Here is a question with no good answer today. When a chatbot or an API replies to you, how do you know which model actually produced the answer? You cannot. A routing service could quietly serve a cheaper model, an evaluator could be graded on different weights than the ones being tested, or a compromised server could alter the token stream, and the reply would still read fluently.
Anthropic’s answer, released November 2 as an open-source research prototype called FlashProve, is to give AI answers a cryptographic receipt. Built on a hash-based zkSNARK, a kind of zero-knowledge proof, FlashProve lets a provider prove that a reply came from one exact set of model weights, without revealing those weights to anyone. The idea is elegant. The price, for now, is brutal.
A commitment, a proof, and nothing else revealed
FlashProve works in two phases. First, offline, the provider publishes a short commitment that binds it to one specific set of weights. That commitment is about 6.5 MB and takes roughly 39 minutes of processing to generate. It reveals nothing about the weights themselves.
Then, for each reply, the system produces a proof that the output tokens are exactly what the committed model would produce for that prompt. Anyone holding the commitment, the prompt, and the reply can check the proof on an ordinary CPU, with no access to the weights and no GPU required. The weights, the model’s internal activations, and even which mixture-of-experts subnetworks ran for each token stay hidden. Anthropic’s researchers, led by Roy Rinberg and Alex Allain with co-authors from EPFL, MIT, StarkWare, and Succinct, also machine-checked the proof system’s top-level security claims in Lean, a proof assistant.
The numbers: fast to check, expensive to prove
Anthropic tested FlashProve on Meta’s Llama 4 Maverick, a 400.7 billion parameter mixture-of-experts model converted to 4-bit weights. The results show both why the idea is exciting and why it is not a product yet.
| Measurement | Result |
|---|---|
| Proving speed | About 110 tokens per second on one Nvidia H100 GPU |
| Batch of 24 requests | About 223 seconds to prove |
| Proof size | About 18.78 MB per 1,024-token request |
| Verification time | About 17 seconds on 24 CPU threads, 21 seconds on one thread |
| Proving overhead | About 70 to 95 times the GPU time of standard vLLM inference |
| Cheating odds | Caught except with probability around q/2^124 plus 2^-101 |
The asymmetry is the point. Verification is cheap, which is what makes a receipt useful: a customer, an auditor, or a regulator could check it without renting a GPU cluster. But proving costs 70 to 95 times the compute of just answering, which means a provider offering verified replies would pay roughly two orders of magnitude more per request. Anthropic is blunt that FlashProve is an intermediary research tool, not something ready for production, and the repository is published as an unmaintained research artifact under the Apache 2.0 license.
What FlashProve cannot prove
The limits matter as much as the capability. FlashProve proves identity, not quality. A valid proof says nothing about whether the answer was accurate, safe, or unbiased, only that the committed model produced it. It also cannot prove that the same hardware was not simultaneously training another model.
Coverage is narrow today. Only Llama 4 Maverick at 4-bit weights, with contexts up to 1,024 tokens, is supported, and no production model from Anthropic or anyone else is covered. A provider would have to publish a weight commitment and run the prover itself before any customer could check a reply this way. And there is a trust subtlety: the proof only counts as an identity check when the commitment comes from a party other than the server being tested, since a server that issues its own commitment could commit to whatever it is actually running.
Why this matters anyway
Even with those limits, the use cases Anthropic names are real. Independent evaluations could finally confirm they tested the model they think they tested, a problem that matters more as benchmark results drive purchasing decisions. Enterprises with approved-model requirements, say a bank allowed to use one specific model version, could get a cryptographic record instead of a vendor’s assurance. Regulators exploring AI compliance tooling get a concrete mechanism rather than a policy document.
That last point is the one to watch. As AI agents take on more consequential work, and as the best agent scores on new tests like SemiAnalysis GDPx remain strikingly low, the question shifts from whether a model can do a task to whether you can trust the system that claims it did. FlashProve does not solve that whole problem, but it does solve one slice of it with unusual precision, and it does so in the open, where others can build on it. For more on how AI evaluation is evolving, see our coverage of the GDPx benchmark results, DeepSeek’s open-source coding agent, and Mistral’s open-weights Large 4 release.
Sources: Anthropic, CryptoBriefing, Unite.AI, Blockchain News.
