Anthropic has released FlashProve, an open-source prototype that uses cryptography to prove an AI response really came from the model a user requested, rather than one silently swapped in by a routing service or tampered with by an attacker. The company published the work on November 2, alongside code, Lean proofs and documentation under the Apache 2.0 license.
The problem is simple to state: when you query a model today, nothing in the text you get back proves which model produced it. Anthropic argues that output quality alone is not evidence, and that this gap matters for independent evaluators, clients buying access through third-party routers, and anyone worried about token streams being altered in transit.
FlashProve and zkSNARKs explained
FlashProve is built on a type of cryptographic proof called a zkSNARK, which Anthropic describes as uniquely suited to provable inference because of its hiding and efficiency properties. In practice, the model provider commits to a model and attaches a short proof to each response; the user checks that proof quickly on a CPU, and the check fails if the response did not come from the claimed model.
Crucially, the proof reveals nothing about the model's weights, which are normally kept private. Anthropic frames the work as intermediate progress rather than a finished research agenda, saying it is sharing the artifacts so others can inspect and improve them.
FlashProve performance and limits
Anthropic's headline numbers come from a 400B-parameter mixture-of-experts model, Llama 4 Maverick, run at 4-bit quantization.
The release also comes with an explicit limitations section and formal verification work, which Anthropic presents as a step toward making these guarantees trustworthy rather than merely fast. The project points to uses in security, AI regulation and verifying compliance with AI pacing requirements.
