Anthropic open-sources FlashProve, a cryptographic system to prove which AI model produced a response

Anthropic has released FlashProve, an open-source prototype for what researchers call "provable inference": a cryptographic proof that a given output came from a specific AI model. TechCrunch reported on the research post on Tuesday, November 3.

The problem

Anthropic's researchers note that users today cannot check whether a response really came from the model a developer claims, rather than one secretly substituted by a routing service to cut costs, or by an attacker tampering with the token stream. Judging from output quality alone is unreliable.

FlashProve uses a type of zero-knowledge succinct argument known as a zkSNARK. A provider commits to a model by publishing a fingerprint of its weights and then attaches a short proof to each response. Users can verify the proof on an ordinary CPU, and the proof reveals nothing about the private weights, meaning closed-model makers could use it without giving up their most valuable asset.

Performance and limits

In tests on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, a single H100 GPU generated proofs at more than 100 tokens per second, with proofs of about 19 MB per 1,024-token request, roughly 70 to 95 times the GPU time of standard inference with vLLM, Anthropic said. The protocol's security properties are formally verified in the Lean proof assistant, and the code, proofs and documentation are published on GitHub under the Apache 2.0 license.

The researchers describe the work as "intermediate progress, and not a completed research agenda," and invite others to improve it. According to TechCrunch, there are no plans to deploy the system at Anthropic or any other lab yet.

Why it matters

TechCrunch noted the system could stop an AI company from quietly swapping in a cheaper model, or a more expensive one to inflate results, and could let third parties verify claims that a task was handled by a particular frontier model. Anthropic also points to uses for independent evaluators checking that the model they tested is the one being served, and for regulators seeking assurance that hardware is being used for inference.

Sources: Anthropic, TechCrunch, GitHub