Anthropic’s FlashProve Proves Which AI Model Answered, at 70–95x the Cost

Last updated: 4 November 2026. Figures below are sourced to the publications linked inline, and any number that originates with Anthropic itself is flagged as self-reported.

The 60-second version

• Anthropic has open-sourced FlashProve, a cryptographic system that lets anyone check which exact AI model — down to its specific set of weights — produced a given reply, without the provider ever handing over those weights.
• The mechanism is a zero-knowledge proof (a zkSNARK): a provider publishes a one-time “commitment” to a model, then attaches a short proof to each answer that any outsider can verify against that commitment.
• Tested on Meta’s 400-billion-parameter Llama 4 Maverick running on a single Nvidia H100 GPU, FlashProve produced proofs at roughly 110 tokens a second — reported at 70 to 95 times slower than simply serving the same model to a user.
• The release is open source under Apache 2.0 on GitHub, and its core mathematical claims are written and machine-checked in the formal-proof language Lean, the same tool Anthropic has used to verify other Claude-generated mathematics.
• Anthropic has not said it will put FlashProve into Claude. It is pitched as shared infrastructure for an industry-wide trust problem, not a shipped consumer feature.

The problem FlashProve is trying to solve

Every call to a hosted AI model runs on faith. When an API says a reply came from a flagship model, the customer has no independent way to check that. The provider could route the request to a cheaper, smaller model to save money, a reseller could substitute a different backend behind an identical-looking endpoint, and an evaluator benchmarking “Model X” could unknowingly be scoring something else entirely. Because the weights are usually a trade secret running on hardware the customer never sees, there has been no way to settle the question without the provider’s cooperation.

That is the gap Anthropic’s provable-inference research and the accompanying open-source tool, FlashProve, are aimed at. According to Anthropic’s own write-up and detailed coverage from AI Polix, the system works in two stages. First, a model provider publishes a cryptographic “commitment” — a short fingerprint that pins down one exact set of weights without revealing them. Then, for every request it answers, the provider generates a compact proof that the output tokens are precisely what the committed model would produce for that prompt. Anyone holding the commitment, the prompt and the reply can check the proof mathematically, with no access to the weights, the hardware or the provider’s infrastructure.

It is a genuinely different approach from the other verification method the industry has been racing to adopt this year. Anthropic, OpenAI and xAI have all shipped statistical watermarking for AI text, which biases token selection in a detectable but probabilistic pattern — useful for spotting AI-generated text in the wild, but not a proof of which model, and something that degrades once text is edited, paraphrased or translated. FlashProve instead gives a binary, mathematically sound answer to a narrower question: did this specific committed model produce this exact output? It proves identity, not authorship in the broader sense, and it does so with cryptographic certainty rather than a statistical hint.

What is actually hidden, and what is not

The clever part of a zero-knowledge proof is what it withholds. Per Anthropic’s own account and AI Polix’s reporting, a FlashProve certificate conceals the model’s weights, the intermediate values computed during inference, and — for a mixture-of-experts model like Maverick — which of the model’s internal sub-networks handled each token. What it reveals is only the architecture family and the fact that a specific committed set of weights, and nothing else, generated this specific reply to this specific prompt. A competitor could not use the proof to reconstruct or steal the model; a customer could not use it to learn anything about the model beyond the one fact they are checking.

That distinction matters because it is also what Anthropic’s defensive research has been circling for months on the other side of the same problem: stopping rivals from copying Claude’s behaviour through distillation. The company’s anti-distillation defences, announced in October, claimed to cut unauthorised copying of Claude’s outputs by up to 99%. FlashProve is the inverse move: instead of making the model harder to copy, it makes the model’s identity provable to someone who is never shown the thing being protected. Together, they sketch a strategy in which Anthropic treats its weights as a sealed asset that can still be audited, verified and licensed without ever being exposed — which lines up with a company that, per its revised IPO filing published the day before FlashProve shipped, has committed roughly $895bn to compute deals it will need enterprise customers, auditors and regulators to trust for years to come.

The catch: it costs 70 to 95 times more than just answering

This is the number that should temper any claim that FlashProve is close to practical. On a single H100 GPU, proving a batch of replies from the 400-billion-parameter Maverick model — specifically, a third-party 4-bit quantization of its publicly released weights, not Meta’s full-precision version — ran at around 110 tokens a second — a large improvement on prior academic attempts (one system Anthropic cites, VerInf, reportedly managed roughly 0.02 tokens a second on the same model, taking over 14 hours to prove a single 1,000-token reply, per AI Polix’s account of Anthropic’s own comparison). But measured against ordinary GPU-optimised serving, Anthropic’s own figures put the overhead at about 72 times longer in typical runs and roughly 94 times longer at its highest tested serving load — though that comparison is to the FP8 version of the same model running across eight H100 GPUs, not the 4-bit, single-GPU setup used for proving, so it isn’t a perfectly apples-to-apples measurement. RuntimeWire‘s coverage rounds the same finding to “70 to 95 times.” In plain terms: proving who answered a question currently costs dozens of times more compute than simply answering it.

Other limits compound that cost. The proofs so far only cover replies up to 1,024 tokens, far short of a typical production conversation. They assume an exact, deterministic (“greedy”) decoding process rather than the sampling randomness behind most chatbot answers. Proving happens after the fact, on batches, not as a live guarantee attached to a streamed reply. And Anthropic has been candid, in its own account of the project’s limitations, that the fast verifier used for everyday checking carries no formal correctness guarantee — it has only been tested for agreement with a slower, machine-checked version written in Lean, the formal-proof language more commonly associated with pure mathematics than production cryptography, and Anthropic does not guarantee that its Lean proofs, paper and code all match one another. There has been no independent security audit. That fits a pattern: Anthropic previously used Lean to machine-verify a Claude-generated formalisation of a notoriously hard piece of mathematics — Claude’s formalisation of Fermat’s Last Theorem, completed in 11 days — and, per AI Polix, Claude itself is credited with contributing to FlashProve’s own zkSNARK engineering. None of this is a minor footnote. It is the difference between a promising research prototype and something a bank’s compliance team could rely on tomorrow.

For builders and publishers: what to actually do with this now

FlashProve is not a tool to integrate into a product this week, but it is worth tracking. Anyone buying inference through a router, reseller or multi-model gateway should treat “which model actually served my request” as a question the industry is now trying to answer cryptographically, not just contractually, and should ask vendors directly whether they log model identity in a way that could support this kind of proof later. Teams benchmarking third-party APIs should note that model substitution, accidental or deliberate, remains essentially undetectable today without a system like this one, which nobody has yet deployed. And it is worth being clear that this solves a different problem from watermarking: a watermark helps spot AI-generated text after the fact and degrades under editing, while FlashProve, if it matures, would let a specific claim — “model A, not model B, produced this” — be checked mathematically rather than inferred statistically. For now, treat vendor claims about which model is running as something the industry still cannot independently verify, and build contracts and audit rights accordingly rather than waiting on a cryptographic fix that is not yet production-ready.

What we still don’t know

• Whether, or when, this becomes fast enough to run live. Anthropic says it intends to cut proving costs and extend the supported context length, but has given no timeline or target overhead.
• Whether Anthropic will use it in Claude itself. Nothing in the release commits the company to deploying FlashProve in its own production API.
• Whether the system has been independently audited. Anthropic’s own account describes limited internal adversarial testing and no third-party security audit yet.
• What this does not prove. A valid certificate shows a specific committed model produced a specific reply. It says nothing about whether the same hardware was simultaneously doing something else, such as training, and side-channel attacks and adversarial prompts are explicitly out of scope.
• Whether rivals adopt a compatible approach, or a competing one. OpenAI and Google have not announced equivalent systems, so it is unclear whether provable inference becomes a shared industry primitive or stays an Anthropic research project.
• Whether regulators would accept this as evidence. No regulator has said it would treat a FlashProve-style certificate as compliance proof, though the use case fits neatly with AI Act-style audit requirements now emerging in the EU.

FAQ

What is FlashProve, in one sentence?

An open-source cryptographic tool that lets anyone verify which exact AI model produced a specific reply, without its owner revealing the model’s weights.

Does this mean Claude’s weights are now public?

No. The proof reveals nothing about the weights themselves — only that one specific, committed model, and no other, generated the output being checked.

Can I use this today to check whether ChatGPT or Gemini is telling me the truth about which model answered?

Not yet. No major provider, including Anthropic, has deployed it, and today’s version is limited to short replies with a heavy computational cost. It is a research release, not a live service.

Why does proving identity matter if the answer itself is good?

Because a growing share of AI spending runs through routers and multi-model platforms where customers cannot see which backend actually serves a request. Quietly swapping in a cheaper model, or an unmonitored one, is currently undetectable from the outside. Provable inference is an early attempt to close that gap mathematically rather than contractually.

Sources

• Anthropic — “Towards provable inference” (research announcement, primary source)
• Anthropic — FlashProve source code and documentation, GitHub (primary source)
• AI Polix — coverage of the FlashProve release and benchmark comparisons
• RuntimeWire — “Anthropic says FlashProve proves model identity at 70 to 95 times inference GPU time”
• TechCrunch — further coverage of Anthropic’s provable-inference work

Please follow and like us: