Anthropic releases free code that proves which AI model wrote a reply
FlashProve attaches a small cryptographic proof to each reply that anyone can check in seconds without seeing the model's secret settings.
Anthropic, the San Francisco maker of Claude, has released free code that lets anyone check that a chatbot reply really came from the AI model a company claims, the company said in a research post Monday.
Why it matters
Today a user cannot tell whether a service quietly swapped in a cheaper model, or whether a hacker altered the reply, Anthropic wrote. Judging by the quality of the answer is not reliable. The company listed several cases where proof would count: outside testers need to know they are checking the same model the public gets; customers of routing services that pass requests between AI companies want the model they paid for; and companies need to know a hacked server, or a rogue agent, isn't secretly running in place of the approved model.
Anthropic also said such proofs could help regulators, for example by confirming that only approved models are served, or that chips a company says are running a known model are really doing so. It said proofs could also show that a given model really reviewed something, such as scanning code for security holes.
How it works
FlashProve uses a zero-knowledge proof, or zkSNARK, a cryptography tool already used in some blockchain systems. It lets one side convince another that a calculation was done correctly, through a small file that reveals nothing secret and is far faster to check than redoing the work. Here the secret is the model's weights, the billions of numbers learned in training that companies guard.
It works in two steps. First the AI company publishes a commitment, a short digital fingerprint that pins down one exact set of weights without revealing them. Then, for each reply, the company's chip produces a proof that the fingerprinted model, given this prompt, produces exactly these words. Anyone holding the fingerprint, the prompt and the reply can check it on an ordinary computer, without the weights. Faking a proof would require breaking math problems believed to be practically impossible, Anthropic said.
Because cryptography code is easy to get wrong, Anthropic said it wrote the key security guarantees in Lean, a language that lets a computer check a mathematical proof step by step, and released a checker built in it.
How fast it is
In tests on Meta's open Llama 4 Maverick model, which has 400 billion weights, one Nvidia H100 chip made proofs at about 110 tokens, or word pieces, per second. Each proof was about 19 megabytes, and a regular computer checked one in about 17 seconds. Making proofs took 70 to 95 times the chip time of simply running the model.
That is far faster than earlier public systems. A previous proof for the same model took 14.3 hours for 1,000 tokens and produced a 93.6-gigabyte proof that took almost a day to check, Anthropic said.
FlashProve is a research prototype, Anthropic said. It handles prompts of only about 1,024 tokens, a few pages of text, it proves replies after the fact rather than as they are written, it hides the weights but not the model's design, and it works only with "mixture of experts" models, which use a small part of their weights for each word.
Its researchers worked with scientists from EPFL in Switzerland and MIT, and Anthropic said Claude helped build the system. The code is free under the Apache 2.0 open-source license.
Source: Anthropic, "Progress on provable inference for large language models," Nov. 2, 2026, and FlashProve code and documentation on GitHub