Anthropic’s FlashProve creates cryptographic proofs that a model produced specific output tokens, but the research system has significant limits.
ARTICLE BODY Anthropic has released FlashProve, an open-source research system designed to prove which AI model generated a response. It links an answer to a specific set of model weights without revealing those private weights. The announcement, published November 3, targets a trust gap: users cannot normally check which model answered a request. The work remains research, with important limits on what its proof establishes.
How AI model verification works
FlashProve addresses the risk that a service returns an answer from a different model than it claims. That substitution could affect quality, cost or the results of an independent evaluation. The system is designed to attach a cryptographic proof to each verified answer. Auditors and regulators could also check whether a model handled a sensitive or regulated request as claimed.
The process has two stages. First, the provider publishes a commitment, or cryptographic fingerprint, tied to one exact set of model weights. The weights themselves remain hidden. Later, the provider generates a proof that those committed weights produced the supplied output for a particular prompt.
Cryptographic proofs and private weights
The technique is a zero-knowledge proof, which aims to verify a computation without revealing the private data behind it. In this case, the provider proves that the committed model produced the claimed tokens. Users can check the prompt, answer and proof against the published commitment. The assurance applies only when a proof accompanies the response and the user verifies it. The protocol is designed to make a forged proof computationally infeasible under its cryptographic assumptions.
Anthropic says the proof can conceal the model weights, but not the model’s architecture. “This research post is meant to share intermediate progress, and not a completed research agenda.” — Anthropic research team. The company released its code and documentation under Apache 2.0. It hopes others will examine and improve the system.
FlashProve’s test and performance
Anthropic tested FlashProve with a public, four-bit version of Meta’s Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model. That is a different model from Claude, and the test does not show that FlashProve is running for Anthropic customers. The researchers used one Nvidia H100 GPU to generate proofs. They reported throughput of about 110 tokens per second in their test.
The proof files averaged about 19 megabytes, according to Anthropic. The company said verification took around 17 seconds on a 24-thread CPU. Those are results from Anthropic’s own implementation, not an independent benchmark. Its context limit is 1,024 tokens, far shorter than many AI services’ windows.
What the model proof does not show
FlashProve aims to verify that a specific model generated specific tokens for a prompt. It does not establish that the response is true, safe, unbiased or useful. Nor does it certify that the model was trained responsibly. A proof addresses model-output provenance, not the quality of the answer.
The current system proves an integer version of the model under greedy decoding. That means its output may not exactly match a normal floating-point run or a reply generated with sampling. Anthropic also says the present design assumes a mixture-of-experts architecture. Side-channel leaks, such as information inferred from proof-generation time, are outside the current guarantee.
Anthropic’s verification roadmap
Anthropic’s public FlashProve repository labels the code a research artifact and says it is not maintained or accepting contributions. TechCrunch reported that the company has no plan to deploy this public release at Anthropic or another lab. That status does not mean the company has done no production work on verification.
In an October 19 safety-roadmap update, Anthropic said its broader inference-verification effort had produced a prototype running with production inference. It also said signing on internal token traffic caught one rare, harmless integrity glitch. The update does not say that the public FlashProve package is serving Claude customers. It shows the company is exploring several ways to verify its own model traffic.
Ultimately, FlashProve offers a way to check whether a claimed model produced a given response without exposing its weights. Its current test and limits make it a research demonstration, not a general guarantee about AI answers. Anthropic’s next challenge is to expand the method beyond a short context and narrow decoding setup. Broader adoption will depend on making proofs practical and independently trustworthy.
