Anthropic releases FlashProve, a way to prove which AI model wrote an answer

A receipt for an AI answer

Anthropic has released FlashProve, an open-source research prototype that produces a cryptographic proof that a language model's reply really came from a particular model. As Unite.AI reported, the proof works even though the model's internal numbers, called weights, stay private. The release is dated November 2, 2026.

The problem it targets is simple to state. A good answer does not tell you who wrote it. A routing service could quietly swap in a different system, a tester could be handed a different model than the one they meant to evaluate, or someone could tamper with the text on the way back. Rerunning the model to check is unrealistic when the weights are secret and the hardware is demanding.

How the proof works

Before any requests are served, the provider publishes a short commitment, which works like a fingerprint of one exact set of weights. The weights themselves are not revealed. Later, for a finished prompt and reply, the system builds a proof that the reply is what the committed model would produce.

The method is a zkSNARK, a kind of zero-knowledge proof: a compact mathematical argument that a claim is true without disclosing the private material behind it. FlashProve is software-only, so it does not rely on special trusted chips. Anyone with the commitment, the prompt and the reply can check the proof, and the check should leak neither the weights nor the intermediate values.

It also hides which specialist sub-networks fired for each word. Llama 4 Maverick is a mixture-of-experts model, meaning only a slice of it activates per token. The design exploits that: the prover's workload follows the roughly 17 billion parameters used per token, not the full 400 billion. The model's overall architecture remains visible.

What the numbers show

Anthropic tested a public 4-bit version of the model. On a server with one H100 graphics card and 24 CPU cores, it proved a batch of 24 requests in about 223 seconds. Each request got its own proof of 18.78 MB. The one-time commitment step took about 39 minutes.

Checking is much lighter. The verifier downloads a commitment of about 6.5 MB and runs on an ordinary CPU, with no GPU. Anthropic measured 17 seconds with 24 threads and 21 seconds with one thread.

Proving is the expensive side. Against the same model served normally on eight H100s with the vLLM serving software, Anthropic found proving needed about 72 times more GPU time per card for the same batch. At the heaviest load it tested on vLLM, the gap grew to about 94 times. The 110 tokens per second figure is real throughput, but it comes at a steep price.

Why it is not ready to rely on

The project is candid about its limits. The repository carries version 0.16.0, labeled an unmaintained research artifact that does not accept contributions. It includes a prover, a fast C++ checker, a slower checker written in Lean (a language for machine-verified math), and formal proofs under the Apache 2.0 license.

Only the slow Lean checker is formally tied to the security argument. The fast checker meant for everyday use has no such guarantee; it was tested to agree with the Lean one. The written formal statements also still need a human to confirm they capture the intended promises.

Anthropic's own documentation says AI systems working under human direction wrote nearly all the code, the formal proofs and the documentation, and ran the tests. No outside security audit has been done, and tests of weight hiding and of deliberately malicious proofs are limited.

The guarantee is also narrow. It covers an exact whole-number version of the weights with greedy decoding, meaning the model always takes its single most likely next word. Normal floating-point arithmetic or random sampling can drift from what was proved. Contexts are capped at 1,024 tokens, and timing-style side-channel attacks are out of scope. Because proofs are made after the fact, they also add recomputation and delay.

Who could use it, and what it cannot show

Anthropic points to customer integrity checks, independent evaluations, regulatory tools and enforcing rules that only approved models be used. In each case the value is the same: a buyer or auditor can confirm that the named model, not a cheaper stand-in, served the request.

One caveat matters for regulation. A certificate shows a request was served by a claimed model. It would not show that the same hardware was not also being used to train another model, so it cannot settle compliance rules built around how computing capacity is used.

The remaining work is to cut proving cost, support looser decoding and longer contexts, and bind the fast checker more tightly to the formal protocol. Until then, think of FlashProve as a demonstration that the idea can work, not a service to depend on.