FlashProve: Anthropic’s cryptographic check on which AI model actually answered you

When you call a model through an API or a reseller, you trust that the model you asked for is the one that answered. A provider could quietly substitute something cheaper, and output quality alone is an unreliable way to tell. TechCrunch reports that Anthropic is publishing an open-source research prototype, FlashProve, to make that verifiable. It produces a cryptographic proof that a given output came from a specific, committed set of model weights without exposing them. The design is meant to hold even when the party trying to cheat is the lab running the model.

The practical cases are easy to list. Developers routing calls through third parties cannot verify what they are paying for. Companies make claims, for example that a library was scanned by a frontier security model, that nobody can check. Regulators who want rules about which models may be served have no technical way to confirm compliance. A proof that verifies on an ordinary CPU, as MarkTechPost reports, could plug into all of these.

FlashProve comes from Anthropic’s Frontier Red Team and uses a zkSNARK, a form of zero-knowledge proof. A lab publishes a fingerprint, or commitment, of a model’s weights; each response can then be proven to come from that committed model. Anthropic released a specification and code under an open-source license and formalized the protocol’s security properties in the Lean proof assistant. The reported benchmarks used Meta’s public Llama 4 Maverick weights, not an Anthropic model.

MarkTechPost, working from the repository’s performance guide, reports that proving takes roughly 70 to 95 times the GPU time of plain inference. Context is capped at 1,024 tokens, and support is limited for now to greedy decoding and mixture-of-experts models. Proofs are about 18.78 MB and take about 17 seconds to verify. That is a large leap over earlier open zero-knowledge machine-learning systems, and still far too expensive to wrap around everyday chat traffic.

So the near-term role is spot checks and high-stakes claims, not every reply. That is enough to matter. Auditing doesn’t have to be universal to change behavior; it has to be possible. If any response might be challenged, quietly swapping models becomes risky.

Most AI accountability tools ask users to take a company’s word. This one is built so you don’t have to, including about Anthropic. That stands out at a time when labs are asking for public trust while disclosing serious problems of their own, from rogue agents in evaluations (Anthropic’s week in hot water over cybersecurity) to cutting internal evals off from the live internet (our coverage).

There is a flip side. The same machinery that lets users check providers could let regulators confirm which hardware serves which approved models, a use case MarkTechPost lists among Anthropic’s stated goals. That can be good governance or a licensing chokepoint. Publishing openly and inviting improvement is the right way to begin that debate. More in our Anthropic coverage and research coverage.