Anthropic has launched FlashProve, an open-source research prototype that employs cryptography to confirm if a particular AI model produced a given response. The system aims to solve the problem where users cannot confirm if a routing service swapped in a cheaper model or if an attacker tampered with the data stream.The tool lets users check if an AI response truly came from the model they paid for, using math instead of trusting the server.FlashProve leverages zkSNARKs to generate compact proofs of model-weight provenance, achieving 110 tokens per second
The figures
FlashProve produces proofs at approximately 110 tokens per second on a single H100 GPU when processing Meta's 400-billion-parameter Llama 4 Maverick model.reported A standard CPU can verify each 19-megabyte proof in 17 seconds.reported The procedure increases processing time by approximately 70 to 95 times relative to standard inference.
Evidence: reported
Anthropic's new prototype proves which model wrote an AI response without exposing its weightsaifleet-decoder
Evidence: reported
Anthropic's new prototype proves which model wrote an AI response without exposing its weightsaifleet-decoder
Behind the figures
The performance metrics are measured against Meta's Llama 4 Maverick model.reported Anthropic notes that the sole other comparable open-source system previously available required more than 14 hours to process 1,000 tokens.reported That earlier system produced a 93.6-gigabyte proof that required nearly a full day to verify, highlighting the significant jump in efficiency achieved by FlashProve.reported
Evidence: reported
Anthropic's new prototype proves which model wrote an AI response without exposing its weightsaifleet-decoder
Evidence: reported
Anthropic's new prototype proves which model wrote an AI response without exposing its weightsaifleet-decoder
Evidence: reported
Anthropic's new prototype proves which model wrote an AI response without exposing its weightsaifleet-decoder
What it means for your stack
FlashProve uses a cryptographic technique called zkSNARK. The provider generates a digital fingerprint of the model's weights and supplies a concise proof with each response to confirm that the designated model produced the output. The proof discloses no information regarding the confidential model weights.
Building on this
Developers can use FlashProve to address scenarios where model identity is critical. Regulators could verify that providers are running only approved models. Organizations could demonstrate that a particular safety model evaluated their code. Service providers could identify server tampering, including instances where an attacker or a more sophisticated model operates undetected. FlashProve pursues these goals through a purely cryptographic approach without needing trusted hardware.
Why it matters
- Inference engineers can verify model provenance without exposing weights, addressing cost-cutting model swaps.
- The 70x to 95x overhead indicates this is currently a research prototype rather than a production-ready solution.
- The 19-megabyte proof size and 17-second verification time on standard CPUs provide concrete latency benchmarks for integration planning.
- Anthropic states it has already achieved its Frontier Safety Roadmap target of creating an inference verification prototype by September 2026 via a separate initiative.
Updated
For readers
Researchers
- FlashProve uses zkSNARKs to verify model origin without exposing weights.
- The prototype achieves 110 tokens per second on an H100 GPU for Llama 4 Maverick.
Policy
- Regulators could use the system to verify providers run only approved models.
- The technology helps detect server tampering or unauthorized model substitution.
Developers
- Proof generation adds 70x to 95x overhead compared to normal inference.
- Each proof is about 19 megabytes and verifies in 17 seconds on a standard CPU.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
How does FlashProve verify the model without exposing weights?
It uses zkSNARKs to create a digital fingerprint of the weights and generates a compact proof that the specific model produced the output.
What is the performance overhead of using FlashProve?
The system adds roughly 70x to 95x overhead compared to normal inference, generating proofs at about 110 tokens per second on an H100 GPU.
Is FlashProve ready for production use?
Anthropic emphasizes that FlashProve is a research prototype with significant limitations, such as constraints on context windows and sampling.
Reading receipt
- Using a single H100 GPU, FlashProve produces proofs at a rate of approximately 110 tokens per second for Meta's Llama 4 Maverick model.
- Each proof is approximately 19 megabytes and verifies in 17 seconds on a standard CPU.
- The system adds 70x to 95x overhead compared to normal inference, a significant improvement over prior systems.