Anthropic open-sources FlashProve, a prototype that proves which model produced a response

On Nov. 2, Anthropic’s Frontier Red Team released an open-source prototype called FlashProve. The system aims to let anyone verify cryptographically that a response really came from the stated model. Today a user cannot tell from the output alone whether a cheaper model was substituted or the token stream was tampered with. FlashProve uses a zkSNARK, a zero-knowledge proof: the provider publishes a short commitment to the weights, then proves that each response came from those weights. The proof leaks nothing about the weights, though hiding the architecture was not a goal.

The measurements were made on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with about 17 billion parameters active per token, using its public 4-bit weights. On a single H100, proofs are generated at about 110 tokens per second, at roughly 19 MB per 1,024-token request. That works out to about 70 to 95 times the GPU time of running the same model on vLLM. Verification is cheap: the client downloads a commitment of about 6.5 MB, and checking a proof takes 17 seconds on 24 threads, with no GPU needed. The repository went up on Oct. 30 under Apache 2.0, and its description says it is not maintained. The post is explicit about limits: the proof covers a model using integer arithmetic and greedy decoding, the system assumes a mixture-of-experts architecture, side-channel attacks are out of scope, and the context is capped at 1,024 tokens for now. According to TechCrunch, there are no plans to deploy the system at Anthropic or any other lab.

Anthropic@AnthropicAI

New Anthropic research: progress on provable inference for large language models.

Here, we introduce FlashProve. Building on established cryptographic techniques, FlashProve allows developers to verify whether a given response came from a given AI model. It’s substantially more efficient than prior open-source methods for doing so.

These proofs have a range of applications. They can, for instance, make it harder for attackers to hijack a chat, or enable safety evaluators to verify that the model they’re testing is the same one being served to customers.

For our full write-up, see here: anthropic.com/research/provable-inference

Further progress in provable inference will likely be an important part of improving trust in AI deployment. To that end, we're open-sourcing FlashProve’s code, here: github.com/anthropics/FlashProve

We’re grateful to our collaborators: Alessandro Chiesa, @GiacomoFenzi, @gwberg95, @miranda__christ, Rahul Dalal (rdalal.github.io) and Ben Mayer (@transmissions11).

Separately, the Nov. 3 entry in the Claude Platform release notes says text generated by Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 now carries Anthropic’s text watermark. On Sonnet 4.6, output may not carry it when temperature, top_p or top_k is set to a non-default value. Anthropic signed the Code of Practice tied to Article 50(2) of the EU AI Act; the watermark detector remains in private preview, open only to eligible organizations such as regulators, law enforcement, media, fact-checkers and researchers.