Anthropic releases tool to verify AI model outputs via cryptography

The problem of hidden models

When companies use third-party AI services, they often face a trust gap regarding which specific model is processing their data. Currently, there is no reliable way for a customer to know if a provider is secretly using a cheaper, less capable model to save on costs. This lack of transparency can be a significant issue for businesses that pay for high-end performance.

Anthropic addressed this by unveiling FlashProve, an open-source cryptographic system designed to verify model outputs. The goal is to let users, auditors, and regulators confirm that a provider is running the exact model they claim to serve. This verification happens without requiring the provider to share their proprietary weights, which are the internal parameters that make a model work.

As more organizations rely on routing services and external providers to access advanced AI, establishing model identity becomes critical. FlashProve aims to provide this assurance while keeping the underlying technology private. It offers a way to verify the integrity of the computation without the user needing to run the model themselves.

How zero-knowledge proofs work

The system relies on a cryptographic technique known as a zero-knowledge succinct non-interactive argument of knowledge, or zkSNARK. This allows a party to demonstrate that a specific computation was performed correctly without revealing any sensitive information about the underlying data. In this context, it proves that a model produced specific tokens in response to a prompt without exposing the model's internal structure.

The process works in two distinct stages to maintain privacy while ensuring accuracy. First, the provider publishes a cryptographic commitment to its model weights, which acts as a unique fingerprint of the model. This commitment allows the model to remain private while still being identifiable to anyone who holds the fingerprint.

When a user submits a request, the provider generates a proof that the committed model produced the corresponding output tokens. Anyone who has the commitment, the original prompt, and the final response can then verify the proof. This creates a verifiable chain of evidence that the output is authentic and originated from the correct source.

Testing and performance metrics

Anthropic demonstrated the effectiveness of FlashProve using Llama 4 Maverick, which is a 400-billion-parameter mixture-of-experts model. During testing, the system was able to generate proofs at a rate of approximately 110 tokens per second. These tests were conducted on a single NVIDIA H100 GPU, showing the system's ability to handle large-scale models.

For a request of 1,024 tokens, each generated proof measured around 19 MB in size. The verification side of the process is notably efficient, requiring only about 17 seconds on a 24-core CPU. This means that while generating the proof is intensive, checking the proof does not require specialized hardware like a GPU.

Despite these results, the technology is currently a research prototype rather than a production-ready tool. Generating these cryptographic proofs requires significantly more computing power than standard inference. Anthropic noted that the process takes between 70 and 95 times the GPU time required by vLLM, which is a common open-source inference engine.

Applications for trust and policy

Beyond simply checking which model a customer is using, FlashProve has several potential applications for security and regulation. It could be used to detect if a model's response has been tampered with after it was generated. It also provides a mechanism for independent evaluations where third parties can verify the results of specific AI tests.

Regulators could use these proofs to ensure that providers are adhering to specific commitments or using approved models. For example, a company might require a provider to prove that its cybersecurity software was analyzed by a specific high-performing model. This prevents a provider from quietly switching to a cheaper, less capable model for sensitive tasks.

Anthropic released the executable code, technical report, and formal verification proofs under the Apache 2.0 license. By making these resources public, the company intends to encourage other researchers to build upon the work. The ultimate goal is to create a framework where model identity and response integrity can be independently verified by anyone.

Current limitations and scope

While FlashProve is a significant step forward, it currently has several technical limitations that researchers must address. The system currently supports contexts of up to 1,024 tokens and only proves an integer version of the model under greedy decoding. It does not yet support every floating-point or sampled inference result, which are common in many AI applications.

Additionally, while the system successfully hides the model weights, it does not hide the model's architecture. This means that while the specific