Anthropic’s FlashProve checks AI model output without exposing its secret weights

Anthropic has released a research prototype that checks an AI model’s output without exposing the weights used to produce it. Called FlashProve, the system uses cryptographic proofs to tie a checked token to a previously committed set of model weights.

The work addresses a problem that is difficult to solve by reading a chatbot's answer: a user may not know whether the requested model generated it, or whether a provider substituted another one. Anthropic says the prototype could give users and auditors a way to check that claim without running the model themselves.

It is research, not a new verification switch in Claude. The test used a quantised version of Meta's Llama 4 Maverick model, and producing the proof still takes considerably more computing power than generating the answer alone.

A proof can tie an answer to a particular set of weights

In its research announcement, Anthropic describes two stages. First, a provider publishes a commitment to the model weights. After a request has been processed, it produces a proof that the committed model generated the checked token.

Someone with the commitment, input and proof can then check the claim without seeing the proprietary weights. Anthropic says its proof is designed to conceal those weights and intermediate calculations, though the model's architecture is not hidden.

That would tell a verifier something specific about how a response was produced. It would not establish that the answer is correct, that the model is safe, or that a provider isn't doing other work on the same hardware.

The experiment still comes with a substantial computing bill

Anthropic tested FlashProve with the 400-billion-parameter Llama 4 Maverick mixture-of-experts model, using publicly available four-bit weights. Each request used a 1,024-token context, with each proof checking one token. Its test system used one Nvidia H100 GPU and 24 CPU cores to produce proofs in batches of 24 requests.

The researchers report roughly 110 tokens per second across their batch, with a proof of about 19 MB for a 1,024-token request. Checking a proof took about 17 seconds using 24 CPU threads, according to the published measurements. The company says proving used roughly 70 to 95 times as much GPU time per device as running the same model with eight-bit weights in the vLLM inference engine. The proof experiment used four-bit weights, so the comparison is not between identical calculations.

Those figures are for the researchers' setup, not a promise about what an individual chatbot user will see. Anthropic’s system generates proofs after inference rather than proving each token as it streams to a user.

The prototype does not cover every kind of response

FlashProve currently checks an integer version of the model using greedy decoding. Anthropic cautions that floating-point implementations or sampled responses can produce different tokens and therefore may not match the computation being proved.

The system also handles contexts of up to 1,024 tokens, much shorter than the context windows offered by many current assistants. Its faster C++ verifier does not carry the formal guarantee of the separate Lean verifier, and the research team says the relationship between the formal protocol and executable code still needs auditing.

Anthropic has released the code, documentation and mathematical proofs under the Apache 2.0 licence so other researchers can inspect and build on the work. The model weights are not included in that release.