Anthropic speeds up cryptographic proofs for AI

Anthropic introduced FlashProve, a prototype that lets you cryptographically prove which model produced an AI response without revealing its weights, meaning the internal values that define how the model works.

The idea addresses a problem that has no simple solution today: when you use a model through an API, you cannot independently verify that the response really came from the system the provider claims to be running. A routing service could replace it with a cheaper one, an attacker could alter the results, or a compromised server could be running a different model.

A proof instead of a promise

FlashProve uses a type of cryptographic proof called a zkSNARK. In simple terms, the provider sends a certificate with the response that proves a specific version of the model received that prompt and generated those tokens.

You do not need to download the weights or run the model again. You only verify the proof. The certificate also does not reveal the weights or the intermediate values used during inference, although it does expose the model's general architecture.

The proof is tied to a kind of digital fingerprint of the weights. If the provider committed to a specific version, a response generated by another version should not pass verification unless someone manages to break the system's cryptographic assumptions.

The goal is to let you verify the response without having the model's weights or the infrastructure needed to run it.

Results

Anthropic tested the system with Llama 4 Maverick, a Mixture-of-Experts model with 400 billion parameters. In these models, each token activates only part of the parameters, around 17 billion in this case.

Using an H100 GPU and weights quantized to 4 bits, the system generated proofs at around 110 tokens per second. Each 1,024-token request produced a proof file of approximately 19 MB.

Verification ran on a 24-core CPU and took around 17 seconds per proof. It does not require a GPU or access to the model's weights. The initial weight fingerprint takes up around 6.5 MB.

The cost is still high. Generating the proofs took between 70 and 95 times more GPU time than running the same workload with vLLM, a common inference engine. That means the system is not ready to add a complete proof to every chat response without significantly affecting speed and cost.

What it could be used for

Verification could have specific uses for companies, auditors, and regulators:

• Checking that the contracted model is being served when a company uses an intermediary to access an AI system.
• Detecting substitutions or manipulation on compromised servers.
• Proving that an evaluation used the correct model, which matters when comparing systems before and after an update.
• Verifying regulatory commitments, such as serving only approved models or proving that certain infrastructure was used for inference.
• Establishing the origin of a response, for example, when a company claims that a model reviewed code or analyzed a business plan.

This does not prove that the response is correct or that the model is safe. It only proves that the response matches the execution of the committed model for that input.

Open research, not a finished product

Anthropic published the code, the protocol, a fast verifier in C++, and another implemented in Lean, a language used to express and mathematically verify system properties. It also released formal proofs of the main guarantees: that honest proofs are accepted, that false proofs cannot be feasibly fabricated, and that the weights are not leaked.

But the team itself points to several limitations. The prototype proves an entire model version using greedy decoding, not arbitrary floating-point execution or responses generated through sampling. It also works only with windows of up to 1,024 tokens, far below the contexts of hundreds of thousands or millions of tokens offered by some current models.

It does not hide the model's architecture either, and for now it is particularly designed for Mixture-of-Experts systems. Anthropic also warns that the fast code does not yet have the same formal guarantees as the slower verifier written in Lean, and that certain side-channel attacks, such as analyzing how long it takes to generate a proof, are outside the scope of this version.

The importance of FlashProve is not that it will change the chatbot experience tomorrow. It is that it narrows the gap between running a model and being able to prove that the correct model was run. The next step will be to lower the cost, expand the context, and close the gap between the mathematical guarantees and the code used in production.