Anthropic's FlashProve lets users check which model answered

Anthropic's Frontier Red Team has released FlashProve, an open-source prototype that lets a user confirm a response actually came from the model a provider claims to be running, without seeing the weights and without running the model themselves. The provider attaches a cryptographic proof, a zkSNARK, to each batch of responses. The proof is sound, so a provider cannot forge one, and zero-knowledge, so it reveals nothing about the weights, though it does expose the model's architecture.

The interesting part is that this is starting to look practical. On Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, a one-time setup takes about 39 minutes on a single H100 and covers roughly 16 million later requests. Proving a batch of 24 requests runs at about 110 tokens per second, and a user can verify the result in around 17 seconds on an ordinary CPU, downloading a 6.5 MB commitment plus one proof per request. The cost is the proving overhead: roughly 70 to 95 times the GPU time of plain inference.

The limits are real and the team is clear about them. Proofs only cover greedy decoding on an integer version of the weights, and only up to 1,024 tokens, far short of a normal chat. The fast verifier code also has no formal proof that it matches the specification. Anthropic frames this as intermediate progress toward its Frontier Safety Roadmap and is publishing the code so others can build on it.

Why it matters

If you run agents or audits on top of a hosted model, this points to a future where you can prove a specific model did the work, rather than trusting the provider's word. The overhead is still too high for everyday use, so watch whether the token limit and cost come down before counting on it.