Anthropic releases FlashProve to verify AI model identities

The problem of model trust

Developers who use AI APIs often face a transparency problem regarding the hardware and software powering their requests. There is currently little way for a customer to know if a provider is routing their data to a cheaper model or if an attacker has interfered with the responses. This lack of visibility creates a significant hurdle for companies requiring high levels of reliability.

Anthropic is attempting to solve this by introducing a way to verify the origin of an AI response. Their new system, called FlashProve, aims to provide a cryptographic guarantee that a specific model produced a specific output. This allows for a layer of trust that does not rely on simply taking the provider's word for it.

As reported by The New Stack, the goal is to help developers verify third-party services and detect compromised systems. By proving the model's identity without revealing its private weights, the system protects the provider's intellectual property while securing the user's experience. It creates a verifiable link between the input, the model, and the final output.

How FlashProve works

FlashProve relies on a cryptographic system known as zkSNARKs. These are used to verify that a response came from a specific set of model weights without actually revealing what those weights are. This ensures that the underlying model remains a secret while the integrity of the output is confirmed to the user.

To ensure the system is mathematically sound, the researchers used a tool called Lean for formal verification. This process involves proving the mathematical properties of the protocol to ensure it accepts valid proofs and rejects forged ones. The team specifically checked that the system does not reveal more information about the weights than what is already disclosed by the responses themselves.

The system includes two different types of verifiers for different needs. One is a faster C++ implementation designed for speed, while the other is a Lean version that is backed by formal mathematical proofs. While the C++ version passed comparison tests, it does not have the same mathematical guarantees as the Lean version. Neither of the two practical verifiers has been formally verified yet.

Performance and limitations

While FlashProve is faster than previous systems, it still faces significant hurdles for everyday use. Anthropic tested the system on Meta's Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model. During these tests, the system processed roughly 110 prompt tokens per second on a single Nvidia H100 GPU.

The primary barrier to adoption is the high cost of generating the proofs. Generating a proof requires 70 to 95 times more GPU time than standard inference using vLLM. Additionally, the system generates proofs in batches after requests are completed, meaning it cannot provide immediate verification as tokens are being delivered to the user.

The research also highlights several technical constraints that prevent it from being production-ready today. It is currently limited to 1,024 tokens of context and uses integer-based inference with greedy decoding. Most production models, however, rely on floating-point calculations and sampling to generate more nuanced and varied responses.

The path forward

Anthropic has released FlashProve as an open-source research artifact on GitHub. They have stated that the project is not currently being maintained and they are not accepting new contributions at this time. This means the tool is intended for researchers and developers to experiment with rather than for immediate integration into commercial products.

There is currently no indication of whether or when FlashProve will become a feature of the Claude API. For now, it serves as a proof of concept for how cryptographic verification can be applied to large language models. It shows that it is possible to verify model identity, even if the current computational overhead is too high for routine API traffic.

For developers who are already closely monitoring every token of their inference spend, the current GPU overhead is difficult to justify. However, as the technology matures and becomes more efficient, it could become a standard for high-security applications. It provides a foundation for a future where AI outputs can be cryptographically audited for authenticity.