Anthropic Releases FlashProve Response Verification System

Anthropic announced FlashProve on November 2 (local time), a system that uses cryptography to verify that a specified AI model generated a response. The company published the code and technical documentation on GitHub under the Apache 2.0 license. Researchers from Anthropic’s Frontier Red Team, École polytechnique fédérale de Lausanne (EPFL), and the Massachusetts Institute of Technology (MIT) took part in its development. Anthropic said the system is research in progress, not a finished product.

Users currently cannot confirm which model actually generated a response. Anthropic cites cases in which routing services replace the selected model with another to cut costs, as well as cases where attackers tamper with responses. Output quality alone cannot reveal which model produced a response, and many models’ weights—the numerical representation of what the model learned—are not public. Even if the weights are available, running the same model to compare its output requires computing resources beyond the reach of ordinary users and evaluation organizations.

FlashProve uses zkSNARKs, a cryptographic method for proving a computation correct with a short proof without revealing its contents. A model provider first publishes a short “fingerprint,” or commitment, corresponding to the model’s weights. For each response, the system then creates a proof file showing that a model with those weights generated that output from the input prompt. Recipients can verify the proof on a computer without a GPU; verification fails if the output came from a different model. The proof does not reveal the weights, but it does not conceal the model’s architecture.

Anthropic lists third-party checks of model identity, detection of tampering after an inference server is compromised, and confirmation of compliance with rules requiring only approved models as potential uses. In its Frontier Safety Roadmap, the company had set a goal of developing by September 30 a prototype that links outputs to the weights of a specific model for verification. Anthropic said that goal was met through a separate project that signs inference traffic and recomputes it on trusted servers; FlashProve pursues the same aim through a different method.

The team tested FlashProve with Meta’s Llama 4 Maverick, a 400-billion-parameter Mixture of Experts (MoE) model, using a 4-bit quantized version. One NVIDIA H100 GPU generated proofs at about 110 tokens per second. Proofs for a 1,024-token request were about 19 MB, and verification took about 17 seconds on a 24-core CPU. The system required about 70–95 times more GPU time than ordinary inference. Anthropic said an existing open-source method for the same model took 14.3 hours to prove 1,000 tokens and produced a 93.6 GB proof.

Anthropic said it used Claude to improve performance over earlier methods and that AI generated much of the executable code. Because large, complex systems can be difficult to assess, the company mathematically proved key security properties using Lean, a formal verification language, and published them for third-party auditing.

FlashProve remains a research prototype. It currently supports only MoE models and context lengths of up to 1,024 tokens. Proofs cover an integerized model and assume greedy decoding, which always selects the highest-probability token. Since proofs are generated after a response is returned, the system detects tampering afterward rather than preventing it in advance.

Anthropic announced FlashProve on November 2 (local time), a system that uses cryptography to verify that a specified AI model generated a response. The company published the code and technical documentation on GitHub under the Apache 2.0 license. Researchers from Anthropic’s Frontier Red Team, École polytechnique fédérale de Lausanne (EPFL), and the Massachusetts Institute of Technology (MIT) took part in its development. Anthropic said the system is research in progress, not a finished product.

Users currently cannot confirm which model actually generated a response. Anthropic cites cases in which routing services replace the selected model with another to cut costs, as well as cases where attackers tamper with responses. Output quality alone cannot reveal which model produced a response, and many models’ weights—the numerical representation of what the model learned—are not public. Even if the weights are available, running the same model to compare its output requires computing resources beyond the reach of ordinary users and evaluation organizations.

FlashProve uses zkSNARKs, a cryptographic method for proving a computation correct with a short proof without revealing its contents. A model provider first publishes a short “fingerprint,” or commitment, corresponding to the model’s weights. For each response, the system then creates a proof file showing that a model with those weights generated that output from the input prompt. Recipients can verify the proof on a computer without a GPU; verification fails if the output came from a different model. The proof does not reveal the weights, but it does not conceal the model’s architecture.

Anthropic lists third-party checks of model identity, detection of tampering after an inference server is compromised, and confirmation of compliance with rules requiring only approved models as potential uses. In its Frontier Safety Roadmap, the company had set a goal of developing by September 30 a prototype that links outputs to the weights of a specific model for verification. Anthropic said that goal was met through a separate project that signs inference traffic and recomputes it on trusted servers; FlashProve pursues the same aim through a different method.

The team tested FlashProve with Meta’s Llama 4 Maverick, a 400-billion-parameter Mixture of Experts (MoE) model, using a 4-bit quantized version. One NVIDIA H100 GPU generated proofs at about 110 tokens per second. Proofs for a 1,024-token request were about 19 MB, and verification took about 17 seconds on a 24-core CPU. The system required about 70–95 times more GPU time than ordinary inference. Anthropic said an existing open-source method for the same model took 14.3 hours to prove 1,000 tokens and produced a 93.6 GB proof.

Anthropic said it used Claude to improve performance over earlier methods and that AI generated much of the executable code. Because large, complex systems can be difficult to assess, the company mathematically proved key security properties using Lean, a formal verification language, and published them for third-party auditing.

FlashProve remains a research prototype. It currently supports only MoE models and context lengths of up to 1,024 tokens. Proofs cover an integerized model and assume greedy decoding, which always selects the highest-probability token. Since proofs are generated after a response is returned, the system detects tampering afterward rather than preventing it in advance.