Anthropic's FlashProve proves which model answered, within limits

What Anthropic released

FlashProve relies on zkSNARKs, a zero-knowledge proof technique. The provider first publishes a cryptographic fingerprint of the model's weights. It then issues a compact proof with each response. That proof shows the committed model generated that output. A verifier checks the proof against the published fingerprint. It never runs the model itself. The proof reveals nothing about the weights. That is the point: closed labs such as Anthropic and OpenAI treat those numbers as their most valuable asset.

Anthropic published the work with technical documentation, executable code and formal verification materials. The code, Lean proofs and documentation sit on GitHub under the Apache 2.0 licence.

Heise notes the comparison Anthropic draws. People recognise a friend by face, voice or handshake. Models have no equivalent tell. A convincing answer does not reveal which model produced it. The same outlet reports that Anthropic's own Claude model contributed key optimisations. The repository labels FlashProve an unmaintained research prototype.

The performance claim

Anthropic measured proof generation at roughly 110 tokens per second. It ran on a single Nvidia H100 GPU. The model was Meta's Llama 4 Maverick, a 400-billion-parameter model. Each proof comes to about 19 megabytes. Heise puts verification at 17 seconds with 24 threads. It puts verification at 21 seconds on a single thread. The same outlet reports that FlashProve needed 223 seconds on an H100 to generate proofs for 24 batched requests.

Proof generation still costs roughly 70 to 95 times the compute of ordinary inference. That is the gap between a working prototype and a service that answers at chatbot speed.

The earlier open-source system needed over 14 hours to process 1,000 tokens. It produced a 93.6-gigabyte proof that took nearly a full day to verify. Heise cautions that the two sets of figures are not directly comparable. The hardware, methods and proof goals differ.

What it cannot do yet

FlashProve currently proves contexts of up to 1,024 tokens. That is far below the context windows of current models. It hides the weights but not the model's underlying architecture. The proof holds only when the model picks the single most likely next token. It does not hold with the randomised sampling that chatbots use in normal conversation.

Anthropic tested a 4-bit quantised version of Llama 4 Maverick, according to Heise. It is still open whether the method survives longer conversations. It is also open whether it survives the regular operation of commercial models.

The company describes FlashProve as a research prototype. It is not a feature in Claude or any other commercial product.

Why provenance matters

Today an API customer has to take the provider's word for which model answered. A provider could route requests to a cheaper model while billing for a frontier one. A third-party platform could swap models without telling anyone. FlashProve would make that checkable without the provider handing over its weights.

Anthropic lists other uses. Regulators could check whether a provider runs only approved models. Companies could prove a specific safety model reviewed their code. Providers could detect tampering on their servers.

Independent evaluators face the same gap. They need confidence that the responses they test came from the model under evaluation. The company had already set itself a target. Its Frontier Safety Roadmap called for an inference verification prototype by September 2026. Anthropic says it met that goal through a separate project. That project signs inference traffic and traces computation on a trusted server. FlashProve chases the same goal with cryptography. It needs no trusted hardware. TechCrunch notes the design aims to be light enough to verify on a local device.

What happens next

Anthropic is publishing the work so outside researchers and developers can examine it and improve it. Its researchers describe the post as intermediate progress rather than a finished agenda. The licence permits commercial reuse. That matters if a cloud provider or an auditor wants to build on it.

Maintenance, though, falls to whoever picks the code up. No date is set for a production version.