Anthropic releases FlashProve for verifiable AI model outputs

The problem of model trust

When a user interacts with an AI through an API, they often have no way to know which specific model actually generated the response. A service provider could theoretically swap a high-quality model for a cheaper, less capable one to save on costs. They could also allow an attacker to tamper with the token stream during delivery.

Judging the quality of an AI's output is not a reliable way to verify its identity or integrity. Because the internal weights of these models are usually hidden, there is currently no standard way to confirm the source of the text. This creates a transparency gap for both end users and the regulators who oversee AI deployment.

Anthropic's Frontier Red Team developed FlashProve to solve this specific issue. It provides a way to verify text provenance, ensuring that the output came from a committed model. As MarkTechPost reported, this system targets a real gap in the current infrastructure of AI services.

How FlashProve works

FlashProve is a zkSNARK system, which is a type of cryptographic proof that allows one party to prove a statement is true without revealing the underlying data. In this case, the model provider acts as the prover and the user acts as the verifier. The system functions in two distinct phases to balance security and speed.

First, the provider goes through an offline phase where they publish a commitment. This is a short fingerprint that binds the output to one exact set of model weights. This process takes about 39 minutes and can cover roughly 16 million requests. During the online phase, the GPU produces a proof for each request, showing that the tokens were indeed produced by that committed model.

The system compiles an interactive oracle proof into a cryptographic proof using hash functions. Anthropic notes that this specific family of proofs is the same type used by validity-proof L2 networks like Starknet. They also claim the system offers post-quantum security, meaning it is designed to remain secure against future quantum computers.

Engineering and performance

Achieving high speeds for these proofs is difficult because cryptographic calculations are usually very heavy. Anthropic made three specific engineering choices to make FlashProve viable for large models. One key choice was scaling the prover work based on the active parameters of a mixture-of-experts model, rather than the total 400B parameters.

The team also designed the system so that weights stream from host memory. This allows a single 80 GB GPU to handle the task. Additionally, requests are proved in batches after they are generated, similar to how prefill works in standard inference. These optimizations allow the system to reach 110 tokens/second on a single H100 GPU for the Llama 4 Maverick model.

While the speed is high compared to previous open-source systems, there is still a significant cost. Proving costs between 70 and 95x the GPU time of standard vLLM inference. However, the resulting proof is only 18.78 MB and can be verified on a standard CPU in about 17 seconds, making it accessible for the end user.

Security and formal verification

Because cryptographic code is notoriously brittle, the team did not rely solely on standard testing. They formalized the entire protocol in Lean, which is a formal proof assistant. This means they mathematically proved the system's completeness, soundness, and zero-knowledge properties to ensure the code behaves exactly as intended.

The README for the project states that a cheating provider is caught except with a probability of about q/2^124 + 2^-101. To make the tool usable, Anthropic provided two different verifiers. One is a fast C++ version for daily use, while the other is a slower Lean verifier that provides a formal guarantee of soundness.

The team even used Claude to help optimize the system during development. Despite the complexity of the math, the goal remains simple: ensuring that the weights stay hidden while the output remains verifiable. This balance is essential for labs that need to detect tampered inference servers or for regulators enforcing AI pacing rules.

Future use cases

FlashProve is currently an open-source research prototype with some specific limitations. It is currently capped at a 1,024-token context window and is optimized for greedy decoding. It also primarily targets mixture-of-experts models for now, though the underlying technology could expand to other architectures.

Anthropic identifies four primary use cases for this technology. Regulators could use it to confirm that hardware is actually serving the inference it claims to, supporting AI pacing rules. Labs could also use it to detect if their inference servers have been tampered with by a third party.

For the average user, the technology provides a way to verify text provenance. It could eventually allow for a standard where AI providers must provide a