is different.

Imagine an investment firm approves one specific model for handling confidential research. A pharmaceutical company validates a particular model for part of a regulated process. A bank tests a particular version before allowing it to participate in risk analysis.

Or imagine a software company claims that its code was reviewed by a particular frontier cybersecurity model.

In every case, the identity of the model becomes part of the control.

If a different model can quietly replace it, that control becomes weaker.

Anthropic gives a particularly interesting security example. A software developer might want evidence that a powerful cybersecurity model genuinely examined a new software release for vulnerabilities. A transcript alone provides limited assurance that the claimed model actually performed the work.

A cryptographic proof could provide stronger evidence that the committed model really processed the relevant material.

That turns AI provenance from:

Trust us.

into something closer to:

Verify it.

This could eventually matter enormously for AI procurement.

Enterprise contracts increasingly distinguish between models and capability tiers. Customers may negotiate different prices for different systems, while internal policies may allow certain models to access sensitive information and prohibit others.

At the same time, agent platforms increasingly route tasks dynamically depending on complexity, latency and cost.

That makes economic sense. There is little reason to use the most expensive frontier model to classify a simple document.

But dynamic routing introduces a governance problem.

Suppose a contract promises that particularly sensitive tasks will always use the premium model. How does the customer audit that?

Logs help. Provider reports help. Contractual rights help.

But all of them ultimately rely to some degree on trusting whoever controls the system generating those records.

Provable inference introduces a different possibility. The customer could independently verify that a particular output came from the weights associated with the approved model.

The implications become especially interesting when third parties are involved.

Your company may trust Anthropic, OpenAI or Google.

Do you equally trust every intermediary through which their models may eventually be delivered?

Model identity becomes more valuable as the AI supply chain becomes longer.

There is another important use case.

Auditors and regulators increasingly face an awkward technical problem. Suppose an organisation says:

How does an external party verify that without gaining access to proprietary model weights or enormous amounts of computing infrastructure?

Today, much of the answer is documentation and controls.

Cryptographic proofs could potentially add something stronger.

Anthropic describes scenarios in which an external party could verify that an approved model was genuinely being served without rerunning the model or learning its secret weights.

The same principle could apply to independent AI evaluators.

An evaluator tests a model. The provider later deploys something. How does the evaluator know the deployed model is the same one it examined?

Again, the question is identity.

The AI industry is gradually discovering something that banking, pharmaceuticals and cybersecurity learned long ago:

Trust becomes harder as systems become more important.

Eventually, important claims need evidence.

This distinction is essential.

A valid FlashProve certificate can establish that the committed model produced a particular output from a particular input.

It does not tell you that the output is true.

It does not tell you that the model reasoned correctly, that the recommendation was unbiased or that the model is safe.

It does not even automatically establish that the committed weights correspond to the commercial brand name you think you purchased. For that, someone still needs a trusted mechanism linking the cryptographic commitment to the product identity.

Cryptography can establish:

These committed weights produced this output.

It cannot establish:

This was a good answer.

This is therefore better understood as integrity infrastructure, not quality assurance.

FlashProve is still a research prototype, and the economics are nowhere close to mass deployment.

Anthropic reports that generating the cryptographic proof currently consumes roughly 70 to 95 times as much GPU time as running comparable ordinary inference.

That is a huge overhead.

The current implementation also handles contexts of only 1,024 tokens, extremely short compared with the hundreds of thousands, and sometimes more, supported by modern frontier systems.

It proves an integer implementation of the model using greedy decoding. Real commercial inference often involves floating-point computation, sampling and other techniques that can cause the generated output to diverge from the exact computation being proved.

Anthropic also acknowledges gaps between the formally verified protocol and the faster executable implementation used in practice.

In other words:

Do not expect a cryptographic certificate beside every AI answer next month.

That is not what this release represents.

The significance is that something that previously looked extraordinarily expensive is becoming technically plausible.

Anthropic compares FlashProve with an earlier open system called VerInf, which proved the same Llama 4 Maverick model at roughly 0.02 tokens per second.

FlashProve reaches around 110.

That is more than three orders of magnitude faster.

The important signal is the direction of travel.

This fits into a larger pattern.

The first phase of enterprise AI was about capability:

Can the model do this?

Then came security:

Can we safely give the model access to our data?

Then governance:

What should the model be allowed to do?

As AI becomes more deeply embedded in critical processes, another layer is emerging:

Can we prove what actually happened?

Which model ran? Which version? Which input did it receive? Was the output modified? Did the approved model really perform the promised review?

Those questions sound technical.

They are actually questions of accountability.

And accountability becomes increasingly important when AI moves from generating disposable text to influencing financial decisions, writing production software, accessing corporate systems and performing regulated work.

Today, we largely buy AI by brand.

Claude. GPT. Gemini. Etc.

The product name functions as a promise.

Behind that name, however, AI infrastructure is becoming increasingly fluid. Models are updated. Requests are routed. Different versions coexist. Agents call other agents. Enterprise platforms sit between users and providers.

Models themselves may increasingly decide which other models should perform particular tasks.

That complexity makes a simple label less informative.

In a mature AI economy, companies may eventually want something more precise:

Which exact model performed this exact computation?

FlashProve is an early attempt to make that question answerable.

It is expensive, limited, experimental and far from something most companies will deploy today.

But the broader idea is important.

As AI becomes infrastructure, model identity may become something that needs to be verified rather than assumed.

Buying access to a named model and proving that the named model actually did the work are two different things.

For most of the AI era, we have simply trusted that they were the same.

We may eventually stop having to.

Until next time,
Stay adaptive. Stay strategic.
And keep exploring the frontier of AI.

Fabio Lopes
XcessAI

💡Next week: I’m breaking down one of the most misunderstood AI shifts happening right now. Stay tuned. Subscribe above.

Read our previous episodes online!