Anthropic Builds a System to Check Which AI Model Wrote a Response
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
FlashProve, the open prototype from Anthropic, adds to each model response a cryptographic proof tied to the fingerprint of its weights. Anthropic explains that this fingerprint, together with the question and the response, is enough to confirm the origin without access to the model. Llama 4 Maverick served as the test bed, and the price is steep: producing the proofs demands roughly 70 to 95 times more graphics card time than serving the answer.
On Monday, November 2, Anthropic unveiled FlashProve, an open-source prototype that uses cryptography to show which AI model produced a given response. It comes from the company's Frontier Red Team working alongside researchers from EPFL and MIT, among others, and Anthropic credits Claude with part of the system's technical gains.
The starting point is a gap: right now, a person querying a model has no way to be sure the answer comes from the model the provider names. A middleman service could quietly swap in a cheaper one, or an attacker could tamper with the text on its way. Judging by how good the answer looks is not enough.
It works in two stages. First, the provider publishes a fingerprint of the model's weights (the numbers that define it), which pins the model down while keeping those numbers secret. Then every response ships with a cryptographic proof of the zkSNARK kind (a compact mathematical proof that can be checked without redoing the computation). Holding the fingerprint, the question and the response, anyone can verify it with no access to the weights and no need to run the model. The weights stay hidden; the model's architecture does not.
Anthropic measured it on Llama 4 Maverick, Meta's 400-billion-parameter model, in its 4-bit version on a server with a single H100 (an Nvidia graphics card built for AI). Proofs come out at about 110 tokens per second (a token is a chunk of text); each one weighs roughly 19 MB per 1,024-token request and is checked in 17 seconds on a processor running 24 threads, with no graphics card. The price: proving takes roughly 70 to 95 times the graphics card time that vLLM (a widely used program for serving models) needs to handle the same requests.
For comparison, the only earlier proof on that same model that Anthropic cites, VerInf, needed 14.3 hours for 1,000 tokens and produced a 93.6 GB proof that took almost a day to verify. A company called Attestable has announced 53 to 77 tokens per second on a smaller model, Gemma 4 31B, but has not published its code.
The uses Anthropic puts forward include spotting a tampered server that hosts a model, letting a customer confirm that a middleman really serves the model being paid for, and letting a regulator check that a provider only serves approved models.
This is a research prototype with clear limits. Contexts are capped at 1,024 tokens, it assumes mixture-of-experts models, and the proof covers a version of the model that uses integer arithmetic and greedy decoding (it always takes the most likely option), so sampling is not covered and floating-point versions are not covered directly either. Nor is there a guarantee that the fast code matches exactly the version formally verified in Lean, a language for mathematical proofs, and attacks that infer information by measuring things such as how long a proof takes to generate are left out of scope.
The code, the Lean proofs and the documentation are released under the Apache 2.0 license. The model weights are not included: each user downloads them from Hugging Face under Meta's license.
Why it matters · analysis and opinion
Until now, anyone buying a model through a middleman, or using it for a sensitive task, had to take the provider at its word. FlashProve shows that this trust can be swapped for a mathematical check that does not require revealing the weights. But it is not ready for daily use: real conversations are far longer than what it covers, sampling is left out, and that computing overhead is hard to absorb on every response. What is valuable is the direction: auditors, regulators and customers with demanding contracts could ask for proofs instead of promises. Releasing the code openly lets others improve it and extend it to more kinds of models.
Official source: Anthropic · Written with the help of AI: how we make the news
