AI users currently have no direct way to confirm that the model they selected generated a response. A service could route a request to a cheaper model, or an attacker could tamper with the data stream. Anthropic says its research prototype, FlashProve, is intended to help address that trust gap.
The system uses a cryptographic technique known as zkSNARK. A provider creates a digital fingerprint of a model’s weights, then supplies a compact proof with each response that the output came from that model. The proof does not disclose the weights themselves.
Anthropic’s technical report says FlashProve can generate proofs at about 110 tokens per second on one H100 GPU when used with Meta’s 400-billion-parameter Llama 4 Maverick. Each proof is approximately 19 megabytes and takes 17 seconds to verify on a standard CPU. The process adds roughly 70 to 95 times the overhead of ordinary inference.
That is still a substantial improvement over the only comparable open-source system cited by Anthropic, which took more than 14 hours to process 1,000 tokens. Its proof was 93.6 gigabytes and took almost a day to verify.
Potential applications include allowing regulators to check whether providers run only approved models, helping companies demonstrate that code was reviewed by a particular safety model, and detecting tampering on a provider’s servers.
Anthropic had set a September 2026 target in its Frontier Safety Roadmap for an inference-verification prototype. The company says it met that goal separately with a system that signs inference traffic and traces computation on a trusted server. FlashProve pursues the same objective through cryptography alone, without requiring trusted hardware.
The company cautions that FlashProve remains experimental. It can currently prove contexts of up to 1,024 tokens, does not conceal a model’s architecture, and works only when the model selects the single most likely next token. That excludes the randomized outputs commonly used by chatbots.
FlashProve’s code, Lean proofs and documentation are available on GitHub under the Apache 2.0 license.
Sources: The Decoder.