The Pulse
Anthropic Builds FlashProve to Verify AI Model Outputs
Anthropic has released FlashProve, a cryptographic prototype designed to prove that an AI response came from a specific set of model weights. Tests on Llama 4 Maverick show proof generation is far slower than ordinary inference, while verif
AI.info Team · Written with AI · fact-checked ·
Anthropic says users cannot currently confirm that an AI response came from the model they selected. Its FlashProve prototype is meant to provide that assurance, but Anthropic’s benchmark puts proof generation at about 72 times the per-GPU time vLLM takes to process the same batch. The company published the work on Nov. 2 as an intermediate research release, not a finished system.
When a model label is not proof
A user who receives a model’s answer has no reliable way to tell whether a routing service secretly substituted a cheaper model, or whether an attacker altered the token stream, Anthropic writes. Independent evaluators also need to know that the model they test before and after release is the one actually being served. FlashProve is intended to let a provider prove that a response came from a particular model without giving the verifier access to its weights.
The system uses a zero-knowledge succinct argument, or zkSNARK. In FlashProve’s offline phase, the provider publishes a short commitment that identifies one exact set of model weights while keeping the weights hidden. For a response, the provider then supplies a proof tied to that commitment; a verifier checks that the committed model produced the given tokens for the given prompt.
FlashProve’s proof has a compute cost
Anthropic tested FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, using publicly available 4-bit weights. The model uses about 17 billion parameters per token. On a server with one H100 GPU and 24 CPU cores, a batch of 24 requests took about 223 seconds to prove, or 110 tokens per second; each proof was 18.78 MB.
Each request covers a 1,024-token window, and each proof checks one token. The client needs no GPU: downloading the 6.5 MB commitment and a proof for each request is enough to verify the result. Checking a proof took 17 seconds on 24 CPU threads, or 21 seconds on one thread, including checks of the commitment.
For comparison, Anthropic ran vLLM on the FP8 release of the same model using eight H100 GPUs. Per GPU, proving the batch took about 72 times longer than vLLM processing the same 24 requests, with results ranging from 66 to 77 times across runs; at vLLM’s highest tested load, the gap was about 94 times. The prototype’s proof is small relative to the model computation, but generating it remains substantially slower than running inference without proofs.
The proof hides weights, not architecture
Anthropic says FlashProve’s proof reveals neither the model weights nor intermediate computation values, including which experts ran at each layer. The model’s architecture is not hidden. A commitment takes about 39 minutes to create and is good for about 16 million requests before the provider must commit again.
The security claim has limits. Anthropic says a valid proof can establish that a model served inference, but does not establish that the same hardware was not also training a model. The company also describes FlashProve as a software-only approach, distinct from trusted-hardware systems; it says the two approaches can offer different, complementary guarantees.
Anthropic releases code and formal checks
Anthropic released executable code, a protocol specification, a technical report, Lean proofs and a visualizer for auditing the formal statements. The code, proofs and documentation use the Apache 2.0 license. The release includes a fast C++ verifier and a verifier whose correctness is formally proved in Lean.
The authors frame the project as a starting point: “This research post is meant to share intermediate progress, and not a completed research agenda.” They invite others to examine and improve the work, while presenting the measurements as progress toward making cryptographic proofs practical for model inference.