Anthropic open-sources FlashProve, a cryptographic proof that a reply came from the model you asked for

Anthropic's Frontier Red Team published FlashProve on November 2, an open-source prototype that lets a model provider prove each response came from the exact model it committed to, without revealing the weights. We read Anthropic's research post and the code repository directly.

WHAT IT DOES

- The provider first publishes a commitment: a short fingerprint that pins down one exact set of weights while keeping them hidden. - For each request it then sends a proof that those committed weights, run on that prompt, produce exactly those tokens. - The proof hides the weights, but not the model's architecture. - Checking needs no GPU. In Anthropic's test, one proof took 17 seconds to check on 24 CPU threads (21 seconds on one), after a one-time download of the commitment, about 6.5 MB.

THE NUMBERS (ANTHROPIC'S OWN FIGURES)

- Test model: Llama 4 Maverick, a 400B-parameter mixture of experts, in 4-bit quantized weights. - One H100 GPU proves about 110 tokens per second, and each proof for a 1,024-token request is about 19 MB. - That is about 70 to 95 times the GPU time vLLM takes to run the same requests. - Anthropic says Claude produced the improvements to the proof system, and that the top-level security claims are written and proved in Lean so they can be audited.

WHY IT MATTERS

Today a user cannot check that a reply came from the model they paid for, rather than a cheaper one swapped in by a routing service or a stream someone tampered with. Anthropic also pitches proofs like these for evaluators and auditors, and for rules that pace frontier development, for example showing that a provider's hardware was really serving inference.

WHAT WE DO NOT KNOW

- Whether Anthropic will attach proofs to Claude itself. The release proves an open model, Llama 4 Maverick, and Anthropic calls it a research prototype. - How far it holds outside the tested setup. The proof covers an integer version of the weights under greedy decoding, so a floating-point or sampled reply can drift from what was proved, and Anthropic says its paper, fast code and Lean version are not guaranteed to match each other.

The code, Lean proofs and documentation are under the Apache 2.0 license at github.com/anthropics/FlashProve, with a fast C++ verifier, a Lean verifier and a technical report. Posts on X flagged the release today; the figures above are from Anthropic's post.