Skip to content
NewsResearch

Anthropic open-sources FlashProve, a cryptographic proof of which AI model answered you

· by Pondero Newsdesk

The short version

Anthropic published an open-source system on 2026-11-02 that proves which specific model produced an AI response without revealing its weights, cutting proof-verification from hours to seconds.

Anthropic open-sources FlashProve, a cryptographic proof of which AI model answered you

When an API bills for a flagship model, nothing today stops a routing service from quietly serving a cheaper one instead and pocketing the difference. Anthropic published an open-source system on November 2, 2026 that closes that gap: a cryptographic proof confirming which specific model produced a given response, without the provider revealing a single weight, per Anthropic's research post.

What

The system, called FlashProve, uses a type of cryptographic proof known as a zkSNARK (zero-knowledge succinct argument of knowledge). A model provider commits to a specific set of weights up front, then attaches a short proof to each response that a user can check without access to the model or its weights per Anthropic. For a 400-billion-parameter mixture-of-experts model, Llama 4 Maverick, running 4-bit quantized weights, a single Nvidia H100 GPU generates these proofs at about 110 tokens per second, producing roughly a 19 MB proof per 1,024-token request. A client then verifies that proof on an ordinary CPU, no GPU required, in about 17 seconds using 24 threads after a one-time download of a roughly 6.5 MB commitment to the model's weights, per Anthropic's technical report. Generating the proof itself costs 70 to 95 times the GPU time of just running the model through vLLM, a widely used open-source inference engine, Anthropic's own benchmark shows. The code, a Lean-formalized protocol specification, and the underlying mathematical proofs ship under an Apache 2.0 license at the FlashProve GitHub repository.

That speed is the headline against what came before. VerInf, described in Anthropic's review of prior work as the only earlier system to attempt proving inference on the same Llama 4 Maverick model, needed 14.3 hours to prove 1,000 tokens and produced a 93.6 GB proof that took almost a day to verify, per Anthropic's prior-work section. FlashProve's proofs land in the tens of megabytes and check out in seconds on a laptop-class CPU. A commercial system called Attestable has since claimed faster raw throughput on a smaller model, but has not released its code, per the same Anthropic review.

Model-swap fraud and AI-pacing rules both get a checkable receipt

The practical target is model substitution: a third-party router silently swapping in a weaker model to cut costs, a compromised inference server tampering with the token stream, or a model that has learned to disguise itself as a smaller, less-scrutinized one. A public commitment from Anthropic's own Responsible Scaling Policy roadmap also attaches to the release: that roadmap set a goal to prototype provable inference by September 30, 2026. Anthropic says it already met that specific goal through a separate, related system that signs inference traffic and recomputes it on a trusted server; FlashProve pursues the same underlying goal through the zkSNARK method instead, per Anthropic's roadmap page. A second use case centers on regulation: proposals to pace AI development by requiring labs to prove their hardware is running inference rather than training would need exactly this kind of checkable proof, since a regulator could request certificates for a period's traffic without ever seeing the model's weights.

The proof covers 1,024 tokens and does not hide the model's architecture

Context length is the sharpest limit: the system currently proves inference over contexts of up to 1,024 tokens, far short of the hundreds of thousands or millions of tokens that frontier chat sessions typically accumulate. Exactness is another: the proof covers an integer version of the model under greedy decoding, so a response generated by sampling or by a floating-point implementation could diverge from what gets checked. Hiding weights but not architecture is a third tradeoff, since the scheme assumes a mixture-of-experts design and does not conceal that structure, meaning a provider using a dense model or wanting its architecture kept secret would need a different approach. Side-channel attacks, such as timing how long a proof takes to generate, could in principle leak information about the weights; Anthropic says it has not assessed that risk and calls it out of scope for this release. No product integration or deployment timeline comes attached. Anthropic frames the whole release as "intermediate progress" rather than a finished research agenda.

What to watch next

Anthropic says the per-model setup, a roughly 39-minute offline phase, produces a commitment good for about 16 million requests before a provider has to recommit. Whether OpenAI, Google, or another frontier lab adopts FlashProve's approach, builds a competing scheme, or stays silent is the open question; none has commented on it yet. A third-party verification tool or benchmark site building on the open-sourced code would be the clearest sign the spec is catching on beyond Anthropic's own walls.

Sources