TL;DR — Key Takeaways
- Anthropic has introduced FlashProve, an open-source research prototype designed to verify which AI model generated a response using cryptographic proofs.
- FlashProve uses mathematical fingerprints and zkSNARKs to verify model computations without exposing proprietary model weights.
- Tests demonstrated CPU-based proof verification, but high compute costs and a 1,024-token context limit currently constrain the technology’s practical use.
Millions of people use AI models every day, but most have no way to independently verify which model is actually generating their answers. An AI provider might promise access to a particular model, but what prevents it from quietly substituting another less costly model?
In a research announcement this week, Anthropic introduced FlashProve, an open-source research prototype designed to give AI responses something like a tamper-evident seal. Using cryptography, it is designed to let customers or auditors verify that AI outputs match a particular model’s computation, without access to proprietary model weights. The technology could be useful for enterprises paying for access to specific AI models, security teams investigating server tampering, and auditors checking whether the models they evaluate are the ones customers receive.
FlashProve starts with an AI provider creating and publishing a cryptographic fingerprint, called a commitment, tied to a specific set of model weights, which are the numerical values learned during training that determine how the model processes information. The fingerprint doesn’t reveal the weights themselves, but it gives others a way to verify that they were used to generate a particular response.
After the model generates a response, the provider produces a separate cryptographic proof showing that the committed model, given the user’s prompt, produced the output being checked. The recipient then uses a verification program to check the proof against the commitment. Cryptographic hashes and mathematical checks make this possible without accessing the model’s weights or rerunning the model.
This cryptographic technique is known as zk-SNARK. Its “zero-knowledge” property means the proof doesn’t reveal the model’s private weights, while “succinctness” means someone can verify the proof without the expensive computation required to run the model itself. If the checked output doesn’t match the committed model’s computation, the proof fails verification.
In tests with Meta’s 400-billion-parameter Llama 4 Maverick, Anthropic said FlashProve processed about 110 tokens per second while generating proofs using one Nvidia H100 GPU. Each proof was approximately 19 MB and checked one token within a 1,024-token context. Verification took 17 to 21 seconds on a CPU. However, Anthropic said generating the proofs required roughly 70 to 95 times the GPU time of conventional inference using vLLM.
The prototype has other limitations. The current implementation supports contexts of only 1,024 tokens. FlashProve also verifies an integer-based version of the model, meaning legitimate responses generated using conventional calculations or random sampling might not match its results. Because proofs are generated after responses are delivered, the system can detect tampering after the fact but cannot prevent it.
Anthropic has made FlashProve available as an open-source research prototype under the Apache 2.0 license, allowing others to explore and build on the work. It’s not a commercial AI feature, but further development could eventually allow customers to verify which model they’re using instead of taking the provider’s word for it. Read more in a technical paper here.
