Anthropic releases tool to prove which AI model answered

Anthropic has released FlashProve, an open-source research prototype that uses cryptography to show which AI model produced a given response, without revealing the model's weights. The company posted the code on GitHub this week but says it has no plans to deploy the system, at Anthropic or anywhere else.techcrunch.com

The work targets a basic gap in trust. Someone calling an AI service usually cannot confirm that the model they paid for actually answered, or that a routing service didn't quietly swap in a cheaper one. In its announcement, Anthropic said the proofs could "make it harder for attackers to hijack a chat, or enable safety evaluators to verify that the model they're testing is the same one being served to customers".marktechpost.com+1

How it works

FlashProve is built on a kind of cryptographic proof called a zkSNARK and runs in two phases. In the offline phase, a model provider publishes a commitment, which is a short fingerprint tied to one exact set of weights while the weights stay hidden. In the online phase, the provider generates a proof for each reply showing that the committed model produced those exact tokens. Anyone who has the commitment, the prompt and the reply can check the proof. Because the fingerprint doesn't expose the weights, closed-model makers could use the system with commercial models.anthropic.com+1

Anthropic tested FlashProve on Meta's ↗ 2.36% Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model. A single Nvidia ↗ 2.29% H100 generated proofs at more than 100 tokens per second, and each proof was about 19 MB for a 1,024-token request. Verification runs on an ordinary CPU and takes 17 seconds with 24 threads. The protocol's soundness is formally proven in the Lean 4 proof language.github.com+2

Limits and next steps

The prototype still has clear limits. Proving takes roughly 70 to 95 times the GPU time of standard vLLM inference. Context is capped at 1,024 tokens, a single request can wait about five minutes for its batch to be proved, and the guarantees only cover greedy decoding, not sampled output. The GitHub repository, released under the Apache 2.0 license, calls itself "a research artifact: not maintained, not accepting contributions".tech.yahoo.com+3

Anthropic's Frontier Red Team built the system with outside cryptographers, including Alessandro Chiesa. The researchers describe the release as an invitation rather than a finished product. "We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it," they wrote.x.com+1