TL;DR
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
Anthropic has released FlashProve, an open-source prototype that uses cryptographic proofs to let users check whether an AI response came from a specified model. The company reports proof generation at about 110 tokens per second for a quantized 400-billion-parameter model on one H100 GPU, but says this requires roughly 70–95 times the GPU time of ordinary inference. The work is an intermediate research release, not a finished or independently validated service.
Anthropic has released FlashProve, an open-source prototype for producing cryptographic proofs that an AI response came from a specified model. The company reports that one H100 GPU can generate proofs at about 110 tokens per second for a quantized, 400-billion-parameter model, a step toward checking model identity without exposing its weights.
FlashProve uses a type of zero-knowledge proof known as a zkSNARK. A provider commits to a model and supplies a proof with its response; a verifier can check whether the response was generated by that model without receiving the model’s weights. Anthropic says the system is designed to hide weights, but not the model architecture.
The reported benchmark uses Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, with 4-bit quantized weights and integer arithmetic during prefill. Anthropic reports a proof of about 19 megabytes per 1,024-token request. It says proof generation takes around 70–95 times the GPU time required to run the model using vLLM, an open-source inference library. These are figures from the company’s report, not an independent performance assessment.
Anthropic has released a technical report, a protocol specification, executable prover and verifier code, Lean proofs of top-level mathematical statements, and an interactive theorem visualizer. The materials are offered under the Apache 2.0 license. The company describes the project as intermediate progress and says it is publishing the work for others to inspect and improve.
Checking Which Model Answered
Today, a user of a hosted model generally cannot confirm from the answer alone that the service used the model it advertised. A provider or routing service could substitute another model, or a malicious party could alter the token stream. FlashProve proposes a way to attach a verifiable record of model execution without requiring users to download private weights or rerun a costly model themselves.
If the approach becomes practical, it could help customers verify model identity when using third-party services and help independent evaluators confirm that the model they test is the one being served. Anthropic also points to possible use in demonstrating compliance with provider commitments or legal requirements. Those are potential applications, not evidence that FlashProve currently provides a deployed compliance system.
The reported compute overhead is a central constraint. Generating proofs at the reported rate requires substantially more GPU time than ordinary inference, while each request produces a proof measured in megabytes. That could add cost, latency, and data-transfer demands. The work therefore advances the technical feasibility of verification, but does not establish that proof generation is economical at large commercial scale.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Why Model Identity Is Hard to Verify
For many everyday interactions, a user may care mainly about the response rather than which exact model produced it. Model identity matters more when a customer has paid for a particular system, when an evaluator is measuring a model’s capabilities, or when a service makes commitments tied to a specified model. In those cases, a convincing answer is not proof of its origin.
Checking by rerunning inference would require access to the model and substantial computing resources. Providers usually keep frontier-model weights private, and independent users may not have the capacity to execute a large model. A cryptographic proof aims to separate verification from model access: the user checks a proof rather than reproducing the computation.
Anthropic says FlashProve builds on established design principles for cryptographic proof systems and applies techniques from cryptography and security research. It also reports using Lean formalization for top-level security statements, giving auditors a way to inspect specific mathematical claims. The company cautions that its post is an intermediate research effort rather than a completed agenda.
“The goal of provable inference is to enable a user with limited computational resources and without any information about the weights to verify that a response came from the requested model.”
— Anthropic, in its research report
Costs, Scale and Independent Review
The figures available in the report are company-reported benchmarks; the supplied material does not establish independent replication. It also does not provide enough detail to determine how proof-generation performance varies across other models, hardware configurations, request lengths, or production workloads.
It remains unclear whether the reported overhead and proof size can be reduced enough for routine, high-volume deployment. The release also does not establish how a deployed provider would bind a proof to the full serving process, including routing and any transformations of responses. FlashProve is intended to prove inference for a committed model; the report does not show that it verifies every property a user might care about, such as the quality, safety, or truthfulness of an answer.
Anthropic says the proofs hide weights, while explicitly saying that concealing model architecture is not a goal. The material provided also does not specify a deployment timeline, service availability, or a third-party audit outcome. Those questions remain open as the prototype is reviewed and developed.
Further Testing and Prototype Development
Anthropic’s immediate next step is to make the system available for inspection through its technical report, code, specification, and Lean proofs. The company says it hopes other researchers and developers will review the design and build on it. That outside scrutiny can test the reported performance and examine whether the formalized claims match the implementation.
The supplied announcement does not set a date for a production release or name a next benchmark milestone. Further progress will depend on testing the implementation beyond the reported configuration, clarifying operational costs, and improving the time and resources needed to create proofs. Until then, FlashProve is best understood as an open research prototype showing a possible route to verifiable inference, rather than a standard feature users can expect from model providers.
Key Questions
What is FlashProve?
FlashProve is an Anthropic-released prototype that uses cryptographic proofs to let a verifier check whether a response was generated by a specified AI model, without revealing the model’s weights.
How fast is proof generation in Anthropic’s report?
Anthropic reports about 110 tokens per second on one H100 GPU for 4-bit quantized Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model. The report also gives a proof size of about 19 megabytes per 1,024-token request.
Does FlashProve make inference faster?
No. The reported figure concerns generating a proof alongside inference. Anthropic says that proof generation uses roughly 70–95 times the GPU time of running the model with vLLM, so the prototype adds substantial compute overhead.
Does the proof reveal the model’s weights?
Anthropic says the proof system is designed to hide model weights. The company also states that hiding the model’s architecture is not a goal.
Is FlashProve ready for production use?
The release is described as intermediate research progress, not a finished research agenda or a production service. The available material does not give a deployment date or establish independent replication of the reported benchmarks.
Source: anthropic.com
