Anthropic has released FlashProve, an open-source research prototype that attaches a cryptographic proof to an AI response showing it came from one specific, committed model. The Anthropic FlashProve release targets a simple but stubborn problem: today, you usually cannot check whether the model you picked is really the one answering you. The company says the proofs reveal nothing about the model’s private weights.
What Anthropic FlashProve Actually Does
When you send a prompt to an AI service, you trust that the provider ran the model it promised. A routing service could quietly swap in a cheaper model to save money, or an attacker could tamper with the text stream on its way to you. Judging by the quality of the answer alone does not settle the question.
FlashProve tackles this with a type of cryptographic proof called a zkSNARK, short for zero-knowledge succinct argument of knowledge. In plain terms, the provider hands over a small “certificate” that anyone can check quickly. If the reply did not come from the promised model, the check fails.
Two phases: commit, then prove
The system works in two steps. First, in an offline phase, the provider publishes a commitment, a short fingerprint that locks in one exact set of model weights while keeping those weights secret.
Later, for each request, the provider generates a proof that the committed model, run on that prompt, produces exactly those output tokens. Anyone holding the commitment, the prompt and the reply can verify it without seeing the weights and without a powerful computer.
How Fast Is FlashProve?
Anthropic tested the prototype on Meta’s Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, using a public 4-bit version of its weights. Because only about 17 billion parameters are active per token, the prover only has to do work for the parts of the model that actually ran.
| Measurement | Result reported by Anthropic |
|---|---|
| Proving speed | About 110 tokens per second on one H100 GPU |
| Proof size | About 19 MB per 1,024-token request |
| Verification time | About 17 seconds on a 24-thread CPU, no GPU needed |
| One-time commitment step | About 39 minutes per model |
| Cost versus normal inference | Roughly 70 to 95 times the GPU time of running the model on vLLM |
That overhead is still large, but it is a huge jump from earlier open systems. Anthropic points out that a previous proof of the same Maverick model took more than 14 hours for 1,000 tokens and produced a 93.6 GB proof that needed almost a day to check.
Why Provable Inference Matters for AI Safety
Anthropic lists several situations where proving which model answered would help. Independent evaluators who test models before release, like the groups Anthropic has worked with on outside model testing, need to know the model they evaluate is the one being served.
- Customers using a model through a third-party router could confirm they got the model they paid for.
- A company could catch a hacked inference server that serves malicious replies while pretending to be a trusted model.
- Regulators could check that a provider serves only approved models, without seeing its proprietary weights.
- A developer could prove a frontier model really spent effort scanning code, for example for security bugs.
The company also ties the work to its Frontier Safety Roadmap, which set a goal of a provable inference prototype by September 30, 2026. Anthropic says it met that goal through a separate project that signs its inference traffic, and that FlashProve pursues the same aim with a different, software-only method. It sits alongside other trust tools such as the Claude output watermark.
Claude helped build it
Anthropic says Claude found new ways to apply existing cryptography tools while the team kept to well-known design principles. To make the work easier to audit, the release includes formal statements written in Lean, a proof language, covering completeness, soundness and zero knowledge. Readers who follow Claude’s growing abilities will recognize the pattern from earlier math and security research.
What’s in the Open-Source Release
Anthropic is publishing the work under the Apache 2.0 license and says it wants others to take it and improve it. The package includes:
- A blog post explaining the system and its possible uses
- A technical report with the full protocol details
- A prover plus two verifiers: a fast one in C++ and a provably correct one in Lean
- Lean proofs of the main security statements, with an interactive visualizer for auditors
The Llama 4 weights themselves are not included. Anyone who wants to reproduce the results must download them separately under Meta’s license and needs a large GPU machine.
Limits Anthropic Spells Out
Anthropic calls this intermediate research, not a finished product. The proofs cover an exact integer version of the model using greedy decoding, so replies made with floating-point math or random sampling may not match the proved computation exactly.
Contexts are capped at 1,024 tokens, far shorter than real chat sessions. The model’s architecture is not hidden, side-channel attacks such as timing are out of scope, and the fast C++ verifier carries no formal guarantee, although Anthropic says it agreed with the Lean verifier on every proof it tested.
What This Means for You
You will not see FlashProve proofs in Claude or other chatbots tomorrow. Still, the release shows that checking which model answered you is becoming practical, which could change how AI services prove their claims.
- If you buy AI access through resellers or routers, model verification could one day become a standard feature to ask for.
- Security teams can watch this space as a defense against tampered or swapped models, a growing concern covered in our AI threat detection guide.
- Policy watchers should note that proofs like these could support future rules on which models providers may serve.
For more coverage of Anthropic’s research and product moves, browse our latest AI news.
Sources
Primary source: Anthropic’s provable inference research post. Additional reporting from Unite.AI.
Conclusion
FlashProve is an early but meaningful step toward AI replies that come with proof of where they came from. It is slow and limited today, with short contexts and large overhead, yet it runs a 400-billion-parameter model on a single GPU at speeds earlier systems could not approach. By releasing the code and formal proofs openly, Anthropic is inviting the wider field to make it faster and broader. If that happens, “which model am I really talking to?” may become a question you can actually answer.
