Anthropic has released a working prototype that lets a user confirm, with mathematics instead of trust, that a reply came from the exact model a provider says it ran. The system is called FlashProve, and Anthropic’s research page is explicit that it is intermediate progress, not a finished research agenda.
The gap it targets is easy to describe. Reach a model through an API or a routing service and nothing in the answer tells you whether a cheaper model was swapped in, or whether an attacker altered the text on its way to you. Output quality is no guide, since a good substitute reads just as well. Anthropic’s authors, who include researchers at EPFL and MIT, name three groups that would care: independent evaluators testing a model before and after release, customers of resellers who want to get what they paid for, and security teams worried about a compromised server.
The cryptography works like a sealed receipt. First the provider publishes a commitment, a short fingerprint of the model’s weights that locks in one exact set without exposing them. For each reply it then produces a proof file, which certifies that the committed weights, fed this prompt, yield these tokens. The tool is a zkSNARK. “Zero-knowledge” means the checker learns nothing about the weights. “Succinct” means checking is far cheaper than redoing the computation. Forging a proof for a false claim would require breaking cryptographic assumptions that researchers widely trust.
The test model was Llama 4 Maverick, an open model with 400 billion parameters, run in 4-bit form on one Nvidia H100. According to Anthropic, the prover generates proofs at about 110 tokens a second, and a proof for one 1,024-token request weighs roughly 19 MB. The user needs no GPU. Checking one proof takes 17 seconds on a 24-core CPU, or 21 if restricted to one thread. A one-time setup of about 39 minutes covers roughly 16 million requests before the provider must commit again.
The price is steep. Proving costs roughly 70 to 95 times what vLLM, a popular open-source serving library, spends on the same prompts. Anthropic still calls that a large improvement. Its own comparison table shows an earlier system, VerInf, needed 14.3 hours to handle 1,000 tokens of this same model, produced a 93.6 GB proof, and needed almost a day to verify. A commercial effort named Attestable reports 53 to 77 tokens per second on Gemma 4 31B, a smaller dense model, but has not released code.
The limits are listed in the post, and they are real. Context length tops out at 1,024 tokens, far shorter than a long chat. The proof covers an integer version of the model under greedy decoding, so an answer produced by floating-point math, or one using sampled decoding, could drift from what was proved. The design depends on the mixture-of-experts structure, so dense models are not covered. Timing the prover could leak information about the weights, which Anthropic leaves out of scope. The fast C++ verifier carries no formal guarantee; only the slower Lean verifier does, and the two agree on every test proof. Proving happens after the fact, so guarantees arrive late.
The compliance angle is why this sits in a safety paper. A regulator could demand certificates for a period’s requests and confirm a provider served an approved model, or that its hardware did inference rather than secret training. Anthropic notes the proofs would not rule out training on the side. Its public goal of a prototype by 30 September 2026 was met through a separate project that signs inference traffic and recomputes it on a trusted server.
Anthropic made the code, the Lean proofs and the write-ups free to reuse under an Apache 2.0 license. For anyone buying model access through intermediaries, the nearest use is spot-checking short audited calls; proving every request at a 70-fold GPU bill is not on the table.
Reported by Anthropic (its research page) on 2 November 2026.
