Anthropic's FlashProve verifies AI model identity with cryptographic proofs

Anthropic’s Frontier Red Team has released FlashProve, an open-source cryptographic system designed to verify the origin of AI-generated responses. Announced on November 4, 2026, this research prototype allows developers to confirm that a specific set of model weights produced an answer without revealing those proprietary weights. While the technology addresses critical supply chain trust issues, its high computational cost currently limits it to experimental use rather than production API traffic.

What happened

Developers relying on third-party AI APIs often lack a reliable method to ensure they are receiving responses from the model they paid for. A provider could silently route requests to a cheaper, less capable model, or an attacker could compromise the inference pipeline to alter outputs. FlashProve aims to solve this opacity by providing a mathematical guarantee of model identity. The system uses zero-knowledge succinct non-interactive arguments of knowledge, or zkSNARKs, to create a proof that a specific model generated a given output.

The project is available on GitHub as a research artifact, meaning Anthropic is not maintaining it for production use or accepting external contributions. It is not integrated into the Claude API, and there is no current timeline for such integration. Instead, it serves as a public demonstration of how cryptographic verification can be applied to large language models, offering a template for future secure AI infrastructure.

How it works

FlashProve operates by generating a cryptographic proof that links a model’s response to its underlying weights without exposing the weights themselves. This process relies on a trusted source for the initial commitment to the model weights; if the source is compromised, the proof loses its value. The system generates these proofs in batches after the inference request is complete, rather than verifying tokens in real time as they stream to the user. This batch approach helps manage the intense computational load required for proof generation.

To ensure the integrity of the protocol, Anthropic used the Lean proof assistant to formally verify the mathematical properties of the system. This formal verification confirms that the protocol accepts valid proofs, rejects forged ones with overwhelming probability, and does not leak information about the model’s weights beyond what is already present in the response. The release includes two verifiers: a formally verified version written in Lean and a faster C++ implementation. While the C++ verifier passed comparison tests against the Lean version, it lacks the same rigorous mathematical guarantees, as does the GPU prover used for generation.

Key details

• FlashProve was tested on Meta’s Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, not on Claude.
• Proof generation processes approximately 110 prompt tokens per second on a single Nvidia H100 GPU.
• Each generated proof is roughly 18.78 MB in size and takes about 21 seconds to verify on a single CPU thread.
• Generating proofs requires 70 to 95 times more GPU time than standard inference using vLLM.
• The system is currently limited to 1,024 tokens of context and uses integer-based inference with greedy decoding.
• Previous systems like VerInf required 14.3 hours to generate a 93.6 GB proof for 1,000 tokens, making FlashProve significantly faster.

Why it matters

For software engineers and technical leads, FlashProve highlights the growing importance of inference integrity in AI supply chains. As organizations integrate more third-party models into their products, the risk of model substitution or manipulation increases. Cryptographic verification offers a path to auditability, ensuring that critical decisions made by AI systems can be traced back to a verified source. This is particularly relevant for regulated industries where proving the origin of an automated decision is a compliance requirement.

However, the current performance overhead makes immediate adoption impractical for most applications. The 70 to 95-fold increase in GPU compute time represents a prohibitive cost for high-volume API services. Developers must weigh the security benefits of verification against the economic reality of inference costs. FlashProve demonstrates that while the technology is maturing, it remains too expensive for routine use, signaling that further optimization is needed before cryptographic proofs become a standard feature in AI APIs.

What you can do

• Download the FlashProve code from GitHub to experiment with cryptographic verification in a controlled environment.
• Use the Lean verifier if your application requires formally verified security guarantees, despite its slower performance.
• Consider the C++ verifier for faster testing, but acknowledge it lacks the same level of mathematical proof as the Lean version.
• Evaluate whether your use case can tolerate batched verification rather than real-time token-by-token checks.
• Monitor developments in zkSNARK efficiency, as reductions in proof generation cost will determine when this technology becomes viable for production.
• Assess your current AI supply chain risks to determine if model substitution is a credible threat to your business logic.