Anthropic's FlashProve gives AI outputs a cryptographic receipt

When you meet someone in the real world, you can hear their voice, look at their face, and shake hands to know they are who they say they are.

When querying an AI model over an API, you have almost none of that. You cannot actually prove whether a response came from the frontier model you paid for, or if a routing proxy secretly swapped in a cheaper alternative to save money.

Anthropic just released FlashProve, an open-source research prototype designed to give AI inferences a tamper-proof cryptographic receipt.

The system uses zkSNARKs (zero-knowledge succinct arguments of knowledge). In simple terms, a model provider publishes a cryptographic commitment to a specific set of weights, then generates a small proof alongside each generated response.

Anyone can check that proof on a regular laptop CPU in seconds without needing specialized hardware, and without the provider ever having to expose its proprietary model weights.

Proving compute without leaking the secret sauce

Verifying large language models has long been seen as practically impossible because frontier weights are proprietary trade secrets, and rerunning a massive model just to audit it is cost-prohibitive.

FlashProve tackles this by keeping weights completely hidden behind zero-knowledge masking, even though the broader neural architecture remains public.

To show it works on real-world sizes, the team tested FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model.

Running on a single NVIDIA H100 GPU with 4-bit quantization and a 1,024-token context window, FlashProve generated proofs at roughly 110 tokens per second, producing a proof file of around 19 MB per request.

That level of cryptographic certainty does not come free. Generating the proof takes about 70 to 95 times the GPU time of running native inference on vLLM.

Still, Anthropic notes this is orders of magnitude faster than previous open-source attempts.

To ensure the implementation is watertight, Anthropic collaborated with researchers from EPFL and MIT to formally verify the protocol's mathematical soundness in Lean 4, driving the probability of an undetected counterfeit down to near zero.

From API fraud to rogue agent sandbagging

Preventing cost-cutting API proxies from bait-and-switching models is only the most obvious use case.

The system also addresses deeper safety dilemmas. Independent evaluators auditing an AI system before launch need absolute assurance that the model they are testing matches what gets deployed to production.

Then there is the threat of compromised infrastructure. An attacker who hijacks an inference server to inject malware into output streams can no longer hide behind normal traffic, because every modified response invalidates the proof.

It even safeguards against future rogue models. A highly capable autonomous agent attempting to sandbag—pretending to be an earlier, less dangerous model to dodge monitoring—would be caught immediately when its generated tokens fail to match the claimed weights.

Regulators could also use these certificates to audit whether computing clusters are actually serving inference rather than covertly training next-generation models.

Why it matters

FlashProve is explicitly marked as an unmaintained research artifact on GitHub, but we think it represents a major conceptual milestone for AI accountability.

Nobody is going to pay a 70x compute penalty for casual chat queries. However, in enterprise environments involving automated code auditing, regulated compliance checks, or legal risk analysis, cryptographic provenance could quickly shift from a luxury to a hard requirement.

For the AI infrastructure sector, verifiable inference threatens the business model of opaque API brokers and unauthorized distillers who quietly pocket the margin between expensive frontier calls and cut-rate local models.

We also find the development process fascinating. Anthropic revealed that Claude itself generated significant parts of the system's optimizations and protocol specs, which pushed the researchers to use Lean 4 formal proofs to double-check the AI's complex design decisions.

AI writing cryptographic code verified by formal logic feels like a preview of how high-assurance software will be built going forward.

Even with a 70-to-95x overhead, FlashProve proves that cryptographic trust and proprietary weights are no longer mutually exclusive.