Anthropic builds FlashProve: cryptographic proof of which AI model produced an answer

Users of hosted AI services currently have to trust that the model they paid for really produced their answer. Anthropic wants to replace that trust with mathematical proof. In early November the company released FlashProve, an open-source research prototype that attaches a cryptographic proof to every AI answer, so that anyone can check which model produced the output.

How it works

FlashProve uses zero-knowledge cryptography, specifically a zkSNARK: a mathematical proof that a calculation was carried out correctly, without revealing sensitive information about the underlying model. Blockchains such as Zcash use the same kind of proof to shield transactions. An AI lab first publishes a cryptographic commitment, a kind of fingerprint of the model. This fingerprint does not reveal the weights, the internal parameters that makers of closed models such as Anthropic and OpenAI keep secret. This means commercial models can take part too, without giving up their most valuable asset.

For each request, the provider then generates a proof that the committed model produced the matching output tokens. Anyone with the commitment, the prompt and the answer can check this proof locally, without a GPU. Anthropic demonstrated the system on Llama 4 Maverick, a mixture-of-experts model with 400 billion parameters. On a single NVIDIA H100 GPU, proofs were generated at about 110 tokens per second, and verification took around 17 seconds on a CPU with 24 cores.

Why it matters

According to the researchers, the system could stop an AI company from secretly using a cheaper model to save costs, or a more expensive model to inflate performance results. It can also check claims made by third parties: a developer who says a frontier model scanned their software library for cybersecurity problems, or a company that says a model approved its business plan. Independent auditors and regulators could also use it to check that providers serve the models they promise.

Still quite limited

FlashProve is explicitly a research prototype, not a solution ready for production. Anthropic's own measurements show that generating proofs takes 70 to 95 times as much GPU time as ordinary inference with vLLM, a widely used open-source inference engine. The system also supports contexts of only 1,024 tokens and proves an integer version of the model under greedy decoding. Floating-point calculations and randomly sampled outputs are not covered yet. It hides the model weights, but not the architecture.

The code, a technical specification and formal verification proofs are available on GitHub under the Apache 2.0 licence. Anthropic stresses that these are interim research results and that it has no plans to use the system at Anthropic or any other lab. The company invites other researchers to pick up the work and improve it.

What does this mean for the road to the singularity?

FlashProve is a first step towards independently verifiable model identity and answer integrity. This kind of trust layer will be badly needed once AI systems form critical infrastructure. As evaluations, regulation and safe deployment increasingly depend on knowing exactly which model did what, cryptographic verification makes it possible to prove this instead of simply trusting it. The high computing costs and the short context length show that this layer still has to be built before it can become standard.

What is the technological singularity? Read the explanation →