Anthropic Releases FlashProve, an Open-Source System for Proving Which Model Answered

The company said the work responds to a gap that grows as more AI traffic passes through intermediaries. Today a user cannot confirm that an answer came from the model they chose, rather than from a cheaper model a routing service has quietly swapped in, or from an attacker who has tampered with the token stream. Anthropic argued that judging from the output alone is unreliable, even when the output is good.

The post lists eight authors: researchers from Anthropic and its fellows programmes, plus collaborators from EPFL, StarkWare, MIT and Succinct.

How It Works

FlashProve is built on zkSNARKs, a type of zero-knowledge succinct argument. The provider first commits to a model and then attaches a short proof to each response. A user can check that proof cheaply and learns nothing about the model's weights. If the response did not come from the committed model, the check fails. Anthropic said the system is designed to hide the weights but not the model's architecture.

Anthropic published benchmark figures for Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, running with 4-bit quantised weights. A single Nvidia H100 GPU generated proofs at around 110 tokens per second, with each 1,024-token request producing a proof of about 19 MB. The company said this takes roughly 70 to 95 times the GPU time of simply running the model on vLLM, a widely used open-source inference library. It described prior open-source systems as orders of magnitude slower.

According to Anthropic, Claude produced the improvements to zkSNARKs for inference by finding new ways to apply existing techniques from the cryptography and security literature. The company also said that Claude's optimisation choices in large, complex systems can be hard to evaluate. To deal with this, it wrote the top-level security guarantees as auditable statements in Lean, a formal verification language.

What Is Being Released

Anthropic is publishing five artifacts under the Apache 2.0 licence: the blog post, a technical report, a protocol description, executable code and Lean proofs. The code includes a prover and two verifiers, one fast verifier in C++ and one provably correct verifier in Lean. The Lean proofs come with an interactive visualiser to help auditors. The company called the release intermediate progress, not a finished research agenda, and invited others to build on it.

Why It Matters

Anthropic named several groups that would benefit. Independent evaluators who test models before and after release need to know they are testing the model that is actually deployed. Companies that reach models through third-party routers want to know they are getting the model they pay for. Security teams want a way to spot tampered outputs.

The company also linked provable inference to regulation. It said such proofs could let providers show they are meeting commitments and legal obligations, and could form part of a toolkit for verifying compliance with AI pacing requirements. That gives the research weight for policymakers who are weighing how far AI rules can be enforced.

The main obstacle is cost. With proofs needing tens of times the compute of the inference itself, the system is not yet practical for routine consumer traffic. It looks better suited to high-assurance uses such as audits and evaluations while the overhead comes down.