FlashProve: The Receipt That Proves Which AI Answered You

Every time you send a prompt to an AI model, you take one thing on trust: that the model answering is the one you asked for. There has never been a way to check. A cheaper model could be quietly swapped in to save the provider money, a pricier one substituted to flatter a benchmark score, or a token stream tampered with along the way — and you would never know. On 2 November 2026, Anthropic published a research prototype that tries to end that blind trust. It is called FlashProve, and it works like a cryptographic receipt stapled to every reply.

Quick answer: Anthropic's FlashProve attaches a cryptographic proof to an AI reply, proving which model answered without revealing its weights. A prototype, not a product yet.

What Is FlashProve?

FlashProve is an open-source research prototype that attaches a mathematical proof to an AI model’s reply, showing the answer came from one specific set of model weights — without revealing those weights. Anthropic announced it in a research post on 2 November 2026, “Progress on provable inference for large language models”, alongside a technical report, a protocol specification and working code released under the Apache 2.0 licence. The technique is called “provable inference”, and FlashProve is Anthropic’s attempt to build it with cryptography rather than trusted hardware.

The problem it targets is one Anthropic states plainly in its post:

“A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream.”

— Anthropic, “Progress on provable inference for large language models”, 2 November 2026

That framing matters, because it sets the scope honestly: FlashProve is about which model answered, not whether the answer is good, safe or true. A verified reply can still be wrong. What it cannot be, if the system works as designed, is a reply from a different model wearing another model’s name.

How Does FlashProve Prove Which Model Answered?

FlashProve works in three steps — commit, prove, verify — and the closest everyday analogy is a cryptographic email signature. TechCrunch, reporting the announcement on 3 November 2026, makes the same comparison: just as a signed email lets a recipient confirm a message really came from its claimed sender, FlashProve lets anyone holding the right pieces confirm a reply really came from the claimed model.

Step 1: Commit — the provider publishes a fingerprint

Before serving any requests, the model provider publishes a “commitment” — a short fingerprint that pins down one exact set of model weights while keeping them secret. According to Anthropic’s figures, reported by Crypto Briefing on 3 November 2026, that commitment is about 6.5 MB and takes around 39 minutes of processing to generate. The weights themselves — the numbers that define how a model behaves and that closed-model makers treat as their most valuable asset — never leave the provider.

Step 2: Prove — every reply carries a receipt

For each completed prompt-and-response pair, the system produces a proof that the output tokens are exactly what the committed model would produce for that prompt. The proof is built on a zkSNARK — a zero-knowledge succinct argument of knowledge — which lets one party demonstrate a computation was performed correctly without revealing the private inputs behind it. The proof, the weights, the model’s activations and its routing decisions all stay confidential.

Step 3: Verify — anyone can check, on an ordinary computer

Anyone holding the commitment, the prompt and the reply can verify the proof without access to the weights and without a GPU. Verification takes around 17 to 21 seconds on a standard CPU, per Anthropic’s reported figures. That last point is the design’s real trick: proving is expensive, but checking is cheap — which is what makes the system usable as an audit tool rather than a laboratory curiosity.

FlashProve by the Numbers

The headline numbers all come from Anthropic’s own demonstration, run on Meta’s Llama 4 Maverick — and every one of them is labelled as Anthropic’s own, because no independent party has reproduced them yet.

Measure	FlashProve’s reported result	What it means
Model tested	Meta’s Llama 4 Maverick, 400.7 billion parameters, 4-bit weights	A frontier-scale mixture-of-experts model, not a toy
Proving speed	About 110 tokens per second on a single NVIDIA H100 GPU	Proof generation keeps up with slow chat, not fast generation
Batch test	24 requests proved in about 223 seconds	Proving is a batch job, not a live feature
Proof size	About 19 MB per 1,024-token request	Fine for audits; heavy for verifying every chat
Verification time	About 17–21 seconds on a standard CPU	Checking is cheap and needs no GPU
Commitment size	About 6.5 MB, about 39 minutes to generate	A one-off cost per model version
Proving cost	About 70–95× the GPU time of standard vLLM inference	The reason this is a prototype, not a product
Licence	Apache 2.0; code on GitHub, version 0.16.0	Open for others to audit and improve

The demonstration matters for one reason: it shows cryptographic verification of a frontier-scale model is possible on a single GPU at all. Until FlashProve, that was an open question. Making it cheap enough to matter is, as Crypto Briefing puts it, “the next, considerably harder, chapter”.

Why Would Anyone Need a Receipt for an AI Reply?

Three real situations make model identity worth proving — and all three are already happening in the industry today.

1. The quiet downgrade

A routing service or API provider could serve a cheaper, weaker model than the one a customer paid for. The answers would still look plausible — most users cannot tell a frontier model from a mid-tier one on a single reply — and the provider pockets the difference. FlashProve’s proof would expose the swap, because the proof only verifies against the committed weights.

2. The flattered benchmark

A lab could run a benchmark with a stronger model than the one it claims to be testing, inflating its public score. This is why the story connects directly to the benchmark debate we covered in our SemiAnalysis GDPx piece: a leaderboard score only means something if the model tested is the model named. A proof attached to each benchmark run would close that gap — assuming the benchmark organiser demanded one.

3. The unverifiable claim

A developer might claim its software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim its business plan was approved by the appropriate model. Anthropic’s researchers pose exactly this question in their post: “How can a user verify these claims?” Today, they cannot. A proof would let them.

There is a fourth use case Anthropic’s team flags: evaluators. An organisation testing a model could receive a different model from the one intended for testing, and its safety or capability results would be meaningless. Verified identity would make evaluation results trustworthy in a way they currently are not.

Why You Can’t Use FlashProve Yet

FlashProve is an intermediate research prototype, and Anthropic is explicit that there are no plans to deploy it at Anthropic or any other lab. The announcement post calls itself a share of “intermediate progress, and not a completed research agenda”, released so others can look at the work, take it and improve it. The GitHub repository marks version 0.16.0 as an unmaintained research artefact that is not accepting contributions. Here are the limits that matter most:

Short contexts only. Proofs cover contexts of up to 1,024 tokens — a fraction of the long conversations people actually have with AI assistants today.
Mixture-of-experts models only. The system is designed specifically for MoE architectures, which route each input through a subset of specialised sub-networks. Dense models are outside its current scope.
Greedy decoding, integer weights. The proofs cover an exact integer version of the weights under greedy decoding — a simplified, deterministic form of inference, not the sampling most chatbots use.
It only works if labs volunteer. Nothing in FlashProve forces a provider to publish a fingerprint. A lab that does not want its model swaps checked simply does not publish one.
It can’t prove the name on the label. The proof ties a reply to a committed set of weights — but it cannot, by itself, prove that the provider committed to the model name it advertises. A dishonest provider could commit to cheap weights and label them “frontier”. The cryptography is sound; the naming is still a trust question.
The cost is the wall. At roughly 70 to 95 times the GPU time of ordinary inference, proving an answer currently costs far more compute than producing it. A 19 MB proof per 1,024-token request is manageable for audits and spot checks, but heavy for verifying every single interaction at scale.

One more honest caveat, from Anthropic’s own materials: the formal security properties of the proofs have been machine-checked in Lean, a proof assistant — but the formal statements still require manual review to establish that they express the intended guarantees, and timing and other side-channel attacks fall outside the guarantee entirely.

Our Take: The Receipt Matters More Than the Prototype

FlashProve will almost certainly never reach your chatbot — and that is not the point. Its value is that it settles a question the AI industry has been dodging: is it even possible to prove which model answered, without handing over the weights? The answer, demonstrated on a 400-billion-parameter model on one GPU, is yes. That changes the conversation from “trust us” to “here is the receipt — check it yourself”, and it gives regulators, evaluators and enterprise buyers a concrete mechanism to ask for.

The honest test for any future claim that a service “uses verified models” is the five-question check below. Run it before you believe a badge, a benchmark or a vendor promise:

Is there a published fingerprint? If the provider has not published a commitment to its weights, there is nothing to verify — whatever it claims.
Does the proof cover this reply? A proof for one request says nothing about the next one. Spot checks only work if they are actually spot-checked.
Is the model name independently attested? Cryptography pins weights, not marketing names. Look for an independent auditor or evaluator confirming the fingerprint belongs to the named model.
What does the proof actually cover? Context length, decoding method and model architecture all limit what a proof guarantees. A 1,024-token proof does not cover a 100,000-token conversation.
Who paid for the proving? At 70–95× inference cost, someone is paying for every verified reply. If verification is free to the user, ask who is funding it — and what they get in return.

Anthropic also deserves a note of context here. This is not the company’s first verification project: its Frontier Safety Roadmap set a public goal of a provable-inference prototype by 30 September 2026, which Anthropic says it met through a separate project that signs its inference traffic and recomputes inference on a trusted server. On 19 October 2026 it renamed that goal “inference verification”. FlashProve is the cryptographic route to the same aim, released in the open. The two approaches may converge — or one may win. Either way, the direction is clear: the era of taking model identity on trust is ending, even if the receipts are not ready for everyday use yet.

For readers, the practical upshot is simple. Today, you still cannot verify which model answered your prompt, and no provider offers a FlashProve-style badge. What you can do is treat model-identity claims the way you would treat any unverified claim: ask for the evidence, check who attested it, and remember that a good answer is not proof of which model wrote it.

Frequently Asked Questions

What is Anthropic FlashProve?

FlashProve is an open-source research prototype published by Anthropic on 2 November 2026. It uses zero-knowledge cryptographic proofs (zkSNARKs) to show that an AI reply came from one specific set of model weights, without revealing those weights. It is a research project, not a product, and Anthropic has no plans to deploy it in a product.

Can FlashProve prove which model answered my ChatGPT or Claude prompt today?

No. FlashProve is a prototype with no deployment. No chatbot, API or router currently attaches FlashProve proofs to replies, and the system only covers mixture-of-experts models, contexts up to 1,024 tokens and greedy decoding. There is no user-facing verified-model badge anywhere today.

How big is a FlashProve proof, and how long does checking take?

About 19 MB per 1,024-token request, based on Anthropic’s demonstration on Meta’s Llama 4 Maverick. Verifying that proof takes about 17 to 21 seconds on a standard CPU, with no GPU and no access to the model’s weights. The expensive part is generating the proof: roughly 70 to 95 times the GPU time of ordinary inference.

Does FlashProve reveal a model’s weights?

No. That is the point of the zero-knowledge design. The provider publishes only a short fingerprint (about 6.5 MB) that pins down one exact set of weights, and the proof lets anyone check a reply against that fingerprint without ever seeing the weights, activations or routing decisions.

Will FlashProve stop AI companies quietly swapping in cheaper models?

Only if providers volunteer to use it. FlashProve works only when a lab publishes a fingerprint for its model, and it cannot prove that the marketing name attached to a fingerprint is honest. It is a tool for honest providers, auditors and evaluators — not a lock that dishonest ones cannot avoid.

Sources and Methodology

Sources: Anthropic, “Progress on provable inference for large language models”, 2 November 2026 (anthropic.com/research/provable-inference); TechCrunch, “Anthropic is working on a system to prove AI models’ identity”, 3 November 2026 (techcrunch.com); Crypto Briefing, “Anthropic’s FlashProve uses zero-knowledge proofs to verify large AI model outputs”, 3 November 2026 (cryptobriefing.com); Unite.AI, “Anthropic Releases FlashProve for Cryptographic AI Inference Proofs”, 3 November 2026 (unite.ai); FlashProve repository, Apache 2.0 (github.com/anthropics/FlashProve). Related reading on this site: our SemiAnalysis GDPx benchmark explainer, our Claude bacterial vault explainer, and our how we test AI tools methodology page.

Methodology: every figure in this article comes from Anthropic’s own research post or from reporting of it (TechCrunch, Crypto Briefing, Unite.AI), checked fresh on 6 November 2026. All performance numbers are Anthropic’s own demonstration results and are labelled as such; no independent reproduction exists yet. This article was desk-researched, not hands-on tested — FlashProve is a research prototype with no public deployment to test. Verification date: 6 November 2026.

Arva Rangwala

Arva Rangwala covers AI news, AI tools, guides and prompts for OpenAIMaster — what is new, what is worth using, and how to put AI to work.