Anthropic's FlashProve proves which model wrote a reply

FlashProve addresses a trust gap that has grown as more businesses route queries through third-party AI services. Without a way to verify which model produced a response, a provider could substitute a cheaper model or an attacker could tamper with the data stream. Anthropic's prototype uses zkSNARK, a cryptographic technique that lets a provider create a digital fingerprint of the model's weights and then deliver a compact proof with each response, revealing nothing about the weights themselves.

The technical report shows FlashProve is far faster than earlier attempts: it generates proofs at roughly 110 tokens per second on a single H100 GPU for Meta's Llama 4 Maverick, a 400-billion-parameter model. That still adds overhead of roughly 70x to 95x compared to normal inference, but it is a significant jump from the only comparable open-source system previously available, which took over 14 hours to process 1,000 tokens and produced a 93.6-gigabyte proof that took nearly a full day to verify.

Anthropic sees several use cases, including regulators checking that providers run only approved models and companies proving their code was reviewed by a specific safety model. In its Frontier Safety Roadmap, Anthropic had set a goal of building an inference verification prototype by September 2026, and the company says it already hit that target through a separate project that signs inference traffic and traces the computation on a trusted server. FlashProve pursues the same goal with a purely cryptographic approach that doesn't need trusted hardware. However, the prototype currently only proves contexts of up to 1,024 tokens and works only when the model picks the single most likely next token, not with the randomized outputs chatbots typically produce—limits that suggest it is not yet ready for everyday use.