Key points
- Anthropic's FlashProve links AI responses to a committed model
- Anthropic says FlashProve could help regulators check AI limits
- Anthropic's FlashProve is a prototype, tested on Meta's Llama
Anthropic released an open-source prototype on November 3 that's designed to prove that a given response came from a previously committed set of AI model weights. The system, called FlashProve, attaches a cryptographic proof to the output, and that proof reveals nothing about the model's private weights, the internal numbers that define how it behaves.
The problem is simple. "A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding," Anthropic's researchers wrote in their research post. A routing service could secretly substitute a cheaper model, they said, and judging from the output alone is unreliable.
Research on the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab, TechCrunch reported.
FlashProve works like a fingerprint and a receipt
A lab first publishes a commitment to its model, which Anthropic describes as a short fingerprint of one exact set of weights. The weights themselves stay hidden. When the model answers a prompt, the lab produces a proof file showing that those committed weights produced those exact words. Users would still have to trust that the commitment belongs to the model the lab names.
Anyone holding the commitment, the prompt, and the reply can check the proof without seeing the weights. Anthropic said the file is about 19 MB for a request of 1,024 tokens, the small chunks of text that models work in, and takes seconds to check on a 24-core CPU.
The method is a type of cryptographic proof known as a zkSNARK, short for zero-knowledge succinct argument of knowledge. Zero-knowledge means the proof reveals nothing beyond the fact that the computation was done correctly. Succinct means it's far quicker to check than to redo the work.
Anthropic also said Claude, its own AI model, "has produced improvements" on these proofs, and that the result is substantially faster than earlier open-source systems. The researchers added a caution. "Claude is good at optimization, but often makes decisions that are hard to evaluate, especially in large complex systems," they wrote. To counter that, they published the top-level security claims in Lean, a language for formally checking mathematical statements.
Mathematicians asked AI labs to name the model
The question of which model did the work has already come up in mathematics. On September 29, an advisory group of mathematicians hosted at the Institute for Advanced Study asked AI labs to name the model behind results that the people prompting it don't yet understand. It also asked labs to publish the prompts, a summary of the reasoning, and the computing cost. A week later, OpenAI released 722 math manuscripts that it said came from an unreleased model.
FlashProve could address the first of those requests, though Anthropic's post doesn't mention the group or math results. A lab could commit to an unreleased model and prove that a result came from the committed model, without showing the model to anyone.
It wouldn't cover the rest. The proof ties an output to a committed model, but it doesn't show whether a math proof is correct. Checking it also requires the prompt, which is one of the things the group said labs should publish, and Scientific American reported in October that OpenAI's release had no prompts.
Anthropic says it could help police AI limits
Anthropic's bigger claim is about regulation. It said such proofs "could contribute to a toolkit for verifying compliance with AI pacing requirements," meaning rules that would limit how fast labs build more powerful models.
In one example, a regulator could ask a lab for proofs covering the requests it served in a given period, to check whether those responses came from the committed model. Anthropic noted a limit there. The check "does not establish that the hardware is not, e.g., training on the side." So the proof can tie a response to a committed model, but it can't show what else the lab's hardware was doing, which is what a regulator enforcing limits on training would need to know.
The idea connects to a condition Anthropic set earlier. In a policy post titled "When AI builds itself," Anthropic staff wrote that the company would slow down if other frontier developers did so "in a verifiable manner." FlashProve's post doesn't cite that pledge.
As models improve, the researchers wrote, "a more advanced model could run in place of the one that was authorized and present itself as the weaker model" to avoid monitoring. A proof tied to specific weights would expose that swap.
FlashProve is still slow and limited
Anthropic tested FlashProve on Meta's Llama 4 Maverick, a 400-billion-parameter model with publicly available weights. The post doesn't report results on Claude. A single Nvidia H100 chip generated proofs at around 110 tokens a second.
That takes about 70 to 95 times the GPU time of running the model through vLLM, a common open-source library. Anthropic said that's much less than previously expected, but it's still a large added cost for every response.
The researchers called the release a research prototype and listed several limits. The system assumes a particular model design, known as mixture of experts, and it hides the weights but not the architecture. It also proves an integer version of the model, so a reply from a standard deployment could differ.
Anthropic had set a public goal of building a provable inference prototype by September 30, and it said it met that goal through a separate project, not FlashProve. Google Cloud and Mysten Labs are working on a related problem with an audit trail for AI agents.
The code, Lean proofs, and documentation are available under an open-source license. "This research post is meant to share intermediate progress, and not a completed research agenda," the researchers wrote.
