Anthropic's FlashProve proves which model answered, at 70x cost

Anthropic released FlashProve on November 2, an open-source prototype that lets an AI provider prove, with cryptography, that a response came from a specific model. The research post frames it as a fix for a trust gap: today a user has no way to check that a router or a hacked server didn't swap in a different model.

The catch is cost. Anthropic says proving a batch of requests takes roughly 70 to 95 times longer than just running the model. This is a research result, not a product, and Anthropic says it has no plans to deploy it. TechCrunch covered it on November 3.

How FlashProve works

The provider first publishes a short commitment to the model's weights. The weights stay secret. Then, for each request, it produces a proof that the committed model yields the given output tokens for the given prompt. Anyone holding the commitment, the prompt and the reply can check the proof without seeing the weights.

Anthropic builds this on zkSNARKs, a kind of proof that is small and quick to check without revealing the underlying data. It says the hash-based design resists quantum computers. The work was done by Anthropic's Frontier Red Team with co-authors from EPFL, MIT, StarkWare, RESI and Succinct.

The numbers

Anthropic tested on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with public 4-bit weights. A mixture-of-experts model uses only part of its network for each token, about 17 billion parameters here, and the prover's work scales with that smaller number.

• The one-time commitment took about 39 minutes on one H100 GPU and covers about 16 million requests.
• Proving a batch of 24 requests took about 223 seconds on one H100, roughly 110 tokens per second.
• Each proof is about 19 MB for a 1,024-token request.
• Checking takes about 17 seconds on a 24-thread CPU, and clients download a commitment of about 6.5 MB.

What it does not cover

Anthropic lists its own limits. The proof covers an exact integer version of the weights under greedy decoding, so floating-point or sampled outputs may differ. Contexts are capped at 1,024 tokens. The model's architecture is not hidden, the design assumes a mixture-of-experts model, and timing side channels are out of scope.

The team also used the Lean proof assistant to prove the protocol's soundness. The fast C++ verifier people would actually run has no formal guarantee, though it matched the Lean verifier on every test.

What to watch

The code, proofs and specification are under the Apache 2.0 license on GitHub. The model weights are not included. The open question is whether anyone can cut the 70-fold overhead enough for a provider to use it on live traffic.