Anthropic has released an open-source system that uses the same kind of cryptography found in Ethereum scaling networks to prove which AI model wrote a given response. The system is called FlashProve, and the company’s Frontier Red Team published it this week.
The project relies on a tool called a zkSNARK, short for zero-knowledge succinct argument of knowledge. Anthropic says its proof system is the kind used in layer-2 networks such as Starknet and Mantle, which help scale Ethereum.
The research team included Anthropic staff and outside researchers from EPFL, MIT and StarkWare, the company behind Starknet. Alessandro Chiesa, who is affiliated with both EPFL and StarkWare, is among the listed authors.
How the Proof System Works
Today, a user has no reliable way to confirm that a reply came from the model they chose. A routing service could quietly swap in a cheaper model, or an attacker could tamper with the response.
FlashProve works in two steps. First, the model provider publishes a short “commitment,” a kind of fingerprint that locks in one exact set of model weights without revealing them.
Then, for each request, the provider produces a proof that the committed model generated those exact output tokens. Anyone with the fingerprint, the prompt and the reply can check the proof without seeing the weights.
Weights are the internal numbers that define how a model behaves. Closed-model makers like Anthropic and OpenAI keep them private, so the hiding feature is meant to let commercial labs take part. The model’s architecture is not hidden.
Speed and Size of the Proofs
Anthropic tested the system on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, using public 4-bit weights. A single Nvidia H100 GPU produced proofs at about 110 tokens per second.
Each proof was about 19 MB for a 1,024-token request. Checking one took 17 seconds on a 24-thread CPU, with no GPU needed.
Proving still costs about 70 to 95 times the GPU time of running the model normally on vLLM, a common open-source inference engine. The one-time fingerprint step took about 39 minutes and covers roughly 16 million requests.
Earlier work was far slower. A prior system called VerInf needed 14.3 hours to prove 1,000 tokens on the same model, produced a 93.6 GB proof and took almost a day to verify.
Anthropic says the commercial firm Attestable reported 53 to 77 tokens per second on a smaller 31-billion-parameter model. Attestable has not released open-source code.
To build trust in the code, the team used Lean, a formal verification language, to prove key security properties. It released both a fast verifier written in C++ and a slower verifier written in Lean.
The researchers listed several possible uses. These include letting regulators confirm that only approved models are served, detecting hacked servers, and checking claims that a frontier model scanned software for bugs.
The prototype has limits. It only handles contexts up to 1,024 tokens, works only with mixture-of-experts models, and proves an integer version of the model under greedy decoding.
Anthropic had set a goal in its Frontier Safety Roadmap to build a provable inference prototype by September 30, 2026. The company says it met that goal through a separate project that signs inference traffic, and FlashProve pursues the same aim by a different method.
The code, Lean proofs and documentation are on GitHub under the Apache 2.0 license. Research is ongoing, and there are no plans to deploy the system at Anthropic or any other lab, according to TechCrunch. The researchers said they are sharing it so others can “take it, and improve it.”
