Anthropic has introduced FlashProve, an open-source cryptographic system designed to mathematically prove which AI model generated a specific output. The system aims to prevent the substitution of AI models and to curb performance inflation by requiring published model fingerprints.
The AI safety company Anthropic announced on November 3, 2026, the release of FlashProve, an open-source prototype system intended to verify the origin of AI-generated responses. This cryptographic framework allows users to confirm that an output originated from the AI model it claims to be from, without needing access to the model's proprietary weights. The system addresses a growing concern in the deployment of AI models, particularly in enterprise settings, where providers might substitute less capable or cheaper models without customer knowledge, or falsely inflate performance metrics. FlashProve employs cryptographic techniques, described as "provable inference," which function similarly to digital signatures for email. AI developers are required to publish a unique "fingerprint" for each model. Users can then cryptographically verify that AI outputs match these published fingerprints, thereby confirming the model's identity. This verification process is designed to be lightweight enough for local device execution, making it practical for widespread use. Crucially, the fingerprints do not reveal any information about the model's internal weights, allowing commercial entities like Anthropic and OpenAI to protect their intellectual property.
Anthropic researchers detailed that FlashProve uses cryptographic proofs, specifically from the zero-knowledge proof family, to enable quick verification on a user's device without disclosing the model's internal parameters. The system attaches a short proof to an AI response, allowing a user to confirm the generating model without revealing its sensitive numerical details. The company has released the technical specifications and working code for FlashProve on GitHub under an open-source license, encouraging collaboration and iteration within the AI community. However, Anthropic has stated there are no immediate plans for production deployment of FlashProve, either internally or with partners. The release is characterized as an ongoing research effort to stimulate community feedback and improvement.
The cryptographic verification process comes with a substantial computational overhead. Anthropic's evaluations indicated that for a large model like Meta's Llama 4 Maverick (400 billion parameters), generating proofs required approximately 70 to 95 times more GPU time compared to standard inference processing using vLLM. For instance, a single H100 GPU could generate proofs at over 100 tokens per second, but this process produced a proof size of about 19 MB per 1,024-token request, with the commitment step taking around 39 minutes offline. Verification, on the other hand, can be performed on a CPU without a GPU, downloading a commitment of approximately 6.5 MB.
FlashProve addresses a gap in trust for hosted AI services. Currently, users have limited independent means to confirm the specific model generating a response, creating opportunities for deception. This could involve a provider substituting a cheaper model to reduce operational costs or an evaluator receiving a different model than intended for testing. By providing cryptographic proof of model identity, FlashProve could help establish new standards for AI transparency, particularly in regulated sectors that require audit trails and verification. The company's move aligns with broader industry efforts to standardize AI transparency and accountability.