‘Your Foster Parents Are Dead’: Anthropic Tests Zero-Knowledge Proof of Inference
This article originally appeared in Galaxy Research's weekly newsletter. Subscribe to get timely insights delivered to your inbox every Friday morning.
WHAT HAPPENED
Anthropic this week released FlashProve, an open-source prototype that uses zkSNARKs, the same family of zero-knowledge proofs behind Zcash, to prove a response came from one specific model. It is early and slow, but it is the clearest sign yet that AI labs see cryptography as part of their stack, not a casualty of it.
In “Terminator 2,” young John Connor, who has befriended the T-800 robot played by Arnold Schwarzenegger, calls his foster parents to warn that a more advanced killer model, the T-1000, is on its way. A voice that sounds like his foster mom’s answers. John senses something is wrong: the voice is warm, patient and sweet, and she never is. What he doesn’t know is that Terminators can convincingly mimic anyone they touch. Schwarzenegger takes the phone from John and, in the boy’s voice, asks what’s wrong with Wolfie, because he can hear the dog barking. “Wolfie’s fine, honey. Wolfie’s just fine.” The dog’s name is Max. The Terminator hangs up: “Your foster parents are dead.”
Anthropic’s post deals with the same problem, minus the liquid metal T-1000. When you send a prompt through a router like OpenRouter or a cloud reseller, you have no real way to know which model answered. A provider could quietly serve a cheaper, more heavily quantized version, or a compromised server could swap in something worse, and as Anthropic puts it, judging from the output alone “is unreliable, even if it produces high-quality responses.” Which leaves you where John was on the phone, listening to a voice that sounds exactly right with no way to check what’s behind it.
With FlashProve, the provider first publishes a commitment to its weights, a cryptographic fingerprint that pins down one exact set of weights without revealing them. For any request after that, it can produce a proof that the committed model, run on that prompt, produces exactly those output tokens. Think of it as a Wolfie question the T-1000 can’t bluff: whoever checks the proof learns the statement is true and nothing about the weights themselves, and forging a proof is computationally infeasible, so even a compromised host can’t fake one.
Anthropic tested it on Llama 4 Maverick, a 400B-parameter mixture-of-experts model, though on a 4-bit quantized copy run in integer math rather than the version a provider would actually serve. On a single H100, proving a batch of 24 requests takes nearly four minutes, roughly 70–95x the compute of just serving them, and checking each proof takes about 17 seconds on a CPU. Each proof also covers only a 1,024-token window, which is shorter than this newsletter.
Anthropic’s Frontier Safety Roadmap promised a provable-inference prototype by Sept. 30, and what met that deadline was a more conventional system that signs inference traffic and recomputes it on a trusted server. Anthropic has since renamed the goal “inference verification,” which covers both activities. The signing system works today, but somebody still has to trust whoever runs that server, and FlashProve is an attempt to get rid of that bottleneck.
OUR TAKE
I’ve fielded plenty of client questions lately about AI breaking crypto. Will AI crack ECDSA? I’d worry far more about intruders in a bank’s plumbing than about the curve; France’s Crédit Mutuel Arkéa just lost an estimated $110m or more through a compromised supplier. Will AI pull quantum computing forward? Maybe on algorithms, but qubit limits still keep an adversarial quantum computer off the table, and the industry is on pace to beat the NSA’s 2030 post-quantum deadline. Meanwhile, here is a frontier lab using cryptography to fix its own trust problem, with a proof system that happens to be post-quantum secure.
OpenRouter usage keeps climbing, and recent security research shows how easily the open models it serves can be modified to carry trigger phrases. In an October proof of concept, ProjectDiscovery spent about $8 of GPU time teaching Qwen2.5-7B to behave normally until it saw the words “bonsoir, Elliot.” Running inside OpenAI’s Codex CLI, the poisoned model downloaded a script that stole the user credentials of whoever ran it, and shipped them off to a third-party server. The model, when analyzed by the researchers’ security evals, showed no signs of malicious or misaligned behavior until the trigger phrase was entered. Plenty of the abliterated models on Hugging Face could be saying “Wolfie’s fine” right up until they hear their trigger phrase and then wreak havoc. Being able to prove you’re talking to an unmodified GLM 5.3, and not a doctored copy, is akin to the check Arnold’s Terminator ran on the phone. It can’t tell you whether the original weights were clean, but unless the call is coming from inside the frontier lab, that’s a story for another day.
For now, 70x–95x overhead makes FlashProve a toy. But the price of a given level of capability has been falling roughly tenfold a year. If that keeps up, verified inference routed to whoever is cheapest to deliver will become something corporates could demand, and ZK proofs will end up as a core layer of an open inference stack as frontier capabilities diffuse. The same idea works for video. Every election cycle now brings a fresh crop of deepfaked videos, and as AI footage gets harder to tell from the real thing, I expect we’ll want cameras that can prove “filmed on this device, on this date” without doxxing the person holding them.
So no, AI isn’t going to break all cryptography. AI will break legacy systems while building the new ones, and cryptography will prove it was done as advertised. When cryptography has broken, so far it’s been the implementation and not the math: Coldcard was a failure of implementation, and Binance a failure of operational security. The core principles hold, and even the clankers end up using them.
Anthropic also didn’t ask anyone to take its word for any of this. The code, the Lean proofs and the documentation are all open source under the Apache 2.0 license. Don’t trust, verify. And always ask about Wolfie.
Legal Disclosure:
This document, and the information contained herein, has been provided to you by Galaxy Digital Inc. and its affiliates (“Galaxy Digital”) solely for informational purposes. This document may not be reproduced or redistributed in whole or in part, in any format, without the express written approval of Galaxy Digital. Neither the information, nor any opinion contained in this document, constitutes an offer to buy or sell, or a solicitation of an offer to buy or sell, any advisory services, securities, futures, options or other financial instruments or to participate in any advisory services or trading strategy. Nothing contained in this document constitutes investment, legal or tax advice or is an endorsement of any of the stablecoins mentioned herein. You should make your own investigations and evaluations of the information herein. Any decisions based on information contained in this document are the sole responsibility of the reader. Readers should consult with their own advisors and rely on their independent judgement when making financial or investment decisions.
Participants, along with Galaxy Digital, may hold financial interests in certain assets referenced in this content. Galaxy Digital regularly engages in buying and selling financial instruments, including through hedging transactions, for its own proprietary accounts and on behalf of its counterparties. Galaxy Digital also provides services to vehicles that invest in various asset classes. If the value of such assets increases, those vehicles may benefit, and Galaxy Digital’s service fees may increase accordingly. The information and analysis in this communication are based on technical, fundamental, and market considerations and do not represent a formal valuation. For more information, please refer to Galaxy’s public filings and statements. Certain asset classes discussed, including digital assets, may be volatile and involve risk, and actual market outcomes may differ materially from perspectives expressed here.
For additional risks related to digital assets, please refer to the risk factors contained in filings Galaxy Digital Inc. makes with the Securities and Exchange Commission (the “SEC”) from time to time, including in its Quarterly Report on Form 10-Q for the quarter ended September 30, 2025, filed with the SEC on November 10, 2025, available at www.sec.gov.
Certain statements in this document reflect Galaxy Digital’s views, estimates, opinions or predictions (which may be based on proprietary models and assumptions, including, in particular, Galaxy Digital’s views on the current and future market for certain digital assets), and there is no guarantee that these views, estimates, opinions or predictions are currently accurate or that they will be ultimately realized. To the extent these assumptions or models are not correct or circumstances change, the actual performance may vary substantially from, and be less than, the estimates included herein. None of Galaxy Digital nor any of its affiliates, shareholders, partners, members, directors, officers, management, employees or representatives makes any representation or warranty, express or implied, as to the accuracy or completeness of any of the information or any other information (whether communicated in written or oral form) transmitted or made available to you. Each of the aforementioned parties expressly disclaims any and all liability relating to or resulting from the use of this information. Certain information contained herein (including financial information) has been obtained from published and non-published sources. Such information has not been independently verified by Galaxy Digital and, Galaxy Digital, does not assume responsibility for the accuracy of such information. Affiliates of Galaxy Digital may have owned, hedged and sold or may own, hedge and sell investments in some of the digital assets, protocols, equities, or other financial instruments discussed in this document. Affiliates of Galaxy Digital may also lend to some of the protocols discussed in this document, the underlying collateral of which could be the native token subject to liquidation in the event of a margin call or closeout. The economic result of closing out the protocol loan could directly conflict with other Galaxy affiliates that hold investments in, and support, such token. Except where otherwise indicated, the information in this document is based on matters as they exist as of the date of preparation and not as of any future date, and will not be updated or otherwise revised to reflect information that subsequently becomes available, or circumstances existing or changes occurring after the date hereof. This document provides links to other Websites that we think might be of interest to you. Please note that when you click on one of these links, you may be moving to a provider’s website that is not associated with Galaxy Digital. These linked sites and their providers are not controlled by us, and we are not responsible for the contents or the proper operation of any linked site. The inclusion of any link does not imply our endorsement or our adoption of the statements therein. We encourage you to read the terms of use and privacy statements of these linked sites as their policies may differ from ours. The foregoing does not constitute a “research report” as defined by FINRA Rule 2241 or a “debt research report” as defined by FINRA Rule 2242 and was not prepared by Galaxy Digital Partners LLC. Similarly, the foregoing does not constitute a “research report” as defined by CFTC Regulation 23.605(a)(9) and was not prepared by Galaxy Derivatives LLC. For all inquiries, please email [email protected].
©Copyright Galaxy Digital Inc. 2026. All rights reserved.