Anthropic has released an open-source prototype that lets anyone check whether an AI answer really came from the model it claims to be. Called FlashProve, the system attaches a cryptographic proof to a response, so a user can verify the answer against a published fingerprint of the model’s weights without ever seeing those weights. The company published the work on November 2, alongside code, a technical report, and formal proofs.
How the proof works
A user has no way to tell which model produced an answer. A routing service could substitute a cheaper model to save money, an evaluator could be served a different model from the one under test, or an attacker could tamper with the token stream. Output alone cannot settle the question, because a good answer proves nothing about its author.
FlashProve works in two phases. In the offline phase, the provider publishes a short commitment, a fingerprint that pins down one exact set of weights while keeping those weights hidden. In the online phase, the provider produces a proof file for a completed prompt and response, showing that the committed model produces exactly those output tokens.
The proof carries four guarantees. Completeness means an honest proof is accepted, and soundness means a forged proof is effectively impossible without breaking widely believed cryptography. Zero knowledge means the check reveals nothing about the weights, and succinctness means the proof is small and cheap to verify.
What the numbers say
Anthropic tested FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model using 4-bit quantized weights. On a single H100 GPU, the system generated proofs at around 110 tokens per second, with each proof about 19 megabytes for a 1,024-token request. That is roughly 70 to 95 times the GPU time of running the model on vLLM.
Verification is cheaper than proving. The client downloads a commitment of about 6.5 megabytes, then checks each proof on a CPU, taking 17 seconds with 24 threads or 21 seconds on a single thread. The prover fits on one 80-gigabyte GPU with 290 gigabytes of host memory, since it does work proportional to the 17 billion parameters active per token.
The jump over earlier work is stark. Anthropic notes that the only earlier proof of the same model, VerInf, took 14.3 hours for 1,000 tokens with a 93.6-gigabyte proof that needed almost a day to verify. A commercial effort, Attestable, reports 53 to 77 tokens per second for a dense 31-billion-parameter model, but has not released an open-source library.
Why It Matters
Provable inference matters most where trust cannot be assumed. Evaluators need to know they tested the model they think they tested, customers paying for a premium model want proof they were not served a cheaper substitute, and regulators may one day require that only approved models are served. Anthropic frames the work as a tool for pacing AI development.
That regulatory angle connects to Anthropic’s own recent filings, where the company warned about fast-moving capability gains and made large compute commitments. A proof system does not settle whether a model is safe, but it settles a narrower question: which model actually answered. That distinction is why Anthropic’s amended IPO filing reads as part of the same trust story.
The limits are stated plainly and they matter. FlashProve proves an exact integer version of the model under greedy decoding, so floating-point inference or sampled decoding could depart from the proved computation. Contexts are capped at 1,024 tokens, far short of real chat sessions, and the model architecture itself is not hidden.
Our read
The framing is that FlashProve is a research prototype, not a product, and its headline cost is the story. Proving at 70 to 95 times the cost of inference means nobody will attach proofs to everyday chat traffic soon. The near-term use is spot-checking: evaluations, disputed outputs, and audited samples where the cost of error exceeds the cost of proving.
There is a neat symmetry in how the system was built. Anthropic says Claude itself produced improvements on the underlying cryptography, while Lean formal proofs were used to audit the claimed guarantees. That is the same verification instinct applied twice: once to the model, once to the proof system itself.
A related line of research asks whether one AI system can directly rewrite another’s weights, as covered in MIT’s weight-space programming work. FlashProve takes the more conservative path: it certifies outputs instead of changing them, which makes its guarantees easier to check and harder to dispute.
The gap to watch is one Anthropic names itself. The fast C++ verifier used day to day carries no formal guarantee, while the formally verified Lean verifier runs slowly, and the formal statements still need manual auditing. Until those pieces converge, FlashProve proves what it claims only as far as its code matches its mathematics.
Background
Anthropic set a goal in its Frontier Safety Roadmap: to build a prototype for verifying inference traffic by September 30, 2026. The company says it met that goal through a project that signs inference traffic and recomputes it on a server, while FlashProve pursues the objective by a different method. This release is presented as progress, not the final word.
Source: Anthropic research post and Unite.AI report
0 Comments