Anthropic has released FlashProve, an open-source system that lets a user check, with a cryptographic proof, that an AI reply really came from the model that was supposed to produce it. The company published the code and a technical write-up on 3 November and calls it a research prototype, not a product.
The problem it targets is simple to state: when you use a chatbot through an app or a routing service, you cannot tell whether a cheaper model was quietly swapped in, or whether someone tampered with the answer on its way to you. A provider would commit to one exact set of model weights, and each reply would come with a proof that those weights produced it, without revealing the weights.
In Anthropic’s research post, the team says Claude helped build the proving system and that the security claims are backed by formal proofs written in the Lean language. The code, a fast C++ verifier, a slower Lean verifier and the proofs are released under the Apache 2.0 licence.
On speed, Anthropic says a single H100 can prove about 110 tokens every second for Llama 4 Maverick, which has 400 billion parameters. Every 1,024-token request gets a proof of roughly 19 MB, and a 24-thread CPU needs around 17 seconds to verify it. Older open-source attempts, the post says, were far slower; one needed about 14 hours to handle 1,000 tokens of this model.
The price is compute. Generating proofs eats 70 to 95 times the GPU time of simply running the requests through vLLM. Setting up the commitment to a model takes about 39 minutes, and one commitment covers around 16 million requests before a new one is needed.
The limits are listed openly. It works only on mixture-of-experts models, covers contexts of up to 1,024 tokens, and proves a whole-number version of the model under greedy decoding, so replies from a floating-point setup or from sampled decoding may not match exactly. Timing side channels that could leak information about the weights are out of scope for this release.
Anthropic ties the work to its earlier goal of a provable-inference prototype by 30 September, which it says it met through a separate project that signs its own inference traffic. It also sees uses beyond trust in chatbots: auditors checking which model was tested, and regulators confirming that only approved models are being served.
There are no plans to deploy FlashProve at Anthropic or any other lab, according to TechCrunch, and Anthropic describes the post as intermediate progress that it hopes others will take and improve.
