Anthropic's FlashProve Proves Which AI Model Answered You

When you ask an AI model a question, you have no reliable way to check that the model you selected is the one that answered. A routing service could quietly swap in a cheaper model to cut its costs. A compromised server could alter the token stream mid-reply. Judging from the output alone does not settle it, even when the answer looks good. Anthropic is now showing what a fix could look like: a cryptographic proof attached to every response that proves exactly which model produced it.

The system is called FlashProve, and Anthropic published it as open-source research code this week. The repository landed on GitHub on October 30, with the research announcement following on November 2 (per Superpower Daily's reporting) and press coverage on November 3. This is breaking-news coverage of that release: what FlashProve does, the numbers Anthropic reports, and the limits the team itself lists.

The problem: the model you picked might not be the model that answered

FlashProve targets what Anthropic calls "provable inference": letting someone with limited hardware verify that a response came from the model the provider claimed, without seeing the model's weights. The motivation is commercial as much as technical. Third-party routing services sit between customers and model APIs today, and those middlemen decide which weights actually run. Independent evaluators face a related problem: they benchmark a model before release, then have no way to confirm the deployed version is the same one.

As TechCrunch reported, the researchers explicitly name the cheat they want to stop: a lab secretly swapping in a cheaper model to cut costs, or a pricier one to inflate its benchmark scores. Anthropic's post adds a more adversarial scenario: an advanced model substituting itself for an authorized weaker one, to dodge the classifiers and monitoring that would apply to it. The technology at the center is a zkSNARK — a zero-knowledge succinct argument of knowledge. In plain terms, it is a short certificate proving a computation ran correctly, which reveals nothing beyond that correctness and is much faster to check than to redo.

How it works: commit, prove, verify

FlashProve runs in three steps. First, in an offline phase, the provider publishes a commitment to the model's weights. Anthropic describes it as a short fingerprint pinning down one exact set of weights while the weights themselves stay hidden. Every later inference claim gets checked against that commitment. Second, for each reply, the provider's GPU produces a proof that the reply is the committed model's output. Third, anyone can check that proof on an ordinary CPU in seconds, with Anthropic's cp_verify tool, without holding the weights.

The GitHub repository spells out the practical flow, including one rule Anthropic flags as critical: get the commitment ID from a party your user trusts, never from the server being checked. The proof says the output came from the committed weights; it cannot say the commitment belongs to the model named in the marketing copy. That trust boundary matters, and it comes up again in the limits below.

Two details are worth naming precisely because they are easy to misread. The system hides the weights but not the architecture: hiding the model architecture "is not a goal of this system," per Anthropic's post. And the fingerprint-plus-proof combination is aimed at inference-time honesty, not training-time honesty. Anthropic states openly that the check "does not establish that the hardware is not, e.g., training on the side." (Anthropic's research post, official.)

The numbers Anthropic reports

FlashProve is tested on Meta's Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model run in 4-bit quantization, not a Claude model. (Anthropic reports no results on Claude.) The headline figures, all from Anthropic's own testing:

• A single NVIDIA H100 GPU generates proofs at about 110 tokens per second, using integer arithmetic in the prefill phase.
• A 1,024-token request produces a proof of roughly 19 MB.
• Proving takes about 70 to 95 times the GPU time of running the same model on vLLM, a common open-source inference library. Anthropic notes this is substantially faster than prior open-source systems. An independent roundup by AlphaSignal puts the nearest full-model comparison, VerInf, at roughly 0.02 tokens per second on the same model, and ZKML at 0.006 on a tiny GPT-2. Treat that table as compiled by a third party, not a controlled benchmark, since hardware and settings differ across systems.
• Verification needs only a CPU: Anthropic measures seconds on a 24-core machine (AlphaSignal's read of the report says about 17 seconds with 24 threads, 21 with one).
• The one-time commitment step takes about 39 minutes and produces a roughly 6.5 MB commitment that can be reused across requests (both figures via AlphaSignal's report).
• At the quoted security parameters, the chance of a fraudulent proof passing verification is bounded by roughly q/2124 + 2-101 after q hash queries. The theorem is machine-checked in Lean 4.

The code is out under Apache 2.0, the commit → prove → verify flow is fully documented, and the repository even ships a toy route: build the verifier (one to two minutes, under 2 GB of RAM), then check a stored example proof in under two seconds. As of this writing the repo shows 369 stars and 32 forks. Note the asymmetry in hardware: verifying a proof needs almost nothing, but proving at full Maverick size needs around 330 GB of RAM, 245 GB of disk, and a 232 GB public 4-bit weight download, per the README. This is verifier-cheap, prover-expensive by design.

Four jobs this technology could do

Anthropic frames the release around four trust challenges, and they read as a roadmap for who would actually use this:

1. Pacing AI development. Some regulatory proposals rely on monitoring hardware and how it is used. One example: checking that a lab's GPUs are serving inference rather than secretly training a new model. A regulator could demand certificates covering a period's requests. Anthropic says such proofs "could contribute to a toolkit for verifying compliance with AI pacing requirements," with the stated caveat about side-training noted above.
2. Tamper detection. Compromised inference servers could serve malicious responses or altered token streams. A provider requiring a valid zkSNARK on every response forces any attacker to produce valid proofs for the expected weights, which — under the cryptographic assumptions — they cannot do.
3. Text provenance. A developer claiming a frontier model scanned their library for vulnerabilities, or a company claiming a specific model reviewed its business plan, could back the claim with a proof instead of a chat log anyone could have faked.
4. Model approval. If regulation ever requires serving only approved models, proofs could enforce it: each request is bound to the model used, so swapping in an unapproved model fails verification.

This work connects to a public goal Anthropic set earlier. Its frontier safety roadmap included building a provable-inference prototype by September 30, 2026. The post says that goal was met through a separate project, one that signs inference traffic and recomputes it on a trusted server, while FlashProve pursues the same objective through cryptography instead.

The honest limits, in Anthropic's own words

The team is unusually direct about what FlashProve is not. This section is drawn from the repository and research post, not any reviewer's gloss:

• No deployment plans. "This research post is meant to share intermediate progress, and not a completed research agenda," the researchers write. TechCrunch confirms there are no plans to deploy it at Anthropic or any other lab.
• It proves the commitment, not the label. The proof binds a response to committed weights — it cannot verify that those weights are the model the lab claims. You still trust the lab (or whoever published the commitment) on that mapping.
• One configuration only. Llama 4 Maverick at 4-bit, contexts up to 1,024 tokens, far below current long-context windows. No Claude coverage, no other models.
• Restricted arithmetic and decoding. The system proves an integer-arithmetic version of the model, so a standard floating-point deployment could differ. The proved decoder uses greedy decoding — always the highest-scoring token — while temperature and sampling need more work. (Superpower Daily flags the BLAKE2 hash idealization as another theoretical caveat.)
• Visible architecture, uncovered side channels. The mixture-of-experts structure is visible to the verifier; timing and resource-use patterns that could leak private values are out of scope.
• Proofs arrive after generation. Systems would need to tolerate verification latency and keep enough request data to match responses to proofs later.
• Research status. The repository calls itself "a research artifact: not maintained, not accepting contributions." Anthropic also notes that the Lean proof covers the formal protocol, not the full optimized C++ implementation.

One more wrinkle, flagged in Anthropic's own post. The team discloses that Claude produced much of the optimization work behind the speed gains, then cautions that "Claude is good at optimization, but often makes decisions that are hard to evaluate, especially in large complex systems." The countermeasure is the machine-checked Lean formalization of the top-level security claims, plus an interactive visualizer for auditing the theorems. (For context on the tool that did the building, see our Claude Code explainer.)

What people will get wrong about this

Three mistakes are already circulating, and all three are worth killing early. First: FlashProve does not check whether an answer is correct or good — a perfectly proved response can still be a hallucination. The proof is about identity, not quality. Second: nothing here is inside Claude or any production API. This is standalone research code for a different model entirely. Third: the ~19 MB proof size is per 1,024-token request, and the 70–95× overhead is GPU time versus vLLM inference. It does not mean the system is 70–95× more expensive in total-cost-of-ownership terms, since Anthropic's comparison excludes the original inference work itself. Treat the number as a research benchmark, not a pricing sheet.

On pricing, there is nothing to print. The software is free under Apache 2.0, and there is no hosted product. The real cost is the proving hardware: one H100 and serious memory for the full pipeline. That is why the practical near-term uses would be sampled checks (evaluation runs, disputed outputs, high-risk transactions) rather than certifying every chat message.

Who should pay attention

Model-evaluation labs get the clearest near-term angle: FlashProve is designed to settle whether the model under test matches the model being served. API buyers paying per token through routing services get a second angle. A future version could turn "you served the model I paid for" from a contractual promise into something checkable. Regulators and standards bodies get the third, since the post is explicit about compliance tooling. For researchers, the artifact is the point: five published pieces (post, technical report, protocol spec, code, Lean proofs) under a permissive license, with an open invitation to improve the 70–95× overhead that currently keeps it out of production.

Frequently asked questions

Is FlashProve built into Claude or the Anthropic API?

No. It is a standalone open-source prototype tested on Meta's Llama 4 Maverick, a model with publicly available weights. Anthropic reports no results on Claude and states there are no plans to deploy the system at Anthropic or any other lab. Treat it as research code, not a product feature.

How much does it cost to run FlashProve?

The software is free under Apache 2.0. Proving needs real hardware: a single NVIDIA H100 GPU, roughly 330 GB of RAM and 245 GB of disk for the full Maverick pipeline, plus a 232 GB weight download. Verification is cheap: an ordinary Linux CPU with under 2 GB of RAM, seconds per proof. Anthropic's research puts proving at 70–95× the GPU time of vLLM inference.

Can a provider still cheat with FlashProve in place?

Yes, in specific ways. The proof ties a response to committed weights, but it cannot confirm the provider labeled those weights honestly. Get the commitment ID from a party you trust, never from the server under test. It also cannot detect training happening on the side, and side-channel leaks like timing are out of scope. The guarantee is narrow: the committed model produced this exact output.

Does the proof hide everything about the model?

No. It hides the weight values and which experts ran for each token, but the model architecture stays visible. Anthropic is explicit that hiding the architecture is not a goal of the system.

Where can I read or try it?

The research post is on anthropic.com/research/provable-inference and the code on github.com/anthropics/FlashProve, both under Apache 2.0. The README's first route is simple: build the C++ verifier and check a stored example proof. It needs only g++ 13, make, and python3 on Linux, and takes a couple of minutes. The repo warns it is a research artifact, not maintained and not accepting contributions.

FlashProve answers one narrow question with unusual precision: which committed model generated this response, with the weights kept private. Everything around it remains someone else's problem: whether the lab labeled the commitment honestly, whether the answer is any good, whether the same hardware was also training something else. That narrowness is the point, and Anthropic's own limits list says so plainly. The open question is whether the 70–95× overhead can be driven down enough, by others, to make cryptographic receipts practical anywhere beyond audits and evaluations.

Sources:

• Anthropic, "Progress on provable inference for large language models" (official research post) — anthropic.com/research/provable-inference
• anthropics/FlashProve on GitHub (official repository) — github.com/anthropics/FlashProve
• TechCrunch, "Anthropic is working on a system to prove AI models' identity" (Nov 3, 2026) — techcrunch.com
• Superpower Daily, "Anthropic releases prototype for proving which AI model produced an answer" — superpowerdaily.com
• AIStockWire, "Anthropic FlashProve: proving which AI model wrote a reply" — aistockwire.com
• AlphaSignal, "Anthropic's FlashProve Cryptographically Proves Which AI Model Answered You" — alphasignal.ai