Anthropic has Claude build cryptography that can reveal whether you get the model you pay for

Anthropic has released FlashProve, an open research system that lets an AI provider prove which model actually answered a request, without revealing the model weights. According to Anthropic, Claude itself produced substantial improvements to the cryptography. The research post is dated 2 November, and the company shared it on X on 3 November at 19:54 UTC.

The problem it addresses is easy to grasp. When a business sends a request to an AI model today, it cannot check that the answer came from the model it pays for. Anthropic itself gives the example of a routing service that quietly swaps in a cheaper model to save costs, and of an attacker who tampers with the stream of responses.

How the proof works

FlashProve is built on a type of cryptographic proof called a zkSNARK. The provider first publishes a short fingerprint of the model weights, known as a commitment. For each response, the provider's GPU produces a proof that exactly those weights, run on exactly this request, produce exactly these tokens.

The recipient can check the proof on an ordinary CPU without access to the weights. According to Anthropic, the proof reveals nothing about the weights, but the model architecture is not hidden.

Anthropic tested the system on Meta's open model Llama 4 Maverick, with 400 billion parameters in a 4-bit version. A single Nvidia H100 generates proofs at around 110 tokens per second. Each proof is about 19 MB for a 1,024-token request. Checking takes 17 seconds on 24 CPU threads. The initial commitment takes about 39 minutes to create and is good for roughly 16 million requests.

From hours to seconds

The cost is compute. Generating the proof takes 70 to 95 times the GPU time of running the model itself in the open inference engine vLLM, according to Anthropic's own measurements.

Even so, the leap is large. The only earlier proof of the same model that Anthropic knows of, VerInf, took 14.3 hours for 1,000 tokens. That proof was 93.6 GB and took almost a day to verify. The company Attestable reports 53 to 77 tokens per second for a smaller model but, according to Anthropic, has not released open-source code.

Anthropic writes that Claude found new ways to apply established tools from the cryptography and security literature. Because Claude often makes decisions that are hard to evaluate, the team added formal proofs in the Lean proof assistant for the key security properties. Code, Lean proofs and documentation are released under the Apache 2.0 licence.

What this means for businesses

Anthropic describes four uses. Independent evaluators can check that the model they test is the one actually being served. Customers can check that an intermediary delivers the model they paid for. A provider can detect that someone has tampered with a server. And a regulator can require proof that only approved models are in service.

For organisations that buy AI through intermediaries, the point is concrete. Today you have to take the provider's word for which model is answering. A proof like this would make it possible to demand evidence instead of trust, in contracts and in audits.

But this is not a product. Anthropic calls it a research prototype and is sharing it so that others can build on it. The GitHub repository is marked as not maintained. The research post says nothing about Claude customers getting such proofs, nor anything about pricing or timing.

The limitations

Anthropic lists several gaps itself. The system only handles contexts of up to 1,024 tokens, far shorter than typical conversations. The proof covers an integer version of the model with so-called greedy decoding, not ordinary operation with sampled output. It assumes a mixture-of-experts architecture.

The fast C++ verifier and the GPU code are tested but not formally proven correct. Attacks that measure how long proofs take to produce are out of scope for this version, Anthropic writes.

Anthropic also writes that its own goal of a prototype for verifying its inference traffic by 30 September 2026 was met through a separate project, which signs the traffic and recomputes it on a trusted server. FlashProve is a different route to the same goal.

Sources and media

• Anthropic: Progress on provable inference for large language models (dated 2 November 2026)
• Anthropic on X: FlashProve announcement (3 November 2026, 19:54 UTC)
• The FlashProve repository on GitHub

Illustration: AI-generated with Grok Bot / hogby.ai