Anthropic's FlashProve: an open-source prototype that proves which AI model answered

Anthropic's Frontier Red Team has published FlashProve, an open-source research prototype that can prove a given AI response really came from a specific model. The research post, dated 2 November 2026, describes it as intermediate progress on "provable inference", with co-authors from Anthropic, EPFL, StarkWare, MIT, RESI and Succinct. The code is on GitHub under the Apache 2.0 licence.

The problem it tackles

When you call an AI model through an API, you take it on trust that the provider ran the model you asked for. Anthropic's post points out that today you can't confirm this: a router could quietly swap in a cheaper model, or someone could tamper with the output on the way back. For businesses paying for a premium model, or regulators checking that only approved models are used, that is a real gap.

How it works, in plain terms

• Commit. The provider publishes a short fingerprint of its model weights. The weights themselves stay secret.
• Prove. For each request, the provider produces a proof file showing that the committed model turns this prompt into these output tokens.
• Check. Anyone with the fingerprint, the prompt and the reply can verify the proof on an ordinary CPU, without seeing the weights.

This uses zero-knowledge proofs: cryptography that lets you show a statement is true without revealing the secret behind it. Anthropic says the aim is that a provider can commit to a model and then "prove that each response was produced by that model."

What the prototype can do today

Anthropic tested it on Meta's open-weight Llama 4 Maverick, a 400-billion-parameter model, using 4-bit weights. The reported figures:

• Proof generation runs at about 110 tokens per second on one Nvidia H100 GPU plus 24 CPU cores.
• That costs roughly 70 to 95 times the GPU time of serving the model normally, depending on load.
• Each proof for a 1,024-token request is about 19 MB, and checking it takes about 17 seconds on 24 CPU threads.
• A one-off setup step per model takes about 39 minutes.

Limits and caveats

• It is a research artefact, not a product. The GitHub README says the code is not maintained and not accepting contributions. The post does not say FlashProve is used in any Claude product.
• Short context only. It handles 1,024 tokens of context, far less than typical chat or agent workloads.
• Narrow setup. Proofs cover an exact integer version of the weights with greedy decoding (always picking the most likely next token). Normal floating-point serving or sampled output may not match the proved computation, and the system assumes a mixture-of-experts model design.
• Partial formal guarantees. Only the slower verifier written in the Lean proof language is formally verified; the fast C++ verifier is not.
• Some things are out of scope, including side-channel attacks such as timing, and hiding the model's architecture.
• Cost. A 70–95x compute overhead is far too high for everyday serving. This is a direction of travel, not something you can buy.

Who should care

Most businesses won't touch this code. But if you buy AI through resellers, routers or marketplaces, or work in a regulated sector that may one day need to show which model made a decision, it is worth knowing that verifiable "this answer came from model X" is moving from theory to working prototypes. Anthropic's post also mentions uses such as tamper detection on inference servers, text provenance and enforcing rules about approved models.

What to do this week

1. Nothing urgent. There is no product to adopt and no action required.
2. Ask your AI vendors how they guarantee the model you pay for is the one serving your requests, especially if you go through a third-party router.
3. Log model identifiers. Keep the model name and version returned by each API response in your logs today; it is the cheapest form of provenance you already have.
4. If you have a security or compliance team, share the research post so they can track the area.

The DevDrift builds AI workflows with audit trails that record which model handled each step, which is a useful habit while proofs like these mature.

Sources

• Anthropic: Progress on provable inference for large language models (2 November 2026)
• GitHub: anthropics/FlashProve