Anthropic introduces FlashProve to verify AI model origins

The problem of AI identity

Currently, AI models lack a clear way to prove their identity to the end user. When you interact with a chatbot, there is no reliable method to confirm that the response actually came from the specific model the provider promised.

Anthropic compares this to human interaction, where we recognize friends by their faces, voices, or handshakes. AI models lack these inherent identifiers, making it difficult to distinguish between a high-end model and a cheaper alternative.

As reported by heise.de, this lack of transparency creates several risks for consumers and businesses. Providers could secretly swap out expensive models for cheaper ones, or attackers could compromise servers to inject malicious code into AI responses.

How FlashProve works

Anthropic developed FlashProve as an open-source research prototype to solve this identification problem. It uses zero-knowledge proofs, a cryptographic method that allows one party to prove a statement is true without revealing the underlying data.

In this context, the system creates a cryptographic fingerprint of the model weights, which are the numbers that determine how an AI behaves. This allows a third party to check if a specific answer was calculated using those weights without actually running the model themselves.

To ensure the core security claims are accurate, Anthropic used Lean, a formal proof language, to provide additional verification. The team also utilized their own Claude model to help optimize the technical process of creating these proofs.

Testing and performance

The team tested FlashProve using Meta's Llama 4 Maverick, which is a mixture-of-experts model containing 400 billion parameters. During testing on an Nvidia H100 GPU, the system took 223 seconds to generate cryptographic proofs for 24 bundled requests.

While the proofs are relatively small at about 19 MB, the generation process is currently very demanding. Anthropic noted that creating a proof requires between 70 and 95 times as much GPU computing power as the standard processing of the requests.

Despite this high cost, it represents a major step forward from previous methods. An earlier procedure called VerInf required 14.3 hours to process 1,000 tokens and produced a massive 93.6 GB proof, making FlashProve significantly more efficient.

Who this affects

For businesses, this technology could provide a way to conduct independent audits. Companies could use it to prove that a safety analysis was actually performed on the specific model they claim to be using. This adds a layer of accountability to AI safety testing.

Regulators could also use these tools to monitor compliance. Authorities might use cryptographic proofs to verify that providers are following rules regarding the speed of AI development or other specific technical requirements.

For the average consumer, it offers a potential path toward greater trust. It provides a mechanism to ensure that the service you pay for is the service you are actually receiving, preventing 'model swapping' by service providers.

Current limitations

FlashProve is currently far from being ready for everyday use in commercial chatbots. The prototype can only handle requests with a context window of 1,024 tokens, which is quite small for long conversations.

The testing was also conducted on a 4-bit quantized version of Llama 4 Maverick. It remains unclear if the process will work efficiently for longer dialogues or for the regular operation of large-scale commercial AI models.

Anthropic has released the documentation in a GitHub repository, but they have explicitly labeled it as an unmaintained research prototype. This means it is intended for study and development rather than immediate production deployment.