You spent money on the most expensive large model, but the backend secretly swapped it for a cheaper version—who could possibly tell? Anthropic has just open-sourced an intriguing project called FlashProve, aiming to use cryptography to address the long-standing trust issues in the AI industry: how can you prove that a piece of AI-generated content truly came from the model the service provider claims it did? Currently, when we call a large model’s API, we essentially have to trust the provider. Could a third-party routing platform be secretly swapping models? Is the model tested by security evaluation agencies the same one ordinary users are actually using? And what if the server is hacked—could someone have tampered with the model’s outputs? These questions are nearly impossible to answer based solely on the model’s responses. FlashProve introduces zero-knowledge proofs (ZK), specifically zkSNARKs—technology familiar to the Web3 community. The principle is straightforward: the model provider first generates a cryptographic commitment for a set of model weights, effectively registering an immutable identity for the model. Each inference can then be accompanied by a proof. Users don’t need to know the model’s parameters or run the model themselves—they can verify on a standard CPU whether the output was genuinely generated by the previously committed model. Anthropic tested this with Llama 4 Maverick, a 400-billion-parameter model. On a single H100 GPU, they achieved approximately 110 tokens per second for generating proofs, with verification taking only a few seconds per proof. Of course, costs remain extremely high. Generating a proof requires 70–95 times more GPU resources than standard inference, and each proof is nearly 19 MB in size. Currently, it only supports contexts up to 1024 tokens and specific inference methods—far from ready for large-scale commercial deployment. But I believe this is worth paying attention to. Over the past few years, zero-knowledge proofs have primarily been used in the crypto industry to verify transactions and computations. Now, Anthropic is attempting to apply the same cryptographic principles to large model services. Even more significant is its potential for AI governance. In the future, regulators may require models to pass security evaluations before deployment; providers will then need to prove that the actual running weights are identical to those approved. Independent auditors could also verify whether the model they tested matches what customers are using. Of course, cryptography can only prove that computations adhere to a prior commitment—it cannot guarantee that the model’s outputs are correct or that the model itself is safe. I’ve always believed that as AI agents begin to take over more real-world tasks, the entire industry will eventually face one fundamental question: What grounds do we have to trust the AI running on a remote server? FlashProve is still just a research prototype—but at least it points toward a promising technical path worth further exploration.