Anthropic has released FlashProve, a research prototype that uses cryptography to verify whether an AI response actually came from the claimed model. The system still has significant limitations.
Anyone sending a query to an AI model today has no way to verify that the chosen model actually generated the response. A routing service could quietly swap in a cheaper model to cut costs. An attacker could tamper with the data stream. Anthropic says its new open-source research prototype FlashProve is designed to tackle this problem.
FlashProve uses a cryptographic technique called zkSNARK. In simple terms, the model provider first creates a digital fingerprint of the model's weights. With every response, the provider then delivers a compact proof showing that this specific model generated the output. The proof reveals nothing about the secret model weights themselves.
Proof generation is fast enough to be practical #
According to the technical report, FlashProve generates proofs at roughly 110 tokens per second on a single H100 GPU for Meta's Llama 4 Maverick, a 400-billion-parameter model. Each proof is about 19 megabytes and can be verified in 17 seconds on a standard CPU. That adds overhead of roughly 70x to 95x compared to normal inference.
That sounds like a lot, but it is a significant jump from earlier systems. The only comparable open-source system previously available took over 14 hours to process 1,000 tokens, Anthropic says. It produced a 93.6-gigabyte proof that took nearly a full day to verify.
Regulators could verify which models providers actually run #
Anthropic sees several use cases. Regulators could check whether a provider is actually running only approved models, companies could prove their code was reviewed by a specific safety model and providers could detect tampering on their servers, like an attacker or a more advanced model slipping in unnoticed.
In its Frontier Safety Roadmap, Anthropic had set a goal of building an inference verification prototype by September 2026. The company says it already hit that target through a separate project that signs inference traffic and traces the computation on a trusted server. FlashProve pursues the same goal but takes a purely cryptographic approach and doesn't need trusted hardware.
Context window and sampling limits hold it back #
Anthropic stresses that FlashProve is a research prototype. The system currently only proves contexts of up to 1,024 tokens, far below the context windows of current models. It hides the model's weights but not its underlying architecture. And the proof only works when the model picks the single most likely next token, not with the randomized outputs that chatbots typically produce in everyday use.
The full code, Lean proofs, and documentation are available on GitHub under the Apache 2.0 license.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Read on for the full picture.Subscribe for hype-free coverage.
Full access to every article on THE DECODER
No ads
Join the comments and community discussions
A weekly AI news recap via mail
6x/year: "AI Radar" — deep dives on the AI topics that matter most
Daily AI news, always up to date
Our full ten-year archive
Covered by a team with 10+ years in AI
Subscribe to The Decoder