Anthropic's FlashProve uses zero-knowledge proofs to keep AI APIs honest

When you pay for a premium model API, how do you know the provider actually ran that model and didn't secretly downgrade your prompt to an 8B toy to pad their margins? Until now, you basically had to take their word for it.

Anthropic just open-sourced FlashProve, a provable inference system built on zero-knowledge proofs (ZKP). It allows an AI provider to generate a cryptographic proof alongside a response, proving mathematically that the output came from the exact model weights promised.

A cryptographic receipt for AI responses

What makes FlashProve clever is how lightweight it is for the person asking the question.

You do not need model weights, which means companies can keep their proprietary models secret. You also do not need an expensive GPU cluster to double-check their work. A standard laptop CPU can run the verification in seconds.

Anthropic benchmarked the system using Meta's Llama 4 Maverick, an MoE model with roughly 400B total parameters and about 17B active parameters per token.

On a single Nvidia H100, FlashProve generated proofs at around 110 tokens per second. For a typical 1024-token prompt, the resulting proof weighs about 19MB, and a consumer CPU verifies it in roughly a dozen seconds.

Anthropic developed the system alongside researchers including Alessandro Chiesa and Giacomo Fenzi, and has made the proof generator, verifier, and formal verification code completely open source.

The math works, but the GPU bill hurts

While FlashProve is substantially faster than prior attempts at verifiable inference, you probably will not see it turned on for your daily chatbot banter anytime soon.

The real catch is server-side compute. Generating the proof consumes about 72 to 94 times more GPU time than running standard inference alone. Generating an answer takes a second, but proving you did not cheat takes over a minute of H100 crunching.

Still, proving that an MoE model of this scale can be cryptographically verified is a massive technical milestone. Anthropic notes it can also stop chat hijacking attacks and let safety evaluators ensure the model they audited is genuinely the one served to the public.

Why it matters

We think Anthropic is smart to tackle the black-box problem with math rather than corporate promises. Shifting AI trust from vendor reputation to cryptographic proof changes the rules of the game.

Right now, paying a 70x to 90x compute premium makes zero sense for casual developers. But for high-stakes workloads—such as automated medical triage, financial compliance, legal analysis, or safety auditing—having verifiable proof that a response came from an approved model is worth every penny.

For the broader cloud industry, FlashProve puts providers on notice. Silent model degradation, aggressive quantization, and stealthy routing to cheaper fallback models have long been open secrets in AI infrastructure. If verifiable inference becomes an enterprise standard, that wiggle room vanishes.

The hardware penalty is steep today, but ZKP acceleration tends to move quickly. By open-sourcing the entire stack, Anthropic is inviting the community and hardware designers to chip away at that 70x overhead. Once that cost drops, black-box APIs will start looking very hard to trust.