Anthropic FlashProve Proves Which AI Model Wrote a Reply

About 110 tokens per second. That is how fast a single Nvidia H100 can produce cryptographic proofs that a chatbot reply really came from the model it claims to come from, according to new research from Anthropic. The system, called Anthropic FlashProve, was published by the company's Frontier Red Team this week as an open source research prototype, and it puts hard numbers on an idea that has mostly lived in academic papers.

The pitch is simple. Right now, when you send a prompt to an AI model through an app or a routing service, you have no way to check which model actually answered. FlashProve tries to change that by attaching a proof that anyone can verify on an ordinary computer, without ever seeing the model's weights.

FlashProve in eight figures

• 400 billion: total parameters in the test model, Meta's Llama 4 Maverick, a mixture of experts design.
• 17 billion: parameters active for each token, which is what the prover actually has to work through.
• 39 minutes: the one time setup to create a commitment, a kind of fingerprint of the weights.
• 16 million: requests a single commitment covers before the provider must create a new one.
• 110 tokens per second: proving speed on one H100 GPU, measured on batches of 24 requests.
• About 19 MB: proof size for each 1,024 token request.
• 17 seconds: time to check a proof on a 24 thread CPU, with no GPU needed.
• 70 to 95 times: extra GPU time compared with plain inference.

A fingerprint instead of the weights

The setup has two parties. The model provider publishes a short commitment that pins down one exact set of weights while keeping them hidden. Later, for any request, the provider generates a proof that the committed model produced those exact output tokens. Anthropic says the verifier learns nothing about the weights, the intermediate math or which experts fired at each layer. The model's architecture, though, is not hidden.

Under the hood it is a zkSNARK, the same family of zero knowledge proofs used in some blockchain scaling networks. Anthropic describes the construction as built on hash functions, which it says also gives post quantum security. You can read the full write up in Anthropic's provable inference research post, and the code, Lean proofs and documentation are on GitHub under the Apache 2.0 license.

Why 110 tokens per second is the headline number

Earlier attempts were far slower. Anthropic's own comparison lists zkLLM at about 2.5 tokens per second for a 13 billion parameter model, and another system that needed 14.3 hours to prove 1,000 tokens and almost a day to verify a 93.6 GB proof. Getting a 400 billion parameter model to triple digit speeds on one GPU is the jump that makes people pay attention.

Two engineering choices did most of the work. First, the prover only handles the roughly 17 billion parameters active per token, not the full 400 billion. Second, it proves requests in batches after the fact, reading finished text in one parallel pass and streaming weights through a single 80 GB GPU backed by about 290 GB of system memory.

The cost is still steep. Anthropic measured proving at roughly 70 to 95 times the GPU time of serving the same requests with vLLM. That is fine for spot checks and audits, and far too expensive to run on every chat. TechCrunch reported that there are no plans to deploy the system at Anthropic or any other lab.

Who would actually use a proof like this

Anthropic lists several cases. Customers who reach models through third party routers want to know they got the model they paid for, not a cheaper one swapped in to save money. Independent evaluators need to know the model they test is the one being served. Regulators could, in theory, require providers to serve only approved models and check that they do. It also fits the wider push for traceable AI systems that we covered in Anthropic's amended S-1 timeline and the debate over AI training opt outs.

TechCrunch pointed out that the design is meant to hold up even when the impostor is the lab that built and runs the model. That matters as more companies serve open weight models like Mistral Large 4 through hosts the end user never sees.

The numbers FlashProve cannot hit yet

Anthropic is upfront that this is intermediate progress. The limits are specific:

• 1,024 tokens: the longest context it proves today, short next to a typical chat session.
• Greedy decoding only: the proof covers an integer version of the model, so sampled or floating point replies can drift from what was proved.
• No formal link between the fast C++ code and the Lean proofs, so the shipping code carries no formal guarantee.
• Timing side channels that could leak details about the weights are listed as out of scope.

Supply chain trust is already a live issue for developers, as the recent Claude Code extension backdoor showed. FlashProve will not fix that today, but it gives labs and auditors a concrete baseline to beat. For more on how AI companies are handling safety and accountability, see our AI coverage. The next figure to watch is context length: if a future version proves full chat sessions at similar speed, routing services may have a lot more explaining to do.