Anthropic releases FlashProve: proof that your LLM really generated the answer

You paid for a top-tier model, but an intermediary service swapped it for a cheaper one along the way. Detecting this from the response text is nearly impossible: the quality may still be perfectly respectable. Anthropic has released a research prototype that aims to close this gap with cryptography.

What exactly they built

The system is called FlashProve. The idea is this: the model provider publishes a commitment—a kind of fingerprint—of its weights in advance. The weights themselves remain secret. The provider then attaches a short zkSNARK proof to every response, showing that those committed weights, given that prompt, produced those exact tokens. The user verifies the proof on an ordinary CPU, without the weights or powerful hardware.

Think of it as a notarized seal on every model response. The seal cannot be forged, while the notary never sees what is inside the vault containing the weights.

The numbers

The system was tested on Llama 4 Maverick: 400 billion parameters, a mixture-of-experts architecture, and 4-bit quantization. A single H100 generates proofs at roughly 110 tokens per second. The proof is about 19 MB for a 1,024-token request. That requires 70–95 times more GPU time than running the model itself with vLLM. According to the authors, previous open systems are orders of magnitude slower.

Claude itself performed part of the work by optimizing the system. But solutions like this are difficult to verify in complex code, so the key security guarantees were formalized as statements in Lean, a formal verification language. They can be audited separately, and a visualizer is available for that purpose. Five artifacts have been released: a post, a technical report, a protocol description, the code—including the prover, a fast C++ verifier, and a Lean-verified verifier—and the proofs themselves. The license is Apache 2.0.

Why this matters

The authors identify four use cases:

• AI pacing: a regulator verifies that the hardware is actually running inference for the declared model instead of training something else on the side.
• Protection against substitution: a company confirms that the same weights are running on its servers even if a server has been compromised or the model attempts to replace itself.
• Text provenance: it becomes possible to prove that code was reviewed by a specific powerful model. For example, a “Proof-of-Failure” could show that the model spent at least one million tokens and found no bugs in a patch.
• Model approval: a regulator verifies that only authorized models are running in production.

Anthropic separately references its Frontier Safety Roadmap goal of building a prototype by September 30, 2026. That goal was met through a different, adjacent project: traffic is signed, while inference is recomputed on a trusted server. FlashProve pursues the same objective through a different route.

Limitations

The solution is not production-ready on its own. GPU-time overhead measured in tens of times makes it impractical for every request in a conventional chat product. The model architecture is not hidden; only the weights are. The proof does not demonstrate that the hardware is not also being used for training in parallel. The authors themselves describe the work as an intermediate result, not a finished program.

There is also an alternative: trusted execution environments (TEEs) rely on the chip manufacturer, whereas this approach bases security on the computational hardness of cryptographic problems. The authors view the two approaches as complementary.

What to do in practice

If you are building a router, model aggregator, or API proxy, keep an eye on this field: within a couple of years, customers may demand provable model authenticity. If you audit models or assess their security, it is already worth examining how Lean specifications can help verify claims. For everyone else, the takeaway is simpler: verifiable inference has moved from theory to a working, open-source prototype that can now be tested and improved.