Anthropic has released FlashProve, an open-source system designed to cryptographically prove that AI model responses were generated by the claimed model rather than a substitute. The work addresses a fundamental trust problem: users querying an AI model today have no way to verify the response came from the specific model a developer claims is responding, versus one secretly substituted by a routing service for cost reasons or tampered with by an attacker.
The system uses zero-knowledge succinct arguments, or zkSNARKs, a type of cryptographic proof that lets a model provider commit to a model and then prove each response was produced by that specific model. According to Anthropic, this approach has applications ranging from consumer products to internal security, and could help verify compliance with AI pacing requirements.
Anthropicdemonstrates substantial performance improvements over prior open-source systems. For a large model (Llama 4 Maverick, a 400-parameter mixture of experts using 4-bit quantized weights), a single H100 GPU generates proofs at around 110 tokens per second, with a proof size of approximately 19 MB per 1,024-token request. This represents roughly 70-95 times the GPU time that vLLM, a common open-source inference library, takes to process the same length prompts. Prior open-source systems are orders of magnitude slower, according to the researchers.
The system addresses several trust challenges in AI deployment. Independent evaluators who test models before and after release need assurance they are evaluating the claimed model. Clients using models through third-party routing services want verification they received responses from the model they paid for. And cryptographic verification can detect if cyberattackers modify token streams while impersonating a particular model.
Anthropicis releasing multiple artifacts under the Apache 2.0 license: a technical report, a protocol specification, executable code including a prover and verifiers, and formal proofs written in Lean, a verification language. The Lean proofs provide auditable statements of the system’s security guarantees. The researchers emphasize this represents intermediate progress rather than a completed research agenda, with the explicit goal of enabling others to build upon and improve the work.
Key facts
- FlashProve generates cryptographic proofs for a 400B-parameter model at ~110 tokens/second on a single H100 GPU
- Proof size is approximately 19 MB per 1,024-token request
- The system is 70-95 times slower than running inference alone, compared to orders of magnitude slower prior systems
- Proofs hide model weights but not architecture
- Anthropic released code, Lean proofs, and documentation under Apache 2.0 license