Anthropic FlashProve Proves Which Model Wrote an AI Answer, Without Revealing the Weights

How do you know the answer you got from an AI service really came from the model it says it came from? Anthropic's Frontier Red Team has published research on exactly that problem, and I think it is one of the more quietly important AI papers of the week.

The project is called FlashProve. The idea is provable inference: alongside a model's response, the server produces a cryptographic proof, a zkSNARK, showing that the output was generated by a specific model the provider committed to in advance. The proof keeps the model weights hidden, though not the architecture, so a company could prove it served the model it promised without giving that model away.

The numbers are what caught my eye. Anthropic says the team ran it on Llama 4 Maverick, a 400 billion parameter mixture-of-experts model with 4-bit weights, and proved inference on a single H100 at roughly 110 tokens per second. A 1,024-token request produces a proof of about 19 MB. It is not cheap yet, at roughly 70 to 95 times the GPU time of normal vLLM inference, but that is a long way from the impractical overhead people usually associate with this kind of cryptography. Anthropic also notes that Claude contributed improvements to the work, and the core statements were written out formally in Lean.

Why does it matter? Think of routing services that might quietly swap in a cheaper model, evaluators who need to know what they are actually testing, or a token stream that has been tampered with along the way. A proof turns trust me into check for yourself.

The team released the technical report, a specification, the prover with a C++ fast verifier and a Lean verifier, plus the Lean proofs, under Apache 2.0. Anthropic is clear this is intermediate progress and not something deployed in its products, but it is a concrete step toward AI outputs you can verify rather than simply believe.