Anthropic has released FlashProve, an open-source research prototype that lets an AI provider attach a cryptographic proof to a model's answer, showing that the answer really came from the model it claims to be using. On a single Nvidia H100 GPU, the system produces proofs for a 400-billion-parameter model at about 110 tokens per second, which Anthropic says is far faster than earlier open-source systems.
The finding
Today a user has no direct way to check which model produced a reply. A routing service could quietly swap in a cheaper model, or an attacker could tamper with the text on its way to the user. Anthropic's post argues that judging the output alone does not settle the question.
FlashProve uses a type of proof called a zkSNARK: a short certificate that a computation was carried out correctly, which can be checked much faster than the computation itself and reveals nothing else. The provider first commits to a set of model weights, then produces a proof for each response. The proof hides the weights, but not the model's architecture.
"A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding"Anthropic research post
How it was done
The researchers tested the system on Llama 4 Maverick, a mixture-of-experts model with 400 billion parameters, using public 4-bit weights. The authors say Claude produced many of the speed improvements in the system, and the team wrote the top-level security claims in Lean, a formal proof language, so that people can audit them.
The release includes the blog post, a technical report, a protocol specification written by Claude, a prover with two verifiers (a fast one in C++ and a provably correct one in Lean), and the Lean proofs. All of it is under the Apache 2.0 licence.
Results
| Measure | Result |
|---|---|
| One-time setup per model | About 39 minutes |
| Proving speed | About 110 tokens per second on one H100 with 24 CPU cores |
| Proof size | 18.78 MB per 1,024-token request |
| Checking a proof | 17 seconds on 24 CPU threads, 21 seconds on one thread |
| Cost compared with normal inference | About 70 to 95 times the GPU time of running the model on vLLM |
For comparison, the post lists earlier systems that managed well under 1 token per second on large models, and a recent peer-reviewed system that reached a few tokens per second on one machine. Anthropic also says the work could help independent evaluators confirm they are testing the model being served, and could support future rules that check how AI hardware is being used.
Limits stated by the authors
- It is a research prototype and an update on work in progress, not a finished product.
- The proofs cover an exact integer version of the model choosing the most likely token each time; replies from floating-point or sampled decoding may not match exactly.
- It currently handles contexts of up to 1,024 tokens, far shorter than modern chat sessions.
- It relies on a mixture-of-experts design and does not hide the architecture.
- Side-channel attacks, such as timing how long a proof takes, are out of scope.
Anthropic says it met a separate goal of a working prototype for verifying its inference traffic by 30 September 2026 through a different, related project.
Announced by Anthropic on its research blog: read the announcement
