Anthropic releases open-source FlashProve prototype to verify which AI model produced an output

Anthropic published a research post on Nov. 2 releasing FlashProve, an open-source prototype that lets users verify cryptographically that an output came from a specific AI model.2

Anthropic said a user cannot today check that a response came from the model a developer claims, as opposed to one secretly substituted by a routing service for cost reasons or by an attacker who tampered with the token stream.2 FlashProve uses a cryptographic proof called a zkSNARK, in which the provider commits to a model and then proves each response was produced by it, according to Anthropic.2

TechCrunch reported that the system requires AI labs to publish a "fingerprint" of each model they release, and that the fingerprints do not reveal a model's weights.1

Anthropic said that for Llama 4 Maverick, a 400B-parameter mixture-of-experts model in 4-bit quantization, a single H100 GPU generates proofs at around 110 tokens/second, with a proof size of ~19 MB per 1,024-token request.2

Anthropic said the proofs take ~70-95x the GPU time that vLLM, a common open-source library, takes to process prompts of the same length.2

Anthropic said it released five artifacts: a blog post, a technical report, a protocol specification document, executable code with a prover and two verifiers (a fast C++ verifier and a provably correct Lean verifier), and Lean proofs for the top-level mathematical statements; it said it released its code, Lean proofs and documentation under the Apache 2.0 license.2