Anthropic releases FlashProve to verify AI model responses

The problem of AI trust

When users interact with artificial intelligence today, they have very few ways to confirm which specific model is generating their responses. A developer might claim to be using a high-quality model, but a routing service could secretly substitute it for a cheaper version to save money. Even worse, a cyberattacker could intercept and modify the stream of text to deliver malicious content while pretending to be a trusted AI.

Judging the authenticity of a response based solely on the quality of the text is unreliable. Even if the output looks correct, there is no inherent way to know if the underlying weights were tampered with or swapped. This lack of transparency creates significant hurdles for independent evaluators, security-conscious clients, and government regulators who need to verify model behavior.

Anthropic is addressing these challenges through a concept called provable inference. This method allows a model provider to commit to a specific set of weights and then provide a mathematical proof for every response. These proofs ensure that the output was indeed produced by the claimed model without requiring the user to have the massive computing power needed to run the model themselves.

How zkSNARKs work

The core technology behind this progress is a cryptographic object known as a zkSNARK, or a zero-knowledge succinct argument of knowledge. In simple terms, a zkSNARK is a system where a prover can convince a verifier that a specific computation was performed correctly using a short certificate. The 'zero-knowledge' part means the certificate reveals no extra information about the private data, such as the model's weights.

The 'succinct' part of the name refers to the fact that it is exponentially faster to verify the proof than it is to run the original computation. This is vital for AI because running a frontier model requires enormous hardware resources that a typical user cannot access. With a zkSNARK, a user can verify a proof in seconds on a standard CPU, even if the original inference took a massive amount of power to complete.

Anthropic's new system, FlashProve, is a performant prototype specifically designed for large Mixture-of-Experts models. Mixture-of-Experts is a type of model architecture that scales by activating only certain parts of the network for different tasks. FlashProve manages to generate these proofs at a speed that makes them practical for real-world use cases rather than just theoretical research.

Performance and benchmarks

The researchers tested FlashProve on a 400B-parameter model called Llama 4 Maverick using 4-bit quantized weights. They found that a single H100 GPU could generate proofs at around 110 tokens per second. This speed is significant because it allows for near-real-time verification of the AI's output as it is being generated for the end user.

The size of the proof is also a key factor in the system's efficiency. For a request of 1,024 tokens, the proof size is approximately 19 MB. While this is larger than the text itself, it is much smaller than the data required to run the model. The researchers noted that the GPU time required to generate the proof is about 70 to 95 times the time it takes to run the model using a common open-source library called vLLM.

Compared to previous open-source systems, FlashProve is significantly faster. The team achieved these results by finding new ways to apply existing tools from the cryptography and security literature. They also used formal verification to ensure the security of the system, providing statements in a language called Lean to audit the mathematical guarantees.

Applications for security and policy

One major application for this technology is 'pacing' AI development. Regulators could require providers to submit certificates proving that their hardware was used for inference rather than for training new models. A provider would be unable to cheat by serving cheaper models to free up resources for training, as the zkSNARK would fail to verify against the committed model weights.

The system also serves as a defense against tampering and unauthorized model substitution. If a company's inference server is compromised, an attacker would need to produce valid proofs for the authorized weights to avoid detection. Because producing these proofs is computationally difficult without the correct weights, it creates a significant barrier for hackers trying to inject malicious responses or swap models.

Finally, the technology helps establish text provenance for high-stakes tasks. A developer could use a 'Proof-of-Failure' to show that a model spent a specific amount of tokens trying to find a bug in a piece of code. This provides a verifiable audit trail that a company actually performed the work they claimed to have done, rather than just faking a chat log with a smaller, less capable model.

Open source and next steps

Anthropic is releasing FlashProve as an open-source project under the Apache 2.0 license. This includes the executable code for the prover and two different verifiers, as well as the technical report and protocol description. The goal is for other researchers to take this work and improve upon it to build a more complete toolkit for AI verification.

The team clarifies that this release represents intermediate progress rather than a finished research agenda. They are demonstrating that zero-knowledge succinct arguments are practical for provable inference at scale. By making the code and the Lean proofs public, they are inviting the broader community to audit the security claims and refine the system for different types of models.

Moving forward, the research will likely expand to address different types of model architectures and hardware configurations. While this software-only approach is powerful, it may eventually be combined with hardware-based solutions like trusted execution environments. These complementary methods will work together to provide a multi-layered defense for AI integrity, privacy, and regulatory compliance.