Anthropic released FlashProve, a prototype for verifying which model generated an AI response.
Why it matters: Reliable model identity could help with audit trails, enterprise controls and model-substitution detection. But FlashProve remains research software, with substantial proof-generation and deployment limits.
- FlashProve binds a prompt and response to a 6.5 MB cryptographic commitment to specific model weights.
- Anthropic tested a publicly available 4-bit version of Meta's roughly 400-billion-parameter Llama 4 Maverick model.
- A single NVIDIA H100 generated proofs at about 110 tokens per second for batches of 24 requests.
- Verification took about 17 seconds on a 24-thread CPU without access to model weights.
Anthropic published FlashProve on November 2, 2026, as an open-source research prototype for proving that a response came from a particular committed set of model weights.
The two-stage system first creates a 6.5 MB cryptographic commitment, or fingerprint, for the weights. It then generates a zero-knowledge proof that the committed model produced the claimed output for a given prompt. Anyone with the commitment, prompt and reply can check the result without the weights.
The system uses zkSNARKs. Under its commitment and verification assumptions, it can make substitution by a provider, router or attacker detectable; it does not prevent someone from substituting a different model. The identity guarantee applies only to the committed weights and the tested inference configuration, not to arbitrary model versions or sampling settings.
In Anthropic's benchmark, the company used publicly available 4-bit weights for Meta's mixture-of-experts Llama 4 Maverick, a model with approximately 400 billion parameters. One NVIDIA H100 generated proofs at about 110 tokens per second for batches of 24 requests, while each proof was about 18.78 megabytes.
Verification required no GPU or model weights and took about 17 seconds on 24 CPU threads. Proof generation took roughly 72 times the per-GPU time of vLLM in one comparison and about 94 times at the highest tested load, according to Anthropic.
The Apache 2.0 release includes executable and formally verified verifiers, but the repository describes the project as a research artifact that is not maintained. TechCrunch reported on November 3, 2026, that Anthropic had no current deployment plans, underscoring the gap between the benchmark and operational use.
By the numbers
- 6.5 MB - size of the cryptographic commitment
- 72x-94x - proof-generation overhead versus vLLM in Anthropic's comparisons
- 110 tokens per second - proof-generation rate on one NVIDIA H100 for batches of 24
Yes, but: The benchmark covers one publicly available, quantized Llama 4 Maverick version and a specific inference configuration. Its results do not establish performance for other models, weight formats or sampling settings, and the project remains a research artifact.
What's next: As of November 3, 2026, TechCrunch reported that Anthropic had no current deployment plans. The dossier identifies no announced production rollout beyond the open-source research release.