Anthropic Releases FlashProve, an Open-Source Prototype to Check Which AI Model Wrote a Response

Anthropic has released FlashProve, an open-source research prototype that uses cryptography to verify whether an AI response came from the model it is claimed to come from, without exposing the model’s weights. The company announced the system in a blog post published Tuesday.

• FlashProve is an open-source research prototype that uses a zkSNARK to prove a response came from the claimed model without exposing its weights.
• On Llama 4 Maverick it proves about 110 tokens per second on one H100, with 19 MB proofs verified in 17 seconds on a CPU.
• Overhead is many times that of normal inference, but the only comparable open-source system took over 14 hours for 1,000 tokens.
• Limits are steep: contexts up to 1,024 tokens, greedy decoding only, and the architecture stays visible.
• Anthropic has no plans to deploy FlashProve and calls the release intermediate progress.

Anthropic releases FlashProve as an open-source research prototype

FlashProve, built by Anthropic’s Frontier Red Team, is described as a research prototype that checks, by cryptographic means, whether a response really came from the model said to have produced it. Anthropic made the system open source and introduced it in a blog post on Tuesday.

Alongside the post, Anthropic released a detailed technical specification and working code. Both are publicly available on GitHub under an open-source license. The full code, the Lean proofs and the documentation are published there under the Apache 2.0 license.

Anthropic described the post as a way of sharing intermediate progress, not a completed research agenda. The company said it hopes others will build on the work in their own research, which sets the tone of the release: a prototype to study and reuse, not a product launch.

The question FlashProve addresses is one that every buyer of AI output faces. A provider says a response came from a particular model, and the customer has so far had to take that on trust. For content teams, agencies and anyone else who purchases generated text or analysis from a model provider, the release shows one way to verify an AI model response mathematically. As of now it remains a prototype with narrow limits, covered below.

How FlashProve proves a model produced an output

The core technique is a hash-based zkSNARK, built on hash functions rather than the more common elliptic-curve setup. This is a cryptographic technique that lets a prover show a computation was done correctly without revealing its secret inputs. In FlashProve the secret inputs are the model weights, so this form of zkSNARK AI verification lets the provider demonstrate that a specific model produced a response while keeping that model private.

Terms behind the system

Three further terms recur in the announcement. Inference is the process of running a trained AI model to generate an output from an input. Model weights are the internal numbers that define how an AI model behaves. Provable inference is a cryptographic proof, essentially a mathematical guarantee, that a given output came from a specific model.

Weights matter because they are the core of what a lab has built. Anyone holding them can reproduce the model, which is why providers do not hand them out. A check that required sharing weights would therefore not be usable for commercial models.

The steps of the process

The model provider first creates a digital fingerprint of the model’s weights. With every response, the provider then delivers a compact proof that this specific model generated the output. The proof reveals nothing about the secret weights.

The fingerprint, a commitment to one specific set of weights published by the model provider, is the fixed reference point. Each response carries a proof that ties it back to that reference, so a verifier can confirm the link without ever seeing what lies behind the fingerprint.

What labs have to publish

The system requires AI labs to publish a fingerprint of each model they release. The fingerprint can later be matched to specific outputs and verified cryptographically.

Because fingerprints do not reveal a model’s weights, labs could publish them without giving up their most valuable asset. That is what enables the system to work with commercial models, and not only with models whose weights are already public.

Why the commitment has to be trusted

A proof only shows that a response matches a published commitment. It cannot show that the commitment itself belongs to the model the provider claims to run. If a provider published a fingerprint of a cheaper model and called it its flagship, every proof would still check out. The guarantee is therefore only as strong as the source of the commitment.

In practice this means the fingerprint has to come from the lab that trained the model and be published through a channel a verifier can authenticate, such as the lab’s own site or an independent registry or auditor. A verifier should confirm that the commitment is genuine before checking any proofs against it, and should treat a commitment of unknown origin as worthless.

Performance figures for speed, proof size and overhead

According to the technical report, FlashProve generates proofs at roughly 110 tokens per second on a single H100 GPU. The model used for the measurement was Meta’s Llama 4 Maverick, a very large mixture-of-experts model.

Measure	Reported figure
Proof generation speed	Roughly 110 tokens per second on a single H100 GPU
Proof size	About 19 megabytes per proof
Verification time	17 seconds on an ordinary CPU
Overhead versus normal inference	Many times the compute of normal inference

The overhead figure means that producing a proven response takes far more compute than serving the same model normally with vLLM, the baseline for the comparison. Verification, by contrast, runs on a standard CPU rather than on a GPU, which keeps the checking side far cheaper than the proving side.

These figures come from the technical report alone. The announcement coverage gives no performance numbers, so they stand as reported in Anthropic’s own document. They describe one model on one GPU type and should not be read as a general rule for other models or hardware.

Who could use it and what it would prevent

The most direct use is catching substitution. FlashProve would prevent an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive model to inflate performance results. Either swap would break the link between the published fingerprint and the proof delivered with the response.

Third parties could also check claims about who did a job. One example given is a software library scanned for vulnerabilities by a frontier cybersecurity model. A proof would let outsiders confirm that the advanced model really performed the scan, rather than relying on the word of whoever ran it.

Uses Anthropic envisions

Anthropic itself sees several use cases:

• Regulators checking whether a provider is running only approved models.
• Companies proving that their code was reviewed by a specific safety model.
• Providers detecting tampering on their own servers, such as an attacker or a more advanced model slipping in unnoticed.

The last case differs from the others because the party being protected is the provider itself. A proof that fails to match the published fingerprint would signal that something other than the intended model produced the output.

How a team would run the check

For teams running a model gateway or a regulated pipeline, the write-ups describe a simple audit routine in four steps:

1. Authenticate the model commitment against the provider’s official publication.
2. Generate proofs for completed batches of responses.
3. Verify those proofs on separate infrastructure, so the system being audited does not check itself.
4. Log each result, so a failed proof leaves a record that auditors can follow up on.

Verification on a local device

The system is designed to be lightweight, so verification could be performed on a local device. The reported 17-second check on an ordinary processor points in the same direction, though nothing in the announcement says a consumer application exists.

Anthropic has also extended a Claude text watermark to several of its models, a separate effort with no described connection to FlashProve.

How FlashProve compares with earlier approaches

According to Anthropic, the only comparable open-source system previously available took over 14 hours to process 1,000 tokens. It produced a 93.6-gigabyte proof that took nearly a full day to verify.

Set against that, FlashProve’s 19-megabyte proofs and 17-second verification on a regular CPU are a large reduction, even with the heavy compute overhead. The comparison rests on Anthropic’s own account of the earlier system.

Link to the Frontier Safety Roadmap

Anthropic’s Frontier Safety Roadmap set a goal of building an inference verification prototype by September 2026. The company says it already met that target through a separate project that signs inference traffic and traces computation on a trusted server.

FlashProve pursues the same goal as that project but takes a purely cryptographic approach. It does not need trusted hardware, so the guarantee rests on the mathematics of the proof and not on the integrity of a particular machine.

Limits of the prototype today

FlashProve currently proves contexts of up to 1,024 tokens only. Longer inputs and conversations fall outside what the prototype can handle at present.

The proof works only when the model picks the single most likely next token, a mode known as greedy decoding. It does not work with the randomized outputs typical of everyday chatbots, which means the most common way consumers use AI models is not yet covered. The proof also relies on integer inference, an integer version of the model rather than the floating-point arithmetic production models use.

The system also hides the weights but not the model’s underlying architecture. A party checking a proof can therefore still learn how the model is structured, even though the numbers that define its behavior stay secret.

Side-channel attacks, such as learning details about a model from how long proving takes, are outside the scope of the release. The measurements also come from a single mixture-of-experts model, and the prototype covers only that architecture type. FlashProve is not part of the Claude API either, so Claude responses do not come with proofs.

Taken together, these limits explain why the performance figures, impressive compared with the earlier system, do not translate into a ready service. Anthropic lists the context cap and the greedy-decoding requirement as open problems.

No deployment planned and what comes next

Research on the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab. The code is out for study and reuse, not for production use by providers.

Anthropic describes the GitHub repository as a research artifact that it does not plan to maintain and that does not accept contributions. Researchers can still fork the code, and the 1,024-token context cap and the greedy-decoding requirement are the named open problems for anyone who picks it up.

For buyers of AI services, nothing changes immediately. Whether any provider will publish fingerprints under this scheme, and when, is not known yet.

Anthropic and its Claude models in context

Anthropic is a Public Benefit Corporation, a designation requiring it to balance shareholder financial interests with benefit to the broader public.

Its site lists a current Claude lineup. Claude Haiku 5.5 is described as its fastest, most capable small model for high-volume work such as summarization, subagents and browser use. The site presents Claude Sonnet 5.5 as a clear upgrade over Claude Sonnet 5 that runs noticeably faster and costs less for most work. Leadership in agentic coding and knowledge work is the claim made for Claude Opus 5.5, which is said to cost substantially less to run than Opus 5 on typical workloads.

The available facts do not cover Anthropic stock, an IPO or a comparison with ChatGPT, and the FlashProve announcement does not mention any of them.

Sources

• The Decoder
• TechCrunch
• anthropic.com

Photo: The Decoder