Anthropic open-sources FlashProve, a prototype for proving which AI model produced an output

Anthropic has published FlashProve, an open-source research prototype that makes it possible to cryptographically prove a particular language model produced a particular response. According to dev.to, summarizing Anthropic's research update on provable inference, the release includes a technical report, a protocol specification, executable code for a prover and two verifiers, and Lean formal proofs, all under the Apache 2.0 license.

The problem FlashProve targets is one of provenance. People who interact with an AI service generally have to take the provider's word for which model, and which version of that model, generated what they see. FlashProve offers a way to turn that claim into something a third party can check independently, while the provider keeps proprietary weights secret.

How it works

The system runs in two phases. First, a model provider makes a cryptographic commitment to a specific set of weights. Later, when the model responds to a request, the provider generates a proof tying the output tokens back to those committed weights.

The proof uses a zkSNARK/IOP construction, which makes it zero-knowledge: a verifier can confirm the output came from the committed model without learning anything about the weights themselves. Instead of re-running the model or gaining access to its parameters, the verifier checks a compact cryptographic artifact.

Demonstrated on a 400B-parameter model

Anthropic tested FlashProve on Llama 4 Maverick, a 400-billion-parameter Mixture-of-Experts model running with 4-bit quantization. According to the figures dev.to reports from the published benchmarks, the offline commitment step took roughly 39 minutes per model. In the online phase, the prover generated proofs for batches of 24 requests in about 223 seconds, around 110 tokens per second, with individual proofs measuring about 18.78 MB.

Verification is deliberately cheap relative to proving. A verifier can run on CPU-only hardware and check a batch of 24 tokens or requests in roughly 17 seconds on a single 24-core machine. That asymmetry, heavy work for the provider and light work for the checker, is central to the design, since it lets customers or auditors validate claims without GPUs or access to the model itself.

A prototype, not a product

Anthropic is explicit that FlashProve is not a deployed API or production feature. Proof generation remains resource-intensive, and the reported numbers come from one model, one quantization setting, and a laboratory-style setup. The research does not establish that the technique scales unchanged to high-volume production traffic or to every model architecture.

The company ties the work to a Frontier Safety Roadmap goal of prototyping verifiable inference by September 30, 2026, and notes that other approaches are being explored in parallel, including traffic-signing methods. FlashProve is therefore one candidate in an emerging design space rather than a settled standard.

Why it matters

For organizations running AI in consequential workflows, knowing which model produced an output can matter as much as the output itself. A verifiable proof could let a customer confirm that an agreed model version, rather than some cheaper substitute, handled a sensitive workflow. It could also support audit trails for model-generated decisions and reports, and provide stronger trust signals when AI output moves between companies.

The release is also notable for what it makes inspectable. Provable inference is difficult to judge from high-level claims alone; by publishing the protocol, the code, and formal artifacts, Anthropic has given researchers and developers material they can test, critique, and build on. Whether zero-knowledge proofs, traffic signing, or another technique ends up dominant, the gap between trusting an AI provider and verifying one is narrowing in a concrete and measurable way.