Anthropic open-sourced FlashProve, a research tool that produces a proof that a reply really came from a specific AI model, without revealing the model's weights.

Anthropic open-sourced FlashProve, a research tool that produces a proof that a reply really came from a specific AI model, without revealing the model's weights.

Today, when you use an AI model through an app or a router, you can't check that the model you picked is the one that actually answered. Anthropic's Frontier Red Team has published progress on "provable inference," which tries to fix that with cryptographic proofs (Anthropic research). Along with each reply, the provider sends a proof that a user can check on an ordinary CPU, with no GPU and no access to the model's weights. On X, Anthropic said the proofs could "make it harder for attackers to hijack a chat, or enable safety evaluators to verify that the model they're testing is the same one being served to customers" (Anthropic on X). In Anthropic's test on Meta's open Llama 4 Maverick (400B parameters, 4-bit), one H100 GPU produced proofs at about 110 tokens a second. Each proof was about 19 MB per 1,024-token request and took about 17 seconds to check on a 24-thread CPU. Anthropic says that's about 70 to 95 times the GPU time of serving the model normally. That's still slow, but far faster than the one earlier proof of this model it knows of, which took 14.3 hours for 1,000 tokens. Anthropic says Claude did much of the work: "Claude has produced improvements on zkSNARKs for inference." The code is on GitHub under an Apache 2.0 license as a research artifact that isn't maintained (GitHub). There are clear limits. It only proves an exact integer version of a model under greedy decoding, it hides the weights but not the model's architecture, and attacks that measure timing are out of scope. Anthropic calls it "intermediate progress, and not a completed research agenda."

What to watch: whether any provider, Anthropic included, starts offering proofs like this for real traffic. Nothing changes in Claude or the API today. If it ever ships, it would let you check that a router or reseller really gave you the model you paid for.