Anthropic Open-Sources a Way to Prove Which AI Model Answered You
Anthropic has released FlashProve, an open-source prototype that attaches a cryptographic proof to a language model's answer, so a user can check which set of model weights produced it. The company published the code and machine-checked proofs of the system's security properties under the Apache 2.0 license on Nov. 2, 2026, alongside a technical report and a protocol specification.
The problem it addresses is that nobody outside a model provider can tell from an answer which model wrote it. Anthropic's post names three cases: an outside evaluator that needs to know the model it tested is the model being served, a customer whose third-party routing service could quietly swap in something cheaper, and an attacker who has tampered with a server's output. The company says the method, a cryptographic tool called a zkSNARK, produces a short certificate that is quick to check and reveals nothing about the weights themselves.
Every performance figure here is Anthropic's own measurement of its own system, and no independent evaluation of any of it has been published. The company reports that on a single H100 graphics processor, its prover handled Llama 4 Maverick, a 400-billion-parameter model from Meta, at 110 tokens a second, producing proofs of 18.78 megabytes each. The prover works on batches of finished replies rather than alongside live inference, and Anthropic puts the overhead at roughly 70 to 95 times the GPU time the same model needs to answer the requests in the first place. Anthropic says checking a proof needs no graphics card and takes seconds on an ordinary processor.
Anthropic says prior open-source systems are orders of magnitude slower, and gives one comparison on the same model: VerInf, the only earlier attempt it knows of, reported 14.3 hours for 1,000 tokens.
The prototype proves answers over contexts of up to 1,024 tokens, far short of the windows frontier models now offer. Anthropic also says the improvements were produced by Claude, its own model, and that it published machine-checked security statements because the model's optimization choices are hard for people to evaluate.
