Anthropic's FlashProve Lets AI Models Prove Their Identity Without Exposing Their Weights

Posted on 4th Nov 2026 11:06:48 in Artificial Intelligence, Machine Learning

Tagged as: Anthropic, FlashProve, AI provenance, zero-knowledge proofs, AI regulation

Anthropic has published an open-source research prototype that lets an AI provider prove, cryptographically, which model produced a given answer, without handing over the model's weights. The system is called FlashProve, and it was released on November 3 alongside a technical report, a protocol description, a C++ verifier, a second verifier written in Lean, and machine-checked proofs of the protocol's security properties. The code sits on GitHub under the Apache 2.0 licence.

The problem it addresses is easy to dismiss until you need it. When a business sends a prompt to a model provider, it receives a stream of tokens and a claim about which model generated them. Nothing in that exchange proves the claim. A routing service could quietly substitute a cheaper model and bill for the expensive one. A compromised server could tamper with a response while still presenting itself as the original model. A vendor could announce that a security review was performed by a frontier cybersecurity model and have that announcement be worth exactly as much as the vendor's word.

FlashProve turns that word into a proof file roughly 19 megabytes in size, which a normal desktop processor can check in seconds.

What FlashProve Actually Proves

The statement a FlashProve proof certifies is narrow and precise: the committed model, evaluated on this specific prompt, produces exactly these output tokens. That is all. It is not a claim that the answer is correct, useful, safe or free of hallucination. It is a claim about provenance, and provenance is the thing that has been missing from commercial AI.

The design has two phases. In the offline phase, the provider publishes a commitment to the model weights: a short digest that pins down one exact set of numbers while keeping the numbers themselves secret. Anthropic reports that this commitment is about 6.5 MB in total and takes roughly 39 minutes to produce once per model. For technical reasons described in the technical report, a single commitment remains valid for around 16 million requests before the provider has to commit again.

In the online phase, the provider produces one proof per request. Anyone holding the commitment, the prompt and the reply can check the proof and be convinced that the committed weights, run on that prompt, generate that reply. Two properties make this useful rather than trivially expensive. The proof is zero-knowledge, meaning it reveals nothing about the weights, the intermediate values of the computation, or which experts in the mixture-of-experts network were activated for each token. And it is succinct, meaning verification costs a tiny fraction of what re-running the model would cost.

Anthropic is explicit that architecture is not hidden. Only the weights are. A provider that regards its model's shape as a trade secret would need a different construction, one that commits to the architecture as well — a variant the researchers mention but did not build.

Inside the Protocol: Commit, Prove, Verify

Under the hood, FlashProve is a zkSNARK of the sort already deployed in blockchain scaling systems such as Starknet and Mantle, and in anonymous credential systems. The construction follows a well-trodden recipe. An information-theoretic object called an interactive oracle proof is compiled into a cryptographic argument using Merkle hash trees, then collapsed into a single non-interactive message with the Fiat-Shamir transformation.

The cryptography rests on hash functions rather than on elliptic curves or lattices. FlashProve assumes that the compression function inside BLAKE2 behaves like a random function, and the proof of soundness holds in the random oracle model. The practical consequence is post-quantum security: an attacker with a large quantum computer gains no obvious advantage against a hash-based argument. The protocol can also swap in a different hash function if BLAKE2 is ever weakened.

The part that required original work is the interactive oracle proof itself, which had to be built specifically for transformer inference. FlashProve targets mixture-of-experts models, where each transformer layer routes a token through a small subset of expert sub-networks. That structure is what makes the arithmetic tractable: for Llama 4 Maverick, a 400-billion-parameter model that activates roughly 17 billion parameters per token, the prover's work scales with the experts that actually ran rather than with the full parameter count.

Anthropic also formalised the protocol and its security claims in Lean 4, a proof assistant that produces machine-checkable mathematics. The published soundness bound is approximately q divided by 2^124 plus 2^-101, where q is the number of hash queries an adversary makes. An interactive viewer of the theorems ships with the repository so that outside auditors can inspect the statements without re-deriving the proofs. The researchers concede the remaining trust gaps plainly: nothing formally guarantees that the fast C++ verifier matches the Lean specification, and the mathematical statements themselves still need human review to confirm they say what they were meant to say.

The Performance Numbers That Matter

Provable inference has existed as a research idea for years. What is new here is that the numbers crossed into the range where a commercial provider could plausibly run it.

On a server with a single NVIDIA H100 and 24 CPU cores, FlashProve proves a batch of 24 requests containing 1,024 tokens each in about 223 seconds. That works out to roughly 110 tokens per second of proof generation, with each proof file around 18.78 MB. Verification runs on the client's CPU: about 17 seconds on 24 threads, or 21 seconds on a single thread, including the checks associated with the offline commitment.

The overhead relative to ordinary inference is substantial but no longer absurd. Anthropic benchmarked vLLM, a widely used inference engine, running the same model in FP8 precision across eight H100s. Per GPU, proving took about 72 times longer than serving the same batch, or about 94 times at the highest load tested. That is roughly two orders of magnitude of overhead, which is high for a production feature but low by the standards of earlier zero-knowledge machine learning systems.

The historical comparison is stark. In 2024, zkLLM proved a 13-billion-parameter model at about 2.5 tokens per second on an A100. The only previous proof of Llama 4 Maverick that Anthropic cites, a system called VerInf, reported 14.3 hours to prove 1,000 tokens on a DGX Spark, producing a 93.6 GB proof that took almost a day to verify. FlashProve proves the same model at 110 tokens per second with proofs three orders of magnitude smaller. The current peer-reviewed state of the art, DeepProve, reaches about 1.4 tokens per second for Gemma 3 on a single machine, though it can hit 31 tokens per second when distributed. A commercial system called Attestable reports 53 to 77 tokens per second for a dense 31-billion-parameter model, without releasing an open-source library.

Why Model Identity Became an Urgent Problem

Four scenarios explain why a lab would spend engineering effort on this. The first is straightforward substitution. Businesses increasingly reach models through third-party routers and aggregators rather than direct APIs. Those intermediaries have both the opportunity and, in a price-sensitive market, the incentive to serve a smaller model than the one advertised. A customer paying frontier prices for a mid-tier model has no way to detect the switch from output quality alone, because output quality is noisy and hard to attribute.

The second is tampering. Inference servers are high-value targets. An attacker who compromises one can exfiltrate weights, inject malicious content into responses, or serve a different model entirely while hiding among genuine traffic. A proof bound to a specific weight commitment means the attacker must produce valid proofs for the expected weights, which is infeasible without breaking the underlying cryptography.

The third is the quiet version of the same threat: a model that is more capable than the one authorised, presenting itself as the weaker model to avoid the classifiers and monitoring that would apply to something stronger. Anthropic frames this as a plausible near-future risk as models become better at improving and deploying themselves. Verifying which weights are actually running on a server is a precondition for any control regime that assumes the server is running what it says it is.

The fourth is claim inflation. A developer might assert that a library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might assert that a business plan was reviewed by an appropriate model. Chat logs prove nothing, since they can be fabricated or generated with a cheaper substitute. A proof file attached to the response changes the evidentiary status of the claim from assertion to attestation. Anthropic sketches a concrete use case: a proof that a provider spent at least a million tokens on a specific model attempting to find bugs in a specific patch, and did not find any.

Regulators, Auditors and the Pacing Debate

The regulatory angle is where the technology gets politically interesting. Proposals to pace frontier AI development often rest on monitoring hardware and how it is used. A provider might be required to devote a given cluster to inference rather than training the next model. Enforcement has been the weak link, because the regulator cannot inspect the provider's servers continuously.

A proof regime inverts that. The regulator asks the provider for certificates covering the inference served in a given period. Each certificate binds a response to the committed weights. A provider that quietly repurposed the cluster for training could not produce matching proofs for traffic it did not serve. The zero-knowledge property protects the provider too: the regulator learns nothing about proprietary weights. Anthropic is careful to note the limit — such a system can show that hardware is serving inference, not that it is refraining from training on the side.

The same machinery supports model approval regimes that require providers to serve only models cleared as safe. A proof bound to the approved weight commitment simply fails to verify if an unapproved model is substituted. For independent evaluators, the value is more immediate: an evaluator testing a model before and after release needs to know that the artefact being tested is the artefact being served, otherwise benchmark results describe a model that may not exist in production.

Anthropic ties the work to a public commitment in its Responsible Scaling Policy: a prototype for verifying inference traffic by September 30, 2026. That goal was met through a separate project that signs inference traffic and recomputes responses on a trusted server. FlashProve is the software-only, cryptographic route to the same objective.

The Limits Anthropic Is Upfront About

The prototype has real constraints, and the researchers list them rather than burying them. Proofs cover only 1,024-token contexts, which is short for chat workloads where context accumulates across hundreds of thousands of tokens. Only mixture-of-experts architectures are supported. The proof is generated after the fact rather than inline, so a tampered response still reaches the user before the failed proof signals a problem — post-hoc verification detects tampering, it does not prevent it. Timing side channels are explicitly out of scope. Multi-GPU proving is not implemented, and the prover occupies one H100 exclusively.

The numerical limitation is the most subtle. Floating point arithmetic is not associative, so identical inference can produce slightly different logits across machines. FlashProve sidesteps this by proving a statement about an integer-quantised version of the model under greedy decoding. An honest floating-point server could therefore diverge from the integer model at some position without any tampering having occurred, and the proof would fail. Anthropic expects that divergence rate to be small and points to statistical methods for separating benign numerical noise from attack, but the gap is real and the researchers say so.

There is also a plain deployment fact: FlashProve is a research artefact, version 0.16.0, not maintained and not accepting contributions. Anthropic states that it has no plans to deploy the system in its own products. The repository is primarily an invitation for others to take the design and improve it.

What This Means for Businesses Building on AI

Nobody needs to budget for zkSNARK infrastructure this quarter. But the direction of travel is worth noting for anyone procuring AI capacity, reselling model access, or building compliance evidence into an AI product.

First, model identity is becoming a contract term rather than a technical detail. Once verification is possible, buyers of inference start asking for it, and providers that cannot attest to what they served lose negotiating position. Second, intermediaries face the most immediate pressure. A router that cannot prove which model handled a request has a trust problem that marketing cannot solve.

Third, the cost curve is moving quickly. Going from 0.02 tokens per second to 110 tokens per second for the same 400-billion-parameter model in roughly a year suggests that provable inference follows the same trajectory as most cryptographic primitives: expensive, then specialist, then unremarkable. The 70-fold overhead measured today is the number to watch decline.

Fourth, the honest framing matters more than the hype. FlashProve does not make AI trustworthy. It makes one specific claim about AI auditable, and it does so with published code, a published specification and formally checked security proofs. In a market where every vendor asserts its own diligence, a mechanism that lets a customer check the assertion without trusting the vendor is a different category of thing.

Anthropic's own summary is unusually modest for a research announcement: this is intermediate progress, shared so that others can take it and improve on it. For a field that has spent three years arguing about how to verify what models do, having a working answer to the narrowest question — which model said this — is a useful place to start.

Sources

• TechCrunch — Anthropic is working on a system to prove AI models' identity
• Anthropic — Progress on provable inference for large language models
• Anthropic — FlashProve: an open-source library for provable inference (technical report)
• GitHub — anthropics/FlashProve, a research prototype for zero-knowledge proofs of AI inference
• Infobae — Anthropic presenta FlashProve, un sistema que verifica si una respuesta procede de un modelo de IA determinado