Anthropic’s FlashProve: Cryptographic Proof of Which AI Model Answered

Anthropic open-sourced FlashProve, a zkSNARK system to prove a reply came from a specific model. What it means for API buyers, audits, and compliance.

If your company pays for a frontier model through an API or a reseller, you usually have to take the provider’s word for which model answered. Output quality alone is a weak signal—cheaper models can look fine, and attackers or misconfigured routers can swap systems without an obvious tell.

Anthropic’s open-source FlashProve project attacks that problem with cryptography: a proof that a response came from a committed model, without revealing the model’s weights. This is an explainer for technical buyers, security teams, and compliance leads—not a claim that the problem is solved in production tomorrow.

What FlashProve is

In a November 2, 2026 research post, Anthropic describes progress on provable inference using zkSNARKs (zero-knowledge succinct arguments). The system is called FlashProve.

Image: Anthropic, maker of Claude, open-sourced FlashProve for provable inference. — Anthropic PBC (software); screenshot by VulcanSphere via Wikimedia Commons, Public domain

In plain terms:

1. The provider publishes a commitment (a short fingerprint) to a specific set of model weights.
2. For a given prompt/response, the provider can produce a proof file.
3. A verifier with limited compute—and no access to the weights—can check that the committed model produced those tokens.
4. The proof is designed to reveal nothing about the weights (zero knowledge). Hiding the full architecture is not a goal of this system.

Anthropic released a blog post, technical report, protocol spec, prover/verifier code (including a fast C++ verifier and a Lean verifier), and Lean proofs for top-level security statements, under Apache 2.0. Researchers frame it as intermediate progress, shared so others can improve it—not a finished product roadmap.

TechCrunch notes there are no plans announced to deploy FlashProve at Anthropic or other labs yet.

Why API buyers should care (“swapped model” risk)

Common failure modes FlashProve-style proofs are meant to address:

Image: Model routing happens on infrastructure buyers can't see, which is why proof of which model answered matters. — Derrick Coetzee from Berkeley, CA, USA via Wikimedia Commons, CC0

• A routing layer silently serves a cheaper model to cut costs.
• A provider or benchmark setup serves a stronger model to inflate results.
• An attacker tampers with the token stream while impersonating a trusted model.
• A third party claims “we scanned this with model X” without a way to verify.

Anthropic’s post walks through related institutional uses: independent evaluators confirming they tested the real served model; customers of third-party routers verifying what they paid for; regulators checking pacing/compliance claims; and provenance for high-stakes “model-approved” assertions (for example, a security scan claim).

For B2B buyers, the short version is attestation: treat model identity more like a signed artifact and less like a marketing string in a dashboard.

Performance snapshot (what was actually measured)

FlashProve is not vapor—Anthropic published concrete prototype numbers on Llama 4 Maverick (a 400B-parameter mixture-of-experts model, 4-bit quantized weights in the reported setup):

• Prover on a single H100: about 110 tokens/second
• Proof size: about 19 MB per 1,024-token request window
• Overhead versus running the model with vLLM: roughly 70–95× GPU time in their measurements
• Verifier on CPU: on the order of tens of seconds per proof in the reported configuration (about 17 seconds on 24 threads in their write-up)

Those numbers show zkSNARK proving for large MoE models is entering a practical research range—still far from “free with every chat token,” but no longer science-fiction slow compared with earlier zkML results Anthropic surveys in the same post.

What it does not solve yet

Anthropic is explicit about limitations. Important ones for buyers:

• Research prototype, not a turnkey compliance product.
• Proofs target an integer / greedy-decoding formulation; floating-point serving or sampled decoding can diverge.
• Current demos focus on MoE structure and contexts up to 1,024 tokens—short versus modern chat windows.
• Architecture details are not hidden.
• Formal guarantees apply to the Lean-specified protocol; the fast executable path still needs audit discipline.

So: useful direction for trust architecture, not a checkbox you can enable on your vendor’s status page today.

What companies should do now

Even before FlashProve-like proofs are productized:

1. Contract for model identity — name the model/version in MSAs and require notice before swaps.
2. Log routing metadata — keep provider request IDs, model headers, and reseller paths.
3. Ask vendors about attestation roadmaps — hardware TEE approaches and cryptographic PI are complementary; Anthropic discusses both classes of tools.
4. Separate “demo quality” from “served identity” in vendor evaluations.
5. Track open-source progress (FlashProve’s Apache 2.0 release is meant for exactly that).

Conclusion

FlashProve is a credible open-source step toward proving which model produced an answer—without handing over weights. For companies buying API access, the immediate value is conceptual and commercial: it makes “no silent model swaps” a verifiable engineering goal rather than a trust exercise. Production deployment is still ahead; procurement and logging hygiene are available today.

Takeaway: Treat FlashProve as a signal that model-identity attestation is becoming real—update contracts and observability now, and watch zkSNARK inference proofs as a coming compliance tool.

Sources

• Progress on provable inference for large language models — Anthropic
• Anthropic is working on a system to prove AI models’ identity — TechCrunch

By W. Soares

Educational content only. Nothing here is investment advice.