FlashProve: Proving Which AI Model Actually Answered

You call an AI API. How do you know the model that replied is the one you asked for? Today, you don’t. Anthropic’s FlashProve (open source, Apache 2.0) is a research prototype that fixes this with a cryptographic proof.

How it works

Commit: The provider publishes a short “fingerprint” of its model weights. The weights stay secret.
Prove: For each reply, the provider’s GPU creates a proof that the committed model produced those exact tokens.
Verify: You check the proof on a normal CPU. No GPU, no weights needed.

Numbers (Llama 4 Maverick, 400B)

About 110 tokens/sec on one H100
Proof size ~19 MB; check time ~17 sec
Proving costs 70-95x the GPU time of normal serving

Why it matters

Catch secret model swaps by routers or providers
Spot tampered responses
Give auditors and regulators real proof

Limits

Only 1,024 tokens of context
Proves an integer version with greedy decoding
Hides weights, not architecture
Prototype: not maintained, no deployment plans

Media
Visual aid: Interactive Lean theorem visualizer from the FlashProve repo, which shows the security claims being checked

References & Credits

Anthropic, Progress on provable inference (Roy Rinberg, Alex Allain and co-authors from EPFL, MIT, StarkWare and Succinct)
FlashProve on GitHub (Apache 2.0)
TechCrunch, Russell Brandom
Interesting Engineering, Neetika Walter