> As models become capable of improving and deploying themselves ... how can a company be sure of which weights are actually running on its servers?

I find this a bit odd and backwards. Why do we choose not to make the deployment code to be robust, but instead to observe the model inference as proven? This moves unobservability layer to the system that collects the proofs. Given the assumption that code is fluid and LLMs are rewriting it often, how can we know it isn't being abused against the observer?

Goes without saying, it's also disappointing that this has nothing to do with making the model inference observable for consumers.

Anthropic here is solving one of their own problems, how to make sure you don't combine other company's models with their stuff for example, and make it sound as if they did it for you.

It makes the inference more expensive and helps controlling the users.

I assume this alludes to their prior work with models running on smart TVs being able to setup inference on additional smart TVs. The idea being that you can't be sure that, having gone through the whole deployment process, your hardware has not been subverted to run a different model. Any level of "robust" code you can imagine to prevent this in the traditional ways could be subverted on the fly by a capable model.

> This moves unobservability layer to the system that collects the proofs.

I'd say it's adding security through a secondary system, rather than displacing security to a secondary system. Security by layers.

I think some model providers are implementing "eyes glaze over" where if you ask a boring simple question they route it to a cheap model but charge you for an expensive model, so consumers may want a proof of work certificate to know they're getting what they pay for.