Anthropic Open-Sources FlashProve, a Crypto Proof System That Shows an AI Answer Really Came From the Model You Paid For

Anthropic has published new research on what it calls provable inference and open-sourced the system behind it, FlashProve, under the Apache 2.0 license. The premise is simple and slightly uncomfortable: when you call a model through an API, you have no cryptographic way to confirm the response actually came from the model you paid for. FlashProve is designed to close that gap with zero-knowledge proofs, without exposing a single line of model weights.

The failure modes Anthropic enumerates in its blog post are not hypothetical. A provider under margin pressure can quietly substitute a cheaper model for a premium one. A third-party router can swap the upstream model mid-flight. An inference server can be compromised and return tampered tokens. A safety evaluator cannot confirm the model it is testing is the model actually deployed. And in the scenario Anthropic flags as most concerning, a more capable model could impersonate an approved, weaker one to slip past the oversight attached to it.

The system works in three steps. First comes an offline commitment: before a model ships, its weights are turned into a unique cryptographic fingerprint on a single H100 in about 39 minutes, and that fingerprint is published. It binds to the exact parameters - change one weight and it no longer matches - while revealing nothing about the weights themselves. Then, at serving time, the provider's GPU generates a proof of roughly 19 MB alongside every 1,024-token block of output. Finally, anyone can run the verifier on an ordinary CPU and get a true-or-false verdict in about 17 seconds. No weights, no GPU, no trusted third party.

The published benchmarks come from Anthropic's own testing and have not been independently verified. FlashProve was evaluated on a 400-billion-parameter Mixture-of-Experts model with public 4-bit weights and a 1,024-token context window, producing proofs for about 110 tokens per second on one H100 at batch size 24. The overhead is substantial - roughly 70 to 95 times the GPU time of plain vLLM inference - which is the price of turning every response into a mathematical receipt.

The open-source release covers the proof generator, C++ and Lean verifiers, technical documentation and formal proofs. According to the team, the overwhelming majority of the codebase was written by Claude itself: about 95.2 percent of the repository, nearly 400 MB, is Lean 4 proof code, with C++, Python and CUDA accounting for under 4 percent combined.

Anthropic is careful to frame this as a research prototype with no commercial deployment plans, and the limitations it lists are real. The tested context window is only 1,024 tokens. The construction does not hide the model architecture. The fast-path implementation is not yet fully matched line-by-line to the formal specification.

Still, the direction matters. Model swapping is the quiet embarrassment of the API relay market, and as agents take on regulated work, "which model actually answered" becomes a compliance question, not just a quality one. If the overhead keeps shrinking, cryptographic receipts for AI output could become as routine as TLS certificates are for web traffic - and the providers who volunteer them first will have an argument to make that their competitors cannot forge.