Anthropic Open-Sources FlashProve to Prove Which Model Produced an AI Response

The work, published on November 2 by the company's Frontier Red Team together with researchers from EPFL, MIT, StarkWare and Succinct, addresses a gap that matters to regulators and to companies buying AI services: a person sending a prompt usually has no way to check which model actually answered. A routing service could quietly substitute a cheaper model, or an attacker who had compromised a server could tamper with outputs, Anthropic wrote.

FlashProve relies on a zero-knowledge succinct argument, or zkSNARK. In a one-off step, the provider publishes a commitment, a short fingerprint of its weights. For each response it then generates a proof that the committed model produced those exact output tokens. A verifier can check the proof without learning anything about the weights. The authors said the construction is hash-based and offers post-quantum security, and that its core properties are formally stated and proved in the Lean proof assistant.

Speed and Cost on Llama 4 Maverick

Anthropic tested the system on Meta's Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, using 4-bit weights. On a single Nvidia H100 GPU, the prover generated proofs at about 110 tokens per second. Each proof for a 1,024-token request is about 19 megabytes, and an ordinary CPU can verify one in about 17 seconds using 24 threads, or about 21 seconds on a single thread. The one-off commitment step takes about 39 minutes per model.

That is still expensive. Compared with serving the same model on vLLM across eight H100s, proving takes roughly 70 to 95 times more GPU time, or about two orders of magnitude, the authors wrote. It is nonetheless far quicker than earlier attempts. Anthropic cited one prior system, VerInf, which took about 14.3 hours to handle 1,000 tokens of the same model and produced a 93.6-gigabyte proof that took almost a day to verify.

Part of the gain comes from design choices. The prover's work scales with the roughly 17 billion parameters active for each token rather than all 400 billion, requests are proved in batches after inference rather than as they are served, and model layers are streamed so that a single 80GB GPU is enough.

Uses for Regulators and Providers

Anthropic set out several applications. Regulators could confirm that a provider serves only approved models without rerunning its requests, or check that hardware is being used for inference rather than training, although the company noted a proof cannot show the hardware is not also training on the side. Providers could detect tampering, since a compromised server, or a model that had swapped itself out, would fail to produce valid proofs. Companies could also prove that a specific model had carried out a task such as a code review.

The project ties to a commitment in Anthropic's Frontier Safety Roadmap to build an inference verification prototype by September 30, 2026. The company said it met that deadline through a separate project that signs inference traffic and recomputes it on a trusted server. FlashProve pursues the same aim through cryptography alone, without relying on trusted hardware.

Limits on the Prototype

The authors were explicit that the system is not ready for production. Proofs cover contexts of only up to 1,024 tokens, far below what chat products and frontier models handle. They apply to an exact integer version of the model under greedy decoding, so outputs produced with the floating-point arithmetic and random sampling that chatbots typically use may not match. The weights stay hidden but the model's architecture does not, and side channels such as timing are out of scope. The fast C++ verifier meant for everyday use carries no formal guarantee; a slower verifier written in Lean does.

The demonstration uses Meta's openly available model rather than Claude. The prover, both verifiers, the Lean proofs and a technical report are published on GitHub under the Apache 2.0 licence, and Anthropic has invited others to build on the work.