Anthropic releases FlashProve, a prototype for proving AI responses

Anthropic has published research describing a cryptographic method for proving that a specific AI model, rather than a substitute, generated a given response. The company released an open-source prototype of the system, called FlashProve, under the Apache 2.0 license.

The problem it addresses: a person or company using an AI model today has no reliable way to confirm a response came from the model they requested. Anthropic says a routing service could quietly swap in a cheaper model to cut costs, or an attacker could tamper with the text a model produces while posing as that model. Judging by the output alone does not solve this, the company says, even when the response looks correct.

FlashProve relies on a zkSNARK, a short proof that a computation ran correctly, built so it reveals nothing extra. A provider commits to a specific set of weights, the numerical values that define a trained model, then generates a proof alongside each response showing the committed model produced it. The proof hides the model’s weights, though it does not hide the model’s architecture, Anthropic says.

In testing, the company ran FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model that splits work across many smaller subnetworks, using 4-bit quantized, or compressed, weights. A single Nvidia H100 GPU generated proofs at about 110 tokens per second, with each proof covering a 1,024-token request running to roughly 19 megabytes. Anthropic says that is 70 to 95 times the GPU time that vLLM, a widely used open-source library, takes to run the same model without generating a proof. The company says prior open-source systems for this kind of proof are orders of magnitude slower.

The release includes a prover, two separate verifiers, one written in C++ for speed and one written in Lean, a formal verification language, for provable correctness, plus a set of Lean proofs covering the system’s top-level security claims and an interactive visualizer meant to help outside researchers audit them. Anthropic says it used Claude to help build the system and write parts of the accompanying protocol specification, while relying on established cryptographic design principles.

Anthropic lists several potential uses: independent evaluators confirming a deployed model matches the one they tested, customers of third-party routing services confirming they got the model they paid for, and detection of a compromised server or a more capable model impersonating a weaker one it is permitted to run instead. The company also says the approach could help regulators check that computing hardware is being used for inference rather than diverted elsewhere, such as training, though it notes the proofs alone cannot rule out the hardware being used for something else at the same time.

Anthropic ties the release to a commitment in its Frontier Safety Roadmap to prototype provable inference by September 30, 2026, a target it says it already met through a separate, related project that signs inference traffic and recomputes it on a trusted server. FlashProve pursues the same goal by a different technical route. The company describes the work as intermediate progress rather than a finished research agenda, and says it is publishing the code and proofs so other researchers can extend them.