The system is intended to make those substitutions detectable through cryptographic evidence rather than relying on the quality or apparent characteristics of a model's responses.
FlashProve works by having an AI provider publish a cryptographic commitment, effectively a unique fingerprint tied to a model's exact weights. When the model processes a request, the provider can generate a proof linking the resulting output to those committed weights. Anyone with the original request, response, and published commitment can then check whether the output matches the specified model.
Importantly, this verification does not require access to the model's underlying weights or the computing infrastructure used to run it. That distinction makes the approach potentially applicable to proprietary AI systems, including those developed by companies that do not publicly release their model parameters.
The underlying technology uses zero-knowledge cryptographic proofs known as zkSNARKs. These allow a provider to demonstrate that a computation was performed correctly while withholding sensitive information about how the model operates internally. FlashProve protects model weights, although concealing the model's architecture is not among its current objectives.
Anthropic says the system could be useful for organizations that need to verify claims about AI-assisted work. A software developer, for example, could provide evidence that a particular cybersecurity model examined its code, while an organization could substantiate claims that a specified AI model reviewed a business document. The same mechanism could help independent researchers verify which models they are evaluating.
The company also identifies potential applications in AI security and regulatory oversight. Organizations could use cryptographic proofs to detect unauthorized model substitutions on compromised servers, while auditors could verify that providers are operating approved models without obtaining confidential model information.
Anthropic's initial performance results suggest that this type of verification is becoming more practical, although generating proofs remains computationally expensive. In testing with Meta's Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, FlashProve generated proofs at approximately 110 tokens per second using a single Nvidia H100 GPU.
Each proof was approximately 19 MB, and verification took 17 seconds on a CPU using 24 threads, or 21 seconds on a single thread. Anthropic reported that proof generation required roughly 70 to 95 times the GPU processing time of ordinary inference using vLLM, an open-source model-serving framework.
Despite that overhead, the researchers say FlashProve substantially improves on earlier publicly available systems, some of which required far more time and computing resources to verify large language models. The ability to check proofs without specialized GPU hardware is a central part of the design.
Anthropic also used its Claude AI model to help develop and optimize the cryptographic system. Because complex AI-generated code can introduce difficult-to-detect errors, the researchers incorporated formal verification using Lean, a mathematical proof assistant. The release includes machine-checkable statements covering key security properties, alongside executable verification tools written in C++ and Lean.
The researchers acknowledge that the formal guarantees do not automatically extend to every component of the faster executable implementation. The system also currently supports inference contexts of up to 1,024 tokens and operates under specific computational assumptions, including integer arithmetic and deterministic token selection. Those restrictions limit how directly the prototype can be applied to existing commercial AI services.
Anthropic has published FlashProve under the Apache 2.0 open-source license, making its code and supporting materials available for external examination and development. The company describes the release as an intermediate research milestone rather than a finished verification product, with no announced plans to integrate it into Anthropic's services or deploy it at another AI laboratory.
The research demonstrates a possible way to independently authenticate AI outputs while preserving the confidentiality of commercial models. For now, FlashProve remains an experimental system whose performance improvements and security guarantees will require further development before it can support broader real-world use.
This analysis is based on reporting from Anthropic & TechCrunch.
Image courtesy of Anthropic.
This article was generated with AI assistance and reviewed for accuracy and quality.
