Anthropic Is Developing FlashProve to Cryptographically Verify AI Model Identity

Anthropic has introduced FlashProve, an open-source research system designed to cryptographically verify which AI model generated a particular response. The technology addresses a growing trust problem in the artificial intelligence industry: when someone uses an AI service, they currently have limited ways to independently confirm that the company actually served the model it advertised. FlashProve uses cryptographic proofs to connect an AI response to a specific set of model weights without revealing those proprietary weights. Anthropic published its research on November 2, 2026, alongside technical documentation, executable code and formal verification materials.

The development could have implications for AI security, enterprise software, independent model evaluations and future regulation. For example, a business using an AI API could verify that a third-party provider actually used the specified advanced model instead of secretly substituting a cheaper alternative. However, FlashProve remains a research prototype rather than a feature currently available in Claude or other commercial AI products. Anthropic is releasing the work to encourage independent researchers and developers to examine the technology and improve it.

Why Anthropic Wants to Prove AI Model Identity

Today, most people using AI services must trust the provider’s claims about which model is generating their responses.

When a user selects a particular model through an API or third-party AI platform, there is generally no independent cryptographic mechanism to confirm that the returned response actually came from that exact model.

This creates several potential problems.

An AI provider could theoretically route requests to a cheaper model to reduce operating costs while continuing to charge customers for access to a more advanced model. A third-party platform could also substitute a different model without clearly informing its customers.

Another concern involves security. If an attacker compromises an AI inference server, they could potentially replace the authorised model with a different system and return manipulated responses.

The problem also affects independent AI evaluations. Researchers testing a model need confidence that the responses they receive actually came from the model being evaluated.

Anthropic believes cryptographic verification could help address these challenges by making model identity independently checkable rather than relying entirely on trust in the provider.

What Is FlashProve and How Does It Work?

FlashProve is based on a concept called provable inference.

In simple terms, provable inference allows an AI provider to generate a mathematical proof showing that a particular model produced a particular response to a particular prompt.

The system uses a cryptographic technique called a zero-knowledge succinct non-interactive argument of knowledge, commonly known as a zkSNARK.

The process involves two main stages.

1. Creating a model fingerprint

The provider first publishes a cryptographic commitment to the model’s weights. This acts like a digital fingerprint that identifies one specific version of the model.

The fingerprint does not reveal the underlying weights, which are the internal numerical values that determine how a model processes information and generates responses.

2. Generating a proof for each response

When the model answers a prompt, the provider generates a cryptographic proof demonstrating that the committed model produced the specified output.

A user or independent verifier can check this proof without downloading the model or accessing its private weights.

If the response does not match the committed model’s computation, the proof should fail verification.

The approach is designed to make verification possible without requiring users to run enormous AI models themselves.

FlashProve Uses Zero-Knowledge Cryptography

One of the most important aspects of FlashProve is its use of zero-knowledge cryptography.

Zero-knowledge proofs allow one party to demonstrate that a statement is true without revealing the private information used to establish that statement.

In the context of AI, this means a company could prove that a response came from a particular model without publishing its proprietary model weights.

This matters because advanced AI models represent substantial investments in research, computing infrastructure and engineering.

Companies such as Anthropic and OpenAI generally keep their most valuable model weights private. A verification system that requires publishing those weights would therefore be difficult for commercial AI providers to adopt.

FlashProve is designed to avoid that trade-off.

The cryptographic proof can establish that the specified computation took place while protecting the model’s weights and internal intermediate values.

However, the current implementation does not hide the model’s architecture. Anthropic identifies architecture privacy as an area for future research.

Anthropic Demonstrates FlashProve on a 400-Billion-Parameter AI Model

Anthropic’s researchers tested FlashProve using Llama 4 Maverick, Meta’s 400-billion-parameter mixture-of-experts model.

The model was used with publicly available 4-bit quantised weights, allowing researchers to evaluate the proof-generation system on a large model without exposing proprietary Anthropic model weights.

The results show progress compared with earlier approaches to cryptographic AI verification.

Performance metric	FlashProve result
Tested model	Llama 4 Maverick
Model parameters	400 billion
GPU used for proving	NVIDIA H100
Proof-generation speed	Approximately 110 tokens per second
Proof size	Approximately 19 MB
Verification time	Around 17 seconds
Verification hardware	24-core CPU
Context window tested	1,024 tokens

The proof-generation speed is particularly notable because previous research systems struggled to verify much smaller AI models efficiently.

Anthropic reported that its system requires approximately 70–95 times the GPU computation time of ordinary model inference in its benchmark comparisons.

This means FlashProve is still considerably more computationally expensive than simply generating an AI response.

Nevertheless, the researchers consider the improvement significant because earlier cryptographic approaches were much slower.

How FlashProve Could Prevent AI Model Substitution

One of the most commercially relevant applications is preventing AI providers from secretly changing the model they serve.

Consider a company paying for access to an advanced AI model through an API.

The customer expects every request to be processed by that specified model. However, the provider might theoretically route some requests to a smaller and cheaper model to reduce infrastructure costs.

Without independent verification, the customer may have difficulty detecting the substitution.

FlashProve could provide a way to check whether each response came from the model identified by the provider.

The same approach could help identify unauthorised model substitutions caused by compromised inference servers or malicious software.

For enterprise customers, this could become particularly important when AI systems handle sensitive business operations, cybersecurity analysis, financial research or software development.

A company could potentially require cryptographic evidence that its AI workloads were processed by an approved model.

Potential Applications in AI Regulation and Security

Anthropic’s research also identifies several applications beyond commercial API verification.

AI safety and regulation: Regulators could require AI providers to demonstrate that they are serving approved models. Cryptographic proofs could make it easier to verify compliance without requiring regulators to inspect proprietary model weights.

AI computing oversight: Governments and independent auditors could use inference proofs to verify that specified computing resources were used for approved AI inference workloads. However, the system alone cannot prove that a provider is not performing additional activities, such as model training, elsewhere.

Cybersecurity: Organisations could verify that a security audit or software vulnerability assessment was performed by a specified AI model rather than a cheaper or unauthorised substitute.

Enterprise accountability: Businesses could request evidence that a particular model processed sensitive tasks, making AI procurement and vendor accountability more transparent.

Independent AI evaluations: Researchers could obtain stronger guarantees that the model they are benchmarking is the same model the provider claims to be serving.

These applications could become increasingly relevant as AI systems take on more important responsibilities across business and government operations.

FlashProve Is Open Source but Not Ready for Commercial Deployment

Anthropic has released several research materials to encourage outside developers and cryptography specialists to examine the technology.

The release includes:

• A technical research report explaining the system.
• A detailed protocol description.
• Executable proof-generation and verification code.
• A fast C++ verifier.
• A formally verified Lean verifier.
• Mathematical proofs covering key security properties.
• An interactive visualiser for examining the formal verification work.

The materials are available under the Apache 2.0 open-source licence.

However, Anthropic has described the release as intermediate research progress rather than a finished product. The company has not announced plans to deploy FlashProve in Claude or make it available as a commercial API feature.

The system also has technical limitations. Its current demonstration supports a context length of up to 1,024 tokens, which is considerably shorter than the context windows offered by modern frontier models.

The implementation also has limitations around architecture privacy, floating-point computation and the formal guarantees of its fast executable code.

These challenges will need to be addressed before the technology can become a practical verification standard across commercial AI services.

The Bigger Picture

FlashProve addresses an important question that could become central to the AI industry: how can customers independently verify that they are receiving the model they paid for?

As AI services become increasingly integrated into enterprise software, cybersecurity, research and automated business processes, knowing which model generated an output may become as important as evaluating the output itself.

Anthropic’s research suggests that cryptographic verification could provide an answer without forcing companies to reveal their proprietary model weights. However, performance overhead, technical limitations and adoption across competing AI providers remain significant challenges.

Looking Ahead

The next stage of FlashProve’s development will depend on independent research, improvements in proof-generation efficiency and support for larger context windows and additional model architectures. Anthropic is encouraging the wider cryptography and AI research communities to build on its open-source implementation rather than treating the current release as a completed solution.

If the technology becomes practical at commercial scale, AI providers could eventually attach verifiable cryptographic evidence to model responses. This could create a new layer of accountability for AI APIs, help enterprises verify model identity and provide regulators with additional tools for overseeing advanced AI systems. For now, FlashProve represents an important research step towards making AI model identity independently verifiable.