When you ask a chatbot a question, you take one thing on faith: that the model answering is the one you think it is. The label says a flagship model. The bill says a flagship model. But nothing in the response lets you check. If a provider quietly swapped in a cheaper model during a busy hour, you would probably never know.
Anthropic wants to change that. This week the company published FlashProve, an open-source research prototype that attaches a cryptographic proof to an AI reply. Anyone holding the proof can check that the text really came from a specific model, without ever seeing the model’s weights. TechCrunch’s Russell Brandom flagged the release on November 3, and the numbers in the early coverage are worth a close look, because they show both how far this idea has come and how far it still has to go.
The short version
- FlashProve uses a zkSNARK, a compact zero-knowledge proof, to show a reply came from a committed model
- Early reports say it proves a 400B-parameter Llama 4 Maverick at about 110 tokens per second on a single H100
- Each proof is roughly 19 MB for a 1,024-token request, and checking it takes about 17 seconds on a CPU
- Proving still costs on the order of 70x or more the GPU time of normal serving
- It is a research prototype, and there are no plans to deploy it at Anthropic or any other lab
The problem FlashProve is trying to solve
Closed AI models are black boxes by design. Labs keep their weights private, which means a customer, a regulator or a safety auditor can only see what goes in and what comes out. That creates two awkward gaps.
The first is commercial. A provider could serve a smaller, cheaper model while charging for a bigger one, or the reverse: run an expensive model on benchmark day to look good, then swap in something lighter for everyday traffic. The second is about safety. When an outside group tests a model and reports its findings, how do we know the model they tested is the one the public actually gets? Anthropic itself has been moving toward more outside checking, and we covered how it agreed to give METR employee level access for independent audits. A proof of model identity would be one more piece of that puzzle.
Text watermarking tries to tackle a neighboring problem, marking AI output after the fact. If you want to see how fragile that approach can be, our piece on OpenAI’s hidden ChatGPT watermark in the EU shows that swapping roughly a tenth of the words can weaken it. FlashProve takes a different route. Instead of hiding a signal in the text, it proves how the text was produced.
How it works, in plain English
The idea is called provable inference. A provider first publishes a commitment to its model, a kind of fingerprint of the weights. The fingerprint does not reveal the weights themselves, but it locks the provider into one specific model. When a user sends a prompt, the provider runs the model as usual and also generates a proof that the response is exactly what that committed model produces for that prompt.
Later, anyone with four things (the commitment, the prompt, the response and the proof) can run a verification step. If the math checks out, the reply came from the committed model. If the provider used a different one, the proof fails. Verification is designed to run on an ordinary local machine, so you do not need a GPU cluster to be the skeptic.
The numbers behind the prototype
Anthropic tested FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with 4-bit weights. Using an open model made sense for a research demo, since the team could publish results anyone can reproduce. The figures below come from secondary coverage of the release, and I could not open Anthropic’s own post, so treat the exact values as reported rather than confirmed.
| Metric | Reported value | Why it matters |
|---|---|---|
| Proving speed | About 110 tokens per second on one H100 | Fast enough to be a demo of something real, not a lab curiosity |
| Proof size | Roughly 19 MB (about 18.78 MB) per 1,024-token request | Larger than the reply itself by a huge factor |
| Verification | About 17 seconds on a 24-thread CPU, no GPU | Auditors and customers can check without special hardware |
| Serving overhead | Estimates range from about 66x to 95x the GPU time of vLLM | The main reason this is not ready for everyday traffic |
| One time commitment | About 39 minutes | Paid once per model, not per reply |
Why the speed jump is the real story
The overhead sounds bad, and it is. But the more telling comparison is against what came before. One report points to a prior system called VerInf, which proved the same Maverick model at about 0.02 tokens per second. That works out to roughly 14.3 hours for 1,000 tokens and a proof of about 93.6 GB. FlashProve would handle a similar amount of text in around nine seconds with a proof you could email.
Moving from hours to seconds is the kind of leap that turns a theoretical idea into something engineers can build on. Even so, the 19 MB proof per request is a lot of baggage. A typical chat reply is a few kilobytes of text. Shipping thousands of times more proof than answer is workable for audits and spot checks, not for every message in a consumer app.
What it could be used for
- Catching model swaps. Customers paying for a top-tier model could verify they got it, at least on sampled requests.
- Honest benchmarks. A lab could prove that the model scoring on a leaderboard is the model it sells.
- Safety evaluations. Outside testers could confirm the system under test matches the one served to the public.
- Regulated settings. Industries that must document which system made a decision could attach a proof to the record.
Limits worth knowing
- It proves identity, not truthfulness. A verified reply can still be wrong
- Anthropic has said there are no plans to deploy it, and one report says the codebase is described as unmaintained
- The tested model was an open one. Proving a frontier closed model at production scale is a separate, harder job
- Comparisons with older systems depend on model size, hardware and what each proof covers, so the speedup is a guide, not a lab-grade ratio
What to watch next
Three questions will decide whether provable inference stays a research topic or becomes infrastructure. Can the overhead fall from roughly seventy times normal serving to something closer to a rounding error? Will other labs, or a standards body, adopt a shared way to publish commitments so proofs from different providers can be checked the same way? And will customers or regulators ever demand this, or will it remain a nice-to-have that nobody pays for?
For now, FlashProve is best read as a proof of possibility. It shows that checking which model answered you is no longer a thought experiment, and that the gap between “impossible” and “expensive” has closed quickly. Expensive problems tend to get cheaper. The next release is the one to watch.
Sources and further reading
- TechCrunch: Anthropic is working on a system to prove AI models’ identity
- YourStory: Provable inference, Anthropic’s way to verify which AI model replied
- Interesting Engineering: Anthropic unveils cryptographic tool to verify model outputs
- Blockchain.News: Anthropic reports progress on provable inference for large language models
Featured image: NVIDIA H100 by Geekerwan, licensed CC BY 3.0, via Wikimedia Commons.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
