FlashProve verifies the model behind a response at 110 tokens per second

A customer calls an expensive model through an API but cannot see what happens behind the interface. A provider or intermediary AI gateway can quietly route the request to a cheaper model and then bill for the original one. Detecting the substitution from the text alone is nearly impossible: a similar response does not prove which system computed it.

Anthropic proposed FlashProve for this problem, an open research prototype based on zkSNARKs. It makes it possible to attach cryptographic proof to a response showing that the result was genuinely produced using the declared weights. The weights themselves are not disclosed.

How it works in practice

Consider an enterprise code-review service. The company requires every code fragment to be analyzed by a specific security model before release. Today, the API log shows only the model name included in the request. If the router substitutes a cheaper option, the log entry proves nothing by itself.

With FlashProve, the supplier first creates a cryptographic commitment to the model weights. After processing the request, it generates a compact proof tied to that commitment and the computation result. The customer verifies the proof on a standard processor and receives confirmation that the required model produced the response, without gaining access to its proprietary parameters.

In a test with Llama 4 Maverick, a 400-billion-parameter model, the system generated proofs for roughly 110 tokens per second on a single Nvidia H100 accelerator. One proof was about 19 MB, and verification took 17 seconds on a standard CPU.

This represents substantial progress over the previous comparable open solution. According to Anthropic, that system took more than 14 hours to process 1,000 tokens, produced a 93.6 GB proof, and required almost a full day for verification.

Where the technology could be useful

The first use case is auditing AI providers and routers. Customers could verify that a service actually used the model they paid for instead of a cheaper substitute. This is especially important for platforms that automatically distribute requests among multiple suppliers.

The second use case is regulated workflows. An organization could prove to an auditor that documents, software code, or decisions were checked by an approved model. The third is infrastructure control: the unexpected appearance of a different model in the compute chain may indicate a configuration error or tampering.

FlashProve does not require trusted hardware. This distinguishes it from systems that sign traffic and track computation inside a controlled server. Its cryptographic proof can be verified independently of the supplier's infrastructure.

Why it is too early to integrate FlashProve into a product

The main limitation is cost. Creating a proof increases compute costs by roughly 70–95x compared with ordinary inference. For a mass-market chat service, that premium remains unacceptable even though the proof itself is generated fairly quickly.

The context is limited to 1024 tokens, which is insufficient for modern assistants, long documents, and large repositories. The prototype also works only with greedy decoding, where the model always selects the most probable next token. Conventional chatbots use random sampling to make responses less repetitive. In addition, the proof hides the weights but not the model architecture.

FlashProve is therefore not a production-ready module today, but a sign that a new layer of AI infrastructure is emerging: verifiable inference. Gateway developers should begin retaining model identifiers, generation parameters, and the complete routing chain. Product teams should identify operations where proof of a response's provenance truly justifies the additional cost, such as code audits, financial decisions, medical workflows, or regulatory compliance.

The code, formal proofs in Lean, and documentation have been published under the Apache 2.0 license. Experimentation can begin now, but customers cannot yet be promised verifiable operation for a conventional chatbot.