The report
In its October 19 Frontier Safety Roadmap update, Anthropic reported signing all internal token traffic and building a production-inference prototype that checks whether outputs came from a designated set of model weights. The company says the new signing system revealed one rare, benign integrity anomaly. Neither statement describes a public, independently audited attestation available for every customer request.
The company also changed the project's terminology from "provable inference" to "inference verification." That distinction is substantive: the published goal is assurance about the integrity and provenance of an inference stream, not a claim that every response has a cryptographic proof of all computations or later tool effects.
Separately, Anthropic's security roadmap targets July 1, 2027 for broader infrastructure hardening. Its stated completion threshold is at least 60% of listed security invariants fully or nearly implemented and at least 80% mostly implemented. The desired measures include short-lived identities, allowlisted egress, verified software supply chains, and weight decryption only on attested machines. These are targets with specified assessment procedures, not controls the public can assume are already operating across all deployments.
Why checkpoint integrity matters can be seen in two distinct controlled studies. A malicious-LoRA experiment induces secret reading through a shell-capable agent; RAGLeak uses altered generator behavior to encode private retrieved content in answers. Knowing exactly which weights produced a token stream helps establish provenance, but it cannot itself restrict DNS access, private retrieval permissions or output recipients. These studies do not establish a breach of Anthropic infrastructure.
The unresolved evidence is the binding across the whole workflow: identified weights, trusted runtime, authentic input, generated output and effectful tools. The roadmap explains an architectural direction and some internal progress. It does not yet establish a third-party-verifiable end-to-end guarantee.