Progress on provable inference for large language models

Nov 4, 2026•ltononro•View Original

TL;DR Highlight

Proving 400B model outputs with zkSNARKs works, at 70-95x the GPU time of plain vLLM

Who Should Read

A backend developer calling LLM APIs through routers or third parties who wonders whether the requested model really answered

Core Mechanics

You can't tell which model answered
- A routing service can silently swap in a cheaper model to save cost.
- An attacker tampering with the token stream is equally undetectable from output alone.
zkSNARK proves these weights produced these tokens
- The provider first publishes a short commitment (fingerprint) to the weights.
- Each response then carries a proof that the user verifies without the weights.
- Weights stay hidden, but hiding the architecture is not a goal.
About 110 tokens/s on one H100 for Llama 4 Maverick
- The target is a 400B-parameter MoE with 4-bit quantized weights.
- Proof size is about 19 MB (18.78 MB) per 1,024-token request.
- Proving a batch of 24 requests takes 223 seconds.
Costs 72x vLLM GPU time, 94x at peak load
- Comparison is per GPU against vLLM (FP8, eight H100s) processing the same 24 requests.
- Verification takes 17s on 24 CPU threads and 21s on one thread.
- The commitment is about 6.5 MB and must be redone after about 16 million requests.
Integer arithmetic comes with conditions
- It proves an exact integer version of the published weights, asserting each token is the model's greedy choice.
- The post states floating-point implementations or sampled decoding could depart at some position.
Code and Lean proofs released under Apache 2.0
- It includes one prover and two verifiers: a fast C++ one and a provably correct Lean one.
- Top-level security statements are in Lean so humans can audit Claude's optimizations.

Community Reactions

Compare providers instead, some argued
- For open-weight models, simply redoing the computation is far cheaper, one commenter said.
- For closed models, the choice is ZKPs, signed responses, or comparing multiple providers.
Quantization swaps may slip through
- A commenter asked whether this catches hosts quietly running quantized models.
- Given the post proves only the integer version and greedy choice, the answer appeared to be no.
Many were skeptical about practicality
- Some said model substitution is vendor accountability and token tampering is infra security.
- Others questioned whether 70-95x GPU cost is justified.
Prompt secrecy and attribution concerns
- One commenter said providers wanting to hide parts of the system prompt may not ship such proofs.
- Another claimed the work builds on their VerInf project with little attribution.

How to Apply

Log the model ID on third-party router calls
- Today, compare the response's model field with the requested model on routed calls.
- Count mismatches per day.
Build a model-consistency check script
- Run 20 fixed prompts at temperature 0 on a schedule and record outputs per host.
- Flag hosts whose outputs drift as quantization suspects.
Add model-verification clauses to eval and audit contracts
- Require external evaluators to specify how they confirm the evaluated model is the served one.
- Limit proofs to sampled audit requests given FlashProve's cost.

Try It

copy & run

# Paste into Claude or ChatGPT (simplified version of the idea: design a model-substitution check instead of a proof)

I use LLM APIs via {{provider/router name}}. The model I use is {{model name}}.

Design a procedure to check that the requested model actually answered.
- No cryptographic proofs; only output comparison and logs.
- 20 fixed prompts, temperature 0, run once a day.
- Include a Python script that records the response model field, latency, and output hash.

At the end, list cases this approach cannot catch (quantization, sampling, etc.).

Next step: use two or more hosts and compare output hashes for the same prompts.

Terminology

zkSNARKA cryptographic technique that shows a computation ran correctly with a short certificate. The verifier doesn't see the contents. It's a receipt without showing the ledger.

commitmentA short fingerprint that pins down exact weights without revealing them. Like stamping a sealed envelope.

MoE (Mixture of Experts)A model design that activates only some expert sub-networks per token. Maverick uses about 17B of 400B per token.

LeanA language where machines check mathematical proofs. It makes security claims easier for humans to audit.

prefillThe inference stage that reads the whole prompt in one parallel pass. The prover reads finished text the same way.

Related Resources

Progress on provable inference for large language models

Nov 4, 2026•ltononro•View Original

TL;DR Highlight

Proving 400B model outputs with zkSNARKs works, at 70-95x the GPU time of plain vLLM

Who Should Read

A backend developer calling LLM APIs through routers or third parties who wonders whether the requested model really answered

Core Mechanics

You can't tell which model answered
- A routing service can silently swap in a cheaper model to save cost.
- An attacker tampering with the token stream is equally undetectable from output alone.
zkSNARK proves these weights produced these tokens
- The provider first publishes a short commitment (fingerprint) to the weights.
- Each response then carries a proof that the user verifies without the weights.
- Weights stay hidden, but hiding the architecture is not a goal.
About 110 tokens/s on one H100 for Llama 4 Maverick
- The target is a 400B-parameter MoE with 4-bit quantized weights.
- Proof size is about 19 MB (18.78 MB) per 1,024-token request.
- Proving a batch of 24 requests takes 223 seconds.
Costs 72x vLLM GPU time, 94x at peak load
- Comparison is per GPU against vLLM (FP8, eight H100s) processing the same 24 requests.
- Verification takes 17s on 24 CPU threads and 21s on one thread.
- The commitment is about 6.5 MB and must be redone after about 16 million requests.
Integer arithmetic comes with conditions
- It proves an exact integer version of the published weights, asserting each token is the model's greedy choice.
- The post states floating-point implementations or sampled decoding could depart at some position.
Code and Lean proofs released under Apache 2.0
- It includes one prover and two verifiers: a fast C++ one and a provably correct Lean one.
- Top-level security statements are in Lean so humans can audit Claude's optimizations.

Community Reactions

Compare providers instead, some argued
- For open-weight models, simply redoing the computation is far cheaper, one commenter said.
- For closed models, the choice is ZKPs, signed responses, or comparing multiple providers.
Quantization swaps may slip through
- A commenter asked whether this catches hosts quietly running quantized models.
- Given the post proves only the integer version and greedy choice, the answer appeared to be no.
Many were skeptical about practicality
- Some said model substitution is vendor accountability and token tampering is infra security.
- Others questioned whether 70-95x GPU cost is justified.
Prompt secrecy and attribution concerns
- One commenter said providers wanting to hide parts of the system prompt may not ship such proofs.
- Another claimed the work builds on their VerInf project with little attribution.

How to Apply

Log the model ID on third-party router calls
- Today, compare the response's model field with the requested model on routed calls.
- Count mismatches per day.
Build a model-consistency check script
- Run 20 fixed prompts at temperature 0 on a schedule and record outputs per host.
- Flag hosts whose outputs drift as quantization suspects.
Add model-verification clauses to eval and audit contracts
- Require external evaluators to specify how they confirm the evaluated model is the served one.
- Limit proofs to sampled audit requests given FlashProve's cost.

Try It

copy & run

# Paste into Claude or ChatGPT (simplified version of the idea: design a model-substitution check instead of a proof)

I use LLM APIs via {{provider/router name}}. The model I use is {{model name}}.

Design a procedure to check that the requested model actually answered.
- No cryptographic proofs; only output comparison and logs.
- 20 fixed prompts, temperature 0, run once a day.
- Include a Python script that records the response model field, latency, and output hash.

At the end, list cases this approach cannot catch (quantization, sampling, etc.).

Next step: use two or more hosts and compare output hashes for the same prompts.

Terminology

zkSNARKA cryptographic technique that shows a computation ran correctly with a short certificate. The verifier doesn't see the contents. It's a receipt without showing the ledger.

commitmentA short fingerprint that pins down exact weights without revealing them. Like stamping a sealed envelope.

MoE (Mixture of Experts)A model design that activates only some expert sub-networks per token. Maverick uses about 17B of 400B per token.

LeanA language where machines check mathematical proofs. It makes security claims easier for humans to audit.

prefillThe inference stage that reads the whole prompt in one parallel pass. The prover reads finished text the same way.

Progress on provable inference for large language models

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources

Progress on provable inference for large language models

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources