Anthropic has released an open source tool called FlashProve that lets anyone mathematically verify an AI response really came from the exact model it claims to, without the lab ever revealing that model’s private weights. The system tackles a problem nobody outside the AI labs can currently check: a provider could quietly swap in a cheaper model to cut costs, or route your request through a weaker system while billing you for a stronger one, and you would have no way to know. Anthropic is calling this a research prototype, not a finished product, and there are no plans yet to put it into production anywhere.
Here’s the trust gap FlashProve is trying to close. When you send a prompt to an API and get back an answer, you are taking the provider’s word for which model actually generated it. Judging quality from the output alone does not work, because a cheaper model can sometimes produce a response that looks fine on the surface. Anthropic’s own researchers put it plainly in the announcement: judging a model by its output alone is unreliable even when the output looks high quality. That gap matters more every month as companies route traffic through resellers, aggregators and internal load balancers that have every incentive to substitute a cheaper model when nobody is checking.
The mechanism behind FlashProve is a type of cryptography called a zkSNARK, short for zero-knowledge succinct argument of knowledge. In plain terms, it lets one party prove to another that a specific computation happened correctly, without showing any of the private information that went into it. Anthropic splits the process into two phases. First, a model provider publishes a short “commitment” to its model weights once, a kind of fingerprint that locks in exactly which version of the model it is without exposing the weights themselves. From there, every time the model answers a prompt, the provider can generate a proof file showing that the committed model, and only that model, produced those exact output tokens. Anyone with the commitment, the prompt and the reply can check the proof on an ordinary computer, no access to the model’s internals required.
The numbers behind that pitch come from testing on Llama 4 Maverick, a 400 billion parameter mixture-of-experts model that uses roughly 17 billion of those parameters per response. Generating the one-time model commitment took about 39 minutes on a single Nvidia H100 GPU and stays valid for roughly 16 million requests before it needs refreshing. Proving a batch of 24 requests took around 223 seconds, which works out to about 110 tokens per second, with each proof file running about 19 megabytes. Checking a proof on the other end took 17 to 21 seconds on an ordinary CPU. The tradeoff is real: proving responses this way runs 70 to 95 times slower than normal inference compared to standard serving setups, which is exactly why Anthropic is framing this as early research rather than something ready to bolt onto a production API today.
Anthropic lists three use cases it has in mind. The most direct is catching a provider who secretly substitutes a cheaper model to save money, or inflates results by quietly running a pricier one during a benchmark. The second is spotting tampering, like an attacker who compromises an inference server and starts serving manipulated responses, or a more capable model impersonating the weaker one it is supposed to be. The third is letting outside parties verify claims about what a specific model actually did, such as a developer saying their code was scanned for vulnerabilities by a frontier security model, or a company claiming its business plan got sign-off from an approved AI system. Right now, none of those claims can be independently checked. FlashProve is Anthropic’s attempt at a receipt.
The project traces back to a specific commitment Anthropic made in its Frontier Safety Roadmap: build a prototype for provable inference by September 30, 2026. Anthropic says it technically hit that deadline through a separate, narrower signing system that re-runs inference on a trusted server, and used the extra months since to build something broader. It also quietly renamed the underlying goal from “provable inference” to “inference verification” in an October update, saying the original term implied a narrower approach than it actually intends to pursue. That is the kind of safety-roadmap bookkeeping that tends to get buried in a footnote, but it is a useful reminder that Anthropic treats these public commitments as deadlines it has to account for, something that stood out again when it warned in its own IPO filing that it is getting close to self-improving AI capability.
The release itself is generous by research-prototype standards: a technical paper, a prover, a fast C++ verifier, a slower but formally verified version built in the proof language Lean, and a visualizer for the underlying mathematical claims, all under the Apache 2.0 license on GitHub. Anthropic is upfront about what it does not do yet. The system only covers mixture-of-experts models and works against an integer version of the weights running greedy decoding, so floating-point math or randomized sampling could, in theory, produce results the proof does not match. It makes no attempt to hide which model architecture is being used, and it is not built to resist side-channel attacks like timing analysis. The context window for a provable request also caps out at 1,024 tokens for now. Anthropic frames all of this as a deliberate first step, inviting other researchers to pick the project up and extend it rather than presenting it as something customers should expect to see in a product menu soon.
It is a telling moment for Anthropic to be publishing infrastructure like this. The company is heading toward an IPO while trying to convince regulators, enterprise customers and the public that it takes AI safety claims seriously, and a tool that lets outsiders verify what a model actually did is squarely in that lane. It also is not just about Anthropic policing itself. The same system, in theory, could let a customer verify what OpenAI, Google or any other closed-model provider actually served them, assuming those labs ever adopt it.
The bottom line
FlashProve solves a real problem that almost nobody talks about: once a model is behind an API, you are trusting a company’s word for what actually generated your answer. That is genuinely useful infrastructure, and open-sourcing it under a permissive license is the right call if Anthropic wants other labs to actually adopt the idea instead of just admiring it. But a system that runs 70 to 95 times slower than normal inference and tops out at 1,024 tokens is not close to something a paying API customer will notice this year. The more interesting question is whether competing labs, the ones with the most to gain from quietly cutting costs on a cheaper model, have any actual incentive to adopt a tool built specifically to catch them doing that.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
