Anthropic's FlashProve verifies which AI model wrote a response

Anthropic has released FlashProve, an open-source research prototype that uses cryptography to prove which AI model generated a given response — without exposing the model's weights. The company itself stresses the system has significant limitations, and the fine print matters more than the headline.

Anyone sending a query to an AI model today has no way to verify that the claimed model actually produced the answer. A routing service could quietly swap in a cheaper model to cut costs. An attacker could tamper with the data stream. Anthropic says FlashProve is designed to close that trust gap.

That gap is not hypothetical. As AI inference moves through intermediaries — API routers, aggregators, enterprise gateways — the party paying for a frontier model has no independent check that a frontier model answered. Verification is also a live regulatory question: authorities drafting rules for high-risk AI deployments need a mechanism to confirm which system actually ran. In short: the stakes are commercial and policy-driven at the same time.

How does FlashProve actually work?

FlashProve relies on a cryptographic technique called zkSNARK (a zero-knowledge proof system that lets one party prove a computation was performed correctly without revealing the underlying secret data). The model provider first creates a digital fingerprint of the model's weights — the trained parameters that define the model's behavior. With every response, the provider then delivers a compact proof showing that this specific model generated the output. The proof reveals nothing about the secret weights themselves.

The mechanism is verification without disclosure. A regulator, customer, or auditor can check the proof against the published fingerprint and confirm the claimed model produced the claimed output. They learn nothing about the model's internals in the process.

Takeaway: the scheme replaces "trust the provider" with "check the math" — in principle.

Is the performance actually practical?

According to Anthropic's technical report, FlashProve generates proofs at roughly 110 tokens per second on a single H100 GPU for Meta's Llama 4 Maverick, a 400-billion-parameter model. Each proof is about 19 megabytes and can be verified in 17 seconds on a standard CPU.

That performance comes at a cost. Anthropic's own numbers show overhead of roughly 70x to 95x compared to normal inference. Producing a proof is, in other words, one to two orders of magnitude more expensive than simply running the model.

The comparison to prior work is nonetheless stark. Anthropic says the only comparable open-source system previously available took over 14 hours to process 1,000 tokens, and it produced a 93.6-gigabyte proof that took nearly a full day to verify. FlashProve cuts that to seconds per proof and megabytes instead of gigabytes. Whether 70x–95x overhead is "practical" depends entirely on the use case: negligible for occasional audits, ruinous for high-volume consumer traffic.

Takeaway: the numbers are a genuine step change, but the overhead still confines the system to low-frequency, high-stakes checks.

Who would use it — and for what?

Anthropic lays out several use cases, each aimed at a different trust problem:

• Regulators could check whether a provider is actually running only approved models, rather than a substituted or unvetted system.
• Companies could prove their code was reviewed by a specific safety model — a verifiable audit trail for automated code review.
• Providers could detect tampering on their own servers, such as an attacker — or a more advanced model slipping in unnoticed — replacing the deployed system.

The third scenario is the most striking. Anthropic frames FlashProve partly as a defense against a future in which a capable model inside a provider's infrastructure interferes with inference. That framing aligns with the company's long-stated concern about agentic AI systems acting outside intended boundaries.

FlashProve also lands ahead of Anthropic's own schedule. In its Frontier Safety Roadmap, the company had set a goal of building an inference verification prototype by September 2026. Anthropic says it already hit that target through a separate project that signs inference traffic and traces the computation on a trusted server. FlashProve pursues the same goal but takes a purely cryptographic approach and does not need trusted hardware — meaning it does not depend on the honesty or integrity of the server running the model.

Takeaway: the same proof serves auditors, customers, and providers watching their own infrastructure.

What are the catches?

The catches are substantial, and Anthropic lists them itself. FlashProve currently only proves contexts of up to 1,024 tokens — far below the context windows of current models, which routinely handle hundreds of thousands of tokens. A system that cannot verify long documents or extended conversations covers only a slice of real AI usage.

The protection is also narrower than "proves the model." FlashProve hides the model's weights but not its underlying architecture. Anyone verifying a proof learns the structure of the network, even if the trained parameters stay secret.

The most consequential limitation concerns sampling. The proof only works when the model picks the single most likely next token — greedy decoding — not with the randomized outputs that chatbots typically produce in everyday use. Real conversational AI samples from a distribution to vary its answers; FlashProve, as released, cannot prove those responses. That gap sits squarely between the prototype and its stated use cases.

The full code, Lean proofs (machine-checkable mathematical proofs of the system's correctness, written in the Lean proof assistant), and documentation are available on GitHub under the Apache 2.0 license. The open licensing suggests Anthropic wants external scrutiny of the cryptography — a reasonable posture for a system whose value depends entirely on being trustworthy.

Takeaway: short contexts, revealed architecture, and no support for randomized outputs keep this firmly in the research column.

What happens next?

FlashProve sets a reference point for verifiable AI inference: proofs at 110 tokens per second, 19-megabyte artifacts, 17-second verification, and honest accounting of a 70x–95x overhead. Extending the technique to long contexts and sampled outputs — the two features everyday chatbot traffic requires — is the obvious next hurdle, and Anthropic has not said when either will arrive. Until then, the prototype proves the concept can be fast; it does not yet prove it can be normal.