Anthropic releases FlashProve, a way to prove which AI model wrote a reply

The problem: you can't see the engine

As technews.tw reported, Anthropic published research describing FlashProve, an open-source prototype that tackles a simple question: when you ask an AI something, how do you know it is the model you chose?

Anthropic points out that users have no way to confirm this today. A routing service could quietly swap in a cheaper model to save money, and an attacker could tamper with the output. Judging by answer quality alone does not settle it.

A fingerprint plus a receipt

The provider first publishes a commitment, which works like a fingerprint of the model's weights (the numbers that make up the model). It locks in one exact set of weights without revealing them.

Each reply then comes with a proof. Anyone holding the commitment, the prompt and the reply can check it. TechCrunch compared this to a digital signature on a letter. Even the company that built and runs the model could not fake it.

The core technique is a zkSNARK, a zero-knowledge proof: it shows a computation was done correctly without exposing the secret inputs. The same family of technology is used by Ethereum second-layer networks such as Starknet, and it resists quantum attacks.

Speed, size and the price tag

Anthropic tested it on Llama 4 Maverick, a mixture-of-experts model compressed to 4-bit precision. One H100 GPU produced about 110 tokens of proof per second. A 1,024-token request yielded a proof file of about 19MB.

Checking needs only a CPU: about 17 seconds with 24 threads. An earlier system, VerInf, took 14.3 hours for 1,000 tokens and produced a 93.6GB proof.

The catch is cost. Generating proofs takes 70~95 times the GPU time of normal inference with vLLM, a common serving tool.

Built with Claude, and still limited

Anthropic says Claude did most of the optimization work. The team then used Lean, a language for machine-checked proofs, to prove the system's completeness, soundness and zero-knowledge properties. Contributors came from Anthropic, EPFL, MIT, StarkWare and Succinct.

The limits are real:

• Context length is capped at 1,024 tokens.
• It covers only integer arithmetic and greedy decoding (always picking the most likely next token).
• The model's architecture cannot be hidden.
• Side-channel attacks are not addressed.
• The fast C++ verifier used day to day has not been formally verified.

Where it could be used

Anthropic sees uses for regulators who want to confirm a company serves only approved models, for spotting a compromised server or a swapped model, and for proving that software was scanned by a top security model.

The company had set a goal of a provable-inference prototype by September 30 this year. It says it met that through a separate project that signs inference traffic, while FlashProve pursues the same goal by a different route. It calls this interim research and has released everything under Apache 2.0, hoping outsiders will test and improve it.