Anthropic's new prototype proves which model wrote an AI response without exposing its weights

Skip to content

Nov 4, 2026

Anthropic

Anthropic has released FlashProve, a research prototype that uses cryptography to verify whether an AI response actually came from the claimed model. The system still has significant limitations.

Anyone sending a query to an AI model today has no way to verify that the chosen model actually generated the response. A routing service could quietly swap in a cheaper model to cut costs. An attacker could tamper with the data stream. Anthropic says its new open-source research prototype FlashProve is designed to tackle this problem.

FlashProve uses a cryptographic technique called zkSNARK. In simple terms, the model provider first creates a digital fingerprint of the model's weights. With every response, the provider then delivers a compact proof showing that this specific model generated the output. The proof reveals nothing about the secret model weights themselves.

Proof generation is fast enough to be practical

According to the technical report, FlashProve generates proofs at roughly 110 tokens per second on a single H100 GPU for Meta's Llama 4 Maverick, a 400-billion-parameter model. Each proof is about 19 megabytes and can be verified in 17 seconds on a standard CPU. That adds overhead of roughly 70x to 95x compared to normal inference.

That sounds like a lot, but it is a significant jump from earlier systems. The only comparable open-source system previously available took over 14 hours to process 1,000 tokens, Anthropic says. It produced a 93.6-gigabyte proof that took nearly a full day to verify.

Regulators could verify which models providers actually run

Anthropic sees several use cases. Regulators could check whether a provider is actually running only approved models, companies could prove their code was reviewed by a specific safety model and providers could detect tampering on their servers, like an attacker or a more advanced model slipping in unnoticed.

Context window and sampling limits hold it back

Subscribe now