Anthropic Releases FlashProve to Prove Which AI Model Produced a Response

The system targets a problem that grows as more companies reach AI models through intermediaries. A customer paying for a premium model through an API has no simple way to confirm that the provider, or a routing service in between, has not quietly swapped in a cheaper model. Anthropic's post also mentions an attacker tampering with the stream of output tokens as a risk. Its answer, in the post's words: "Cryptographic proofs of inference solve this problem."

How It Works

FlashProve runs in two stages. In an offline stage, the party serving the model publishes a commitment to its weights. This is a short fingerprint that pins down one exact set of weights while keeping them hidden. In Anthropic's tests, creating the commitment took about 39 minutes on a single Nvidia H100 and covered about 16 million requests.

In the online stage, the server produces a proof for each request stating that the committed model generates the given output tokens. Anyone with the commitment, the prompt and the reply can check the proof without access to the weights. Technically the scheme is a zkSNARK built with hash functions, which Anthropic says also gives it security against future quantum computers.

Anthropic demonstrated the prototype on Meta's Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, using its public 4-bit weights. Because only about 17 billion parameters are active for each token, the proving work grows with that smaller number rather than the full model size. On one H100 with 24 CPU cores, the prover handled about 110 tokens a second. A batch of 24 requests took about 223 seconds. Each proof is about 18.78 MB and can be checked on an ordinary CPU in about 17 seconds using 24 threads, or about 21 seconds on a single thread. The client first downloads a commitment of about 6.5 MB.

Costs and Limits

The overhead is still large. Anthropic puts the cost of proving at roughly 70 to 95 times the GPU time the vLLM serving engine needs to run the same requests. Proofs are generated in batches after the responses have been served, not in real time.

The company lists several limits. The proof covers an integer version of the model under greedy decoding, not the floating-point arithmetic and sampled outputs that production systems usually use. Context is capped at 1,024 tokens. The model's architecture is not hidden, only its weights. Side-channel attacks such as timing analysis are out of scope. Anthropic also says there is no formal guarantee that the fast executable code matches the protocol it has verified in the Lean proof assistant.

The code, the Lean proofs, a technical report and the protocol specification are released under the Apache 2.0 licence. The Llama weights are not included and must be downloaded separately under Meta's licence. Anthropic has not said it plans to use the system across its own API.

Why It Matters

For companies that buy models through clouds, resellers or routing platforms, being able to verify which model answered would support procurement, audit and compliance checks. Anthropic says the approach could help with tamper detection, tracing where text came from, enforcing model approvals and checking compliance with rules on how quickly AI capabilities are released. It could matter most to governments and regulated industries that need to show an approved model was used. At current costs and limits, FlashProve shows the idea can work on a frontier-scale open model. It is not yet a tool that can run alongside live traffic.