Editorial illustration for Anthropic Releases FlashProve: GPU Proves Reply Came From Committed Weights
Anthropic's FlashProve Proves AI Responses Are Authentic
Anthropic Releases FlashProve: GPU Proves Reply Came From Committed Weights
Anthropic's Frontier Red Team put out FlashProve this week, an open-source system that answers a question most API users never think to ask: did the model I paid for actually generate this response. The tool is a zkSNARK, a cryptographic proof that a given reply came from a specific set of committed weights, without exposing anything about those weights. Anthropic tested it on Llama 4 Maverick, a 400 billion parameter mixture-of-experts model with about 17 billion active parameters per token, and got it proving at roughly 110 tokens per second on a single H100 GPU.
The gap FlashProve targets is a plain one. When a developer calls an API, there's no way to confirm which model actually handled the request. A provider could quietly route a query to a cheaper model and pocket the difference.
A compromised server could tamper with tokens mid-stream. Checking output quality by eye doesn't catch either case. Anthropic frames this as useful for regulators who want proof that approved hardware or approved models are actually running, for labs trying to catch tampered servers, and for anyone who wants to verify where a piece of text came from.
The mechanics of how the proof gets built start with a prover.
Why this matters
For anyone building on third-party inference APIs, this is the first real answer to a question we've had no way to check: did you actually get Llama 4 Maverick, or some cheaper swap-in the provider didn't disclose? A proof that reveals nothing about the weights themselves is the right design, since it means model providers don't have to choose between protecting IP and letting customers verify. The 110 tokens/second figure on a single H100 matters more than the cryptography itself: it tells us this is close to usable for real traffic, not just a lab curiosity.
Borrowing the same proof family that powers Starknet and other validity-proof rollups is a sensible bet, since that machinery has already survived adversarial scrutiny in finance. We'd want to see independent verification of those throughput numbers before anyone builds billing or compliance tooling on top of FlashProve. Still, as inference gets routed through more intermediaries, brokers, resellers, quantized mirrors, the ability to cryptographically confirm which model actually ran is the kind of infrastructure that stops being optional.
Related Reading
Browse all Anthropic news →
Open Source D&B rebuilds 642 million‑business database after AI agents hit limits
Open Source Box CEO Aaron Levie Says AI Will Drive "Biggest Cybersecurity Upgrade
Open Source Study: 6.7% of Deepfake Requests on Hugging Face Targeted Children
Related Topic Claude gains shared context in Excel, PowerPoint; Microsoft adds Copilot Cowork
AI Tools & Apps
Related Topic Anthropic: Hackers Stole Claude Tokens Via Compromised Session Key
LLMs & Generative AI
From Archives Soniox STT v6 adds text input, echo filtering; no v6 accuracy or latency
From Archives Track AI cost per active developer and merged pull request, not tokens
From Archives Anthropic FlashProve system aims to verify AI model identities
Research & Benchmarks
From Archives Anthropic's Message Threads cut AI response time by 35% for long chats
LLMs & Generative AI
Common Questions Answered
What is FlashProve and how does it verify model responses?
FlashProve is an open-source zkSNARK system developed by Anthropic's Frontier Red Team that cryptographically proves a given reply came from a specific set of committed model weights. The tool allows API users to verify they received a response from the actual model they paid for, without exposing any information about the model's weights or internal architecture.
How does FlashProve protect model intellectual property while enabling verification?
FlashProve uses a zkSNARK (zero-knowledge succinct non-interactive argument of knowledge) design that proves a response originated from committed weights while revealing nothing about those weights themselves. This approach allows model providers to let customers verify authenticity without having to choose between protecting their proprietary IP and providing transparency.
What is the performance of FlashProve on Llama 4 Maverick?
FlashProve achieves approximately 110 tokens per second on a single H100 GPU when tested on Llama 4 Maverick, a 400 billion parameter mixture-of-experts model with about 17 billion active parameters per token. This performance metric demonstrates the practical feasibility of generating cryptographic proofs for large-scale language models.
Why is FlashProve important for third-party inference API users?
FlashProve solves a critical verification problem for API users who have had no way to confirm they actually received responses from the specific model they paid for, rather than a cheaper alternative the provider may have substituted without disclosure. This tool provides the first practical mechanism to cryptographically verify model authenticity in production inference scenarios.
