Anthropic open-sources proofs that identify which AI model answered

Anthropic has open-sourced FlashProve, a research system that lets an AI provider prove that a response came from a specific set of model weights without revealing those weights.

The system uses zkSNARKs. A provider first publishes a cryptographic commitment to its model, then generates a proof for each response. A customer, evaluator or regulator can verify that proof on a CPU. This could expose silent model substitutions by API routers, tampering on inference servers or a mismatch between the model tested by evaluators and the one served to users.

On a 4-bit Llama 4 Maverick, Anthropic reports that one H100 generates proofs at roughly 110 tokens per second. Each proof is about 19 MB for a 1,024-token request and takes around 17 seconds to verify on a 24-core CPU. The proving process still consumes roughly 70–95 times the GPU time of ordinary vLLM inference.

FlashProve is a prototype, not a production service. It currently supports short contexts, greedy decoding, integer arithmetic and mixture-of-experts models. Side channels are outside its scope. Anthropic released the code, two verifiers, protocol documentation and Lean proofs under Apache 2.0.

The work makes model identity something that can be checked cryptographically rather than inferred from output style.