Anthropic presented, on November 2, FlashProve, an open-source system that makes it possible to cryptographically verify whether a response was produced by the artificial intelligence model announced by the provider. The technology seeks to prevent API services or intermediaries from replacing one neural network with another without the user being able to detect the swap.
Currently, those who purchase access to a given model must trust that the provider actually uses the promised version. FlashProve proposes replacing that trust with a verifiable mathematical proof, without requiring the customer to have access to the neural network's internal parameters.
The system uses zkSNARKs, a cryptographic technique that makes it possible to demonstrate the correct execution of a calculation without revealing confidential information used in the process.
Before responding to requests, the provider publishes a cryptographic identifier associated with the weights of a specific version of the model. It can then generate proofs that link the results presented to that configuration. The user verifies these proofs using only the identifier, the input and the response.
In the tests released by Anthropic, FlashProve reached 110 tokens per second in proof generation for Llama 4 Maverick, Meta's model with 400 billion parameters, using an NVIDIA H100 GPU and batch processing.
Each proof was approximately 19 MB and verified a token calculated from a context of 1,024 tokens. The check took 17 seconds on a processor with 24 threads, without the need for a GPU.
High computational cost still limits the technology
Despite the performance achieved, producing the proofs required 70 to 95 times more GPU time than running the same requests with the conventional vLLM inference engine, according to Anthropic's measurements.
The prototype also has important restrictions. Verification occurs after the responses are generated, uses a version of the model based on integer arithmetic, and covers only deterministic token selection, known as greedy decoding.
The current context limit is 1,024 tokens, significantly lower than the windows used by commercial models. The company also acknowledges that there is still no formal guarantee of equivalence between the fast implementation of the verifier in C++ and the specified mathematical protocol.
As part of the launch, Anthropic made available the source code, the technical description of the protocol, and formal proofs developed in Lean, a language used to verify mathematical properties of programs. The materials were published under the Apache 2.0 license.
The technology can be applied to independent model auditing, verification of intermediary API services, and proof that authorized systems are actually in operation.
FlashProve remains a research prototype, with no announcement of commercial deployment. Its guarantee also has a fundamental boundary: proving which model produced a response does not mean proving that the information presented is true.
