Anthropic has released FlashProve, an open-source cryptographic system designed to verify whether an artificial intelligence model actually generated a particular response. The technology aims to solve a growing trust problem in the AI industry: users currently have no reliable way to confirm whether a company is running the exact AI model it claims to provide. With FlashProve, developers and users could verify model-generated responses through mathematical proofs without gaining access to the model’s confidential internal parameters.
Announced on November 2, 2026, the system uses zero-knowledge cryptography to establish that a response came from a specific set of model weights. Anthropic demonstrated the technology using Meta’s 400-billion-parameter Llama 4 Maverick model, generating verification proofs at approximately 110 tokens per second on a single NVIDIA H100 GPU. The company has published its research, technical documentation and implementation code under the Apache 2.0 open-source licence.
What Is Anthropic’s FlashProve?
FlashProve is an experimental cryptographic system developed by Anthropic’s Frontier Red Team to verify the identity of AI models generating responses.
Today, when someone sends a request to an AI service, they generally have to trust the provider’s claim about which model is processing their request.
For example, a company might advertise access to an advanced AI model but secretly route some requests to a cheaper, less capable alternative to reduce operating costs.
Similarly, an attacker could compromise an inference server and manipulate the responses without users knowing which model actually generated them.
FlashProve aims to address this problem by attaching a cryptographic proof to AI-generated responses.
The proof allows anyone with the appropriate verification information to establish that a specific model generated the output for a given prompt.
Importantly, the system does not require the AI company to reveal its proprietary model weights.
This makes FlashProve particularly interesting for companies such as Anthropic and OpenAI, which operate commercially valuable models with confidential internal parameters.
How FlashProve Uses Zero-Knowledge Cryptography
The central technology behind FlashProve is a cryptographic method called zkSNARK, short for Zero-Knowledge Succinct Non-Interactive Argument of Knowledge.
In simple terms, zero-knowledge cryptography allows one party to prove that something is true without revealing the confidential information used to establish that fact.
For AI models, this means a provider can demonstrate that a particular response came from its declared model without exposing the model’s internal weights.
FlashProve operates through two main stages.
1. Creating a Cryptographic Model Fingerprint
Before generating responses, the AI provider creates a cryptographic commitment to its model weights.
This commitment acts like a unique fingerprint associated with a specific version of the model.
The provider publishes this fingerprint so that future responses can be checked against the same model identity.
The actual model weights remain private.
2. Generating Proofs for AI Responses
When a user submits a prompt, the model provider generates a response and produces a cryptographic proof connecting that response to the previously committed model.
The user can then verify the proof using the prompt, response and published model commitment.
If the provider secretly substitutes another model, the replacement should not be able to produce a valid proof for the original model’s commitment.
Anthropic says verification can be performed using a CPU without requiring the user to possess the expensive GPU infrastructure needed to operate the original model.
Why AI Model Verification Matters
As businesses increasingly depend on external AI services, knowing which model actually processes a request is becoming an important security and accountability issue.
AI providers may offer multiple models with different capabilities, pricing structures and safety characteristics.
Without verification, customers generally have to trust that the service is delivering the model they selected.
FlashProve could address several problems.
Preventing model substitution: Providers could be prevented from secretly replacing expensive models with cheaper alternatives without detection.
Protecting AI evaluations: Independent researchers could verify that the model being evaluated is actually the one claimed by its developer.
Detecting server manipulation: Cryptographic proofs could help identify responses generated by compromised or unauthorised inference systems.
Supporting regulatory compliance: Regulators could verify whether companies are serving approved AI models under specific legal or safety requirements.
Verifying AI-assisted work: Businesses could establish that particular security audits, code reviews or other tasks were performed using a specified AI model.
For example, a cybersecurity company could claim that it used a particular advanced AI model to inspect software for vulnerabilities. FlashProve could eventually provide a way to verify that claim rather than relying entirely on the company’s own statements.
Anthropic Tests FlashProve on Meta’s 400-Billion-Parameter AI Model
To demonstrate the system’s capabilities, Anthropic tested FlashProve using Meta’s Llama 4 Maverick model.
The model contains approximately 400 billion parameters and uses a mixture-of-experts (MoE) architecture, activating approximately 17 billion parameters for each token.
Anthropic reported the following performance figures:
| Metric | FlashProve Performance |
|---|---|
| Tested AI model | Llama 4 Maverick |
| Total parameters | 400 billion |
| Active parameters per token | Approx. 17 billion |
| GPU used | NVIDIA H100 |
| Proof generation speed | Approx. 110 tokens/second |
| Proof size | 18.78 MB |
| Context per request | 1,024 tokens |
| Verification time | Approx. 17 seconds |
| Additional GPU time | Approximately 70–95 times regular inference |
The results represent substantial progress compared with earlier open-source cryptographic AI verification systems.
However, the performance comes with an important trade-off: generating proofs requires significantly more computing resources than ordinary model inference.
Anthropic estimates that proof generation consumes approximately 70 to 95 times the GPU time required by standard inference using vLLM.
FlashProve Keeps AI Model Weights Private
One of the most important aspects of FlashProve is its ability to verify AI responses without exposing confidential model weights.
Model weights are the numerical parameters that determine how an AI model processes information and generates responses.
Companies invest significant resources in developing these parameters, making them valuable intellectual property.
Requiring companies to publish their weights would create serious commercial and security concerns.
FlashProve addresses this through zero-knowledge proofs.
The system demonstrates that the committed model generated the response without revealing the underlying weights or intermediate computational information.
However, Anthropic clarifies that the current implementation does not hide the model’s architecture. Its primary privacy protection concerns the model weights.
FlashProve Is Open Source, but Not Ready for Commercial Deployment
Anthropic has released several components of FlashProve for public examination and development.
These include:
- A detailed technical research report.
- An open-source protocol specification.
- Executable proof-generation software.
- A fast C++ verification implementation.
- A formally verified Lean verification implementation.
- Mathematical proofs describing the system’s security properties.
The code, documentation and Lean proofs are available under the Apache 2.0 licence.
The release is intended to encourage independent researchers and developers to examine the technology, identify weaknesses and improve its performance.
However, FlashProve remains a research prototype rather than a commercial product.
Anthropic has not announced plans to deploy it across its own AI services or offer it as a production verification feature.
What Are FlashProve’s Current Limitations?
Despite its promising results, the technology still has several important limitations.
Limited context length: The current implementation supports requests containing up to 1,024 tokens, significantly shorter than the context windows available in modern AI models.
Restricted model architecture: The system currently focuses on mixture-of-experts models. Extending it to other architectures will require additional engineering work.
High computing overhead: Proof generation requires approximately 70–95 times the GPU time of conventional inference in Anthropic’s reported tests.
Decoding limitations: The current proof system verifies an integer representation of the model under greedy decoding. Responses generated through other decoding methods may not match the computation being verified.
Security auditing: Although Anthropic has used Lean to formally establish important security properties, the company acknowledges that the executable implementations still require careful auditing.
These limitations mean that widespread commercial adoption will require further improvements in speed, compatibility and implementation security.
The Bigger Picture
FlashProve addresses an important but often overlooked problem in the AI industry: trust in model identity. As AI services become embedded in financial systems, cybersecurity operations, enterprise software and government applications, customers need more than a company’s assurance that a particular model handled their requests.
Cryptographic verification could eventually provide an independent way to establish which model generated an answer while allowing developers to protect their intellectual property. This could also help regulators monitor AI deployment and ensure that organisations comply with model-specific safety requirements.
However, the technology is still experimental. Its substantial computing overhead, limited context length and restricted architecture support must be addressed before it becomes practical for large-scale commercial AI services.
Looking Ahead
Anthropic is encouraging developers and researchers to examine FlashProve and contribute improvements through its open-source release. Future development will likely focus on supporting longer conversations, additional model architectures and more efficient proof generation. These improvements will be important for making cryptographic verification practical across real-world AI applications.
If the technology matures, FlashProve could help establish a new layer of accountability for AI services. Rather than simply trusting that a company is using the model it advertises, customers could eventually verify the origin of AI-generated responses through cryptographic evidence. This could become increasingly important as businesses and governments rely on advanced AI systems for sensitive and high-stakes decisions.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
