Anthropic releases FlashProve, open-source code that cryptographically verifies an AI response came from a given model, not a cheaper one swapped in by a router (Anthropic)

Anthropic, a leading artificial intelligence research company, has unveiled FlashProve, an open-source code that enables cryptographic verification of AI responses. This innovation aims to ensure that an AI model's response is produced by the specific model it claims to be, rather than a potentially cheaper or substituted model.

Presenting this development are Roy Rinberg, Alex Allain, Alessandro Chiesa, Miranda Christ, Rahul Dalal, Giacomo Fenzi, Ben Mayer, Guy Weissenberg, and other contributors from Anthropic, EPFL, StarkWare, MIT, and RESI. The FlashProve system is designed to enable users to confirm that the AI model they have selected is the one generating the response.

This is crucial for various applications, ranging from consumer products to internal security, and can contribute to a toolkit for verifying compliance with AI pacing requirements.

The core of FlashProve lies in a type of cryptographic proof known as a "zkSNARK" (zero-knowledge succinct argument of knowledge), which is particularly well-suited for provable inference due to its strong hiding and efficiency properties. FlashProve's release includes code, Lean proofs, and documentation under the Apache 2.0 license, with the intention of sharing intermediate progress and fostering further improvement.

For instance, when a user queries an AI model, they currently have no way of verifying that the response originates from the selected model and not a substituted one. This issue becomes more pressing in scenarios where assurance of the model's identity is essential. Evaluators assessing AI models before and after release need to be certain they are evaluating the model being served.

Clients using a model via a third-party routing service require assurance that the tokens come from the model they paid for. Additionally, if a cyberattacker modifies the token stream while posing as a specific model, a user would have no way to detect this alteration from the output alone.

Implementing provable inference (PI) enables users with limited computational resources and without access to model weights to verify that a response came from the requested model. The primary motivation for PI is to enhance customer trust in AI providers, as well as to facilitate compliance with AI development commitments and potential legal obligations. However, the challenge lies in verifying model responses using limited computational resources and without knowledge of the underlying weights.

To address this, FlashProve proposes a solution through cryptographic techniques. A zero-knowledge succinct argument is a cryptographic object that allows the model provider to send a short proof when claiming a specific response. The user can quickly verify this proof, typically within seconds on a CPU, to confirm whether the response aligns with the specified model. Crucially, these proofs do not reveal any information about the model's weights, preserving privacy while ensuring authenticity.

The FlashProve prototype demonstrates the feasibility of this approach. For a 400 billion parameter mixture-of-experts model (Llama 4 Maverick, quantized to 4-bit), the system generates proofs at over 100 tokens per second, with each proof size being approximately 19 megabytes for a 1,024-token request. This is roughly 70-95 times more efficient than the GPU time required by vLLM, a common open-source library, to process prompts of the same length.

By making these tools accessible through open-source code and documentation, Anthropic hopes to accelerate development in the field of provable inference and demonstrate the practicality of zero-knowledge succinct arguments.