Anthropic introduces FlashProve to cryptographically verify AI model outputs

Anthropic has released an experimental cryptographic system designed to verify the identity of AI models. Known as FlashProve, the project tackles a core integrity issue in AI services: verifying that a specific, high-capability model generated a given response rather than a cheaper or weaker substitute.

The system, detailed in a technical report published on November 2, 2026, relies on zero-knowledge proofs to deliver provable inference. Under this setup, a model generates a mathematical proof confirming that an output came from a committed set of model weights. The verification does not require the provider to disclose proprietary weights, nor does it require the recipient to rerun the model.

Anthropic Frontier Red Team researchers Roy Rinberg and Alex Allain co-authored the project alongside researchers from EPFL, StarkWare, MIT, RESI, and Succinct. The code and technical specifications are available on GitHub under an Apache 2.0 open-source license.

Zero-knowledge proofs and benchmark overhead

FlashProve operates much like a cryptographic signature for model outputs. When generating text, the system creates a zkSNARK proof tying the completion to the model architecture. In mixture-of-experts designs, the proof also hides which specific expert subnetworks were activated for each token, protecting proprietary routing choices.

In benchmark tests evaluated on Meta's 400-billion-parameter Llama 4 Maverick model, which uses roughly 17 billion active parameters per token, FlashProve proved 110 tokens per second on a single Nvidia H100 80GB GPU. Generating these proofs requires substantial resources: between 70 and 95 times the GPU compute time of standard inference via vLLM, alongside 290 GB of host RAM and 24 CPU cores on the prover side. For a 1,024-token request, the generated proof file reaches 18.78 MB.

Validating the proof on the user side requires far less hardware. An ordinary CPU without a GPU can verify a generated proof in roughly 17 seconds.

Guarding against model swapping and false audits

Third-party platforms and API providers face growing scrutiny over model identity. A cloud host could quietly route queries to a smaller model to save compute costs, or developers might falsely claim that an advanced cybersecurity frontier model audited their software repository. FlashProve provides mathematical confirmation that output matches the specified model checkpoint, even if the hosting provider cannot be trusted.

Anthropic emphasized that FlashProve verifies model identity, not output accuracy. The cryptographic proof confirms that a designated model produced the response, but it does not determine whether the factual claims inside the text are true.

Production readiness and deployment limits

Anthropic has not announced plans to integrate FlashProve into commercial Claude APIs or production services. The system remains a working prototype, constrained by proof generation costs that make real-time, large-scale inference impractical today. Whether the research community and competing labs can lower compute overhead enough to establish an industry-wide verification standard remains to be seen.