Learn · Intermediate

Verifiable computation: checking which model ran without seeing its weights

Verifiable computation lets one party check that another performed a precisely specified calculation without repeating all of the work. Applied to AI inference, a cryptographic proof can connect a request and selected output to committed model parameters. The guarantee concerns computation, so it does not automatically establish that an answer is true or that a commercial model label is authentic.

The problem it solves

A hosted model is normally a promise about a remote machine. The customer sees an endpoint name and an answer, while the operator controls the actual implementation. A provider could substitute different parameters, use an unintended numerical format or return output unrelated to the advertised calculation. Ordinary benchmarking samples behavior; it cannot establish what happened on every checked request.

A proof changes the question from whether the output looks plausible to whether it satisfies a mathematical relation. Daniel Kang and colleagues’ work on trustless neural-network inference describes an earlier approach at image-classification scale. Anthropic’s FlashProve report explores a more recent language-model setting. These are implementations within a broader cryptographic field, rather than evidence that all models can already be verified economically.

Commitments, witnesses and verification

A commitment acts like a tamper-evident reference to data. The provider commits to model parameters before proving an inference result. The verifier can then reject a proof about different parameters, assuming the commitment scheme’s security holds.

The provider possesses information needed to demonstrate the computation, including private weights and intermediate values. Cryptographers call such private supporting information a witness. The proof lets a verifier check the required relation without receiving every intermediate value or running the whole network again.

Imagine a sealed recipe registered with an independent notary. A kitchen wants to demonstrate that it followed that particular recipe without publishing it. A proof can connect the preparation to the registered recipe. It does not establish that the recipe tastes good, that its ingredients are safe or that the notary’s label identifies the chef you intended. Those require different evidence.

What zero knowledge adds

A zero-knowledge property means the proof reveals no additional information about designated secrets beyond what the public statement already implies, within the formal security definition. In model inference, the hidden information may include proprietary weights. The prompt and response can still be public to the verifier.

This distinction separates the topic from encrypted inference. Encryption-based inference asks how to compute while protecting data from an operator. A proof asks how to check the computation. Privacy and integrity can be combined, but neither word implies the other.

Three basic properties organize a proof system. Completeness means an honest prover with a valid computation should succeed. Soundness means an efficient cheating prover should have only a very small probability of convincing the verifier of a false statement. Zero knowledge limits what the proof reveals. Each property has assumptions and a defined scope; none means that every component of the surrounding product is secure.

Why the exact statement matters

For a language model, the statement could concern one token, a range of tokens or a whole sequence. Proving one next-token choice does not prove all later choices. A greedy-choice proof does not automatically cover a reply generated through randomized sampling.

Numerical representation also belongs in the statement. Quantization changes how weights and arithmetic are represented. A proof about an integer model verifies that model’s computation, which may differ from a floating-point service. Small differences can change a winning token when alternatives have similar scores.

FlashProve makes these boundaries concrete. Its standard benchmark checks a selected token under committed integer-model inference, and its researchers also examine fuller checking. The research repository recommends obtaining the commitment identifier from a trusted party. Otherwise a dishonest server could offer a perfectly valid proof about the wrong model.

The proof still needs a trustworthy system

A verified protocol description is not automatically a verified accelerator implementation. Code can depart from the mathematics. Likewise, a server could log a correct response while sending a different response to the customer. Verification must bind to the actual delivered request and output if it is to address that threat.

This differs from proof assistants, which check formal arguments, and from model fingerprinting, which infers identity through behavior. They can complement inference proofs while solving different problems.

The economic question is whether proof creation, transmission and checking cost less than the risk they address. Proving can be much more expensive than ordinary inference, even when verification is comparatively cheap. Before accepting a deployment claim, identify the committed model, numerical rules, checked tokens, authenticated commitment source, implementation assurance and delivery binding. A strong proof is valuable precisely because its guarantee can be stated narrowly enough to inspect.

Ground Truth. (2026, November 5). Verifiable computation: checking which model ran without seeing its weights. Ground Truth. https://groundtruth.day/learn/verifiable-computation-and-zero-knowledge-inference.html

@misc{groundtruth:verifiable-computation-and-zero-knowledge-inference,
  title  = {Verifiable computation: checking which model ran without seeing its weights},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/learn/verifiable-computation-and-zero-knowledge-inference.html}
}

Topics: cryptography · verifiable-computation · inference · ai-security · fundamentals