Anthropic releases FlashProve, open code for proving a model's identity

A buyer of hosted model inference has had no way to check the answer. There was no proof it came from the model named on the invoice. On 2 November Anthropic released FlashProve, an open source system. It uses zero-knowledge proofs to confirm an answer came from a specific set of model weights. The code, the specification, formal proofs in Lean, and a C++ verifier are all on the FlashProve repository. The licence is Apache 2.0.

What the system does

A provider commits once to a model. The commit produces a small fingerprint of the weights. Every later inference call then produces a short proof. The proof says the answer came from those committed weights. A user downloads the proof and the fingerprint, and the verifier returns yes or no. Anthropic writes that "cryptographic proofs of inference solve this problem: they let a model provider commit to a model and then prove that each response was produced by that model."

The verifier does not see the weights. Anthropic says this is the point. A vendor can keep its model private and still let a buyer audit identity.

The numbers Anthropic reports

Anthropic ran the system on Llama 4 Maverick, a 400 billion parameter mixture-of-experts model, at 4-bit. The prover produced about 110 tokens a second on a single H100 GPU. Each proof for a 1,024 token request is about 19 megabytes. Verification took 17 seconds on 24 CPU threads. On a single thread it took 21 seconds. The prover is 70 to 95 times slower than vLLM on the same hardware. Anthropic calls FlashProve a research prototype. The one-off commitment phase for Llama 4 Maverick took about 39 minutes.

What a buyer and a builder can do today

Anthropic says the work is "intermediate progress, and not a completed research agenda". The slowdown rules out a plain swap into a live API path. Two uses are already practical. A regulator or a large buyer can ask for a proof on a sample of calls after the fact. One in a thousand would be a workable rate. A model lab can publish a fingerprint with each release. A third party can then check that the hosted endpoint matches. Both change the contract without needing every call proved.

The release also moves the conversation from marketing to math. Anthropic tells TechCrunch the goal is to stop providers from secretly swapping cheaper models. Swaps happen to cut costs or to inflate benchmark scores. A buyer who writes a FlashProve clause into a contract forces that question to be answered. The answer is due before the money goes out.

Source

• Provable inference, Anthropic.
• FlashProve on GitHub, Anthropic, Apache 2.0.
• Anthropic is working on a system to prove AI models' identity, TechCrunch.