Anthropic's FlashProve Aims to Let Users Verify Which AI Model Answered

Anthropic is developing FlashProve, an open-source system that would let users confirm an answer came from the model they believe they are using. The company describes it as a system for provable inference of large Mixture-of-Experts (MoE) language models, an architecture that routes each token to a subset of specialist sub-networks rather than through the whole model. The work is at the research stage. TechCrunch reports that the researchers have no plans to deploy FlashProve at Anthropic or at any other lab.

The core mechanism works on fingerprints. Under the design, AI labs would publish a fingerprint of each released model. Individual outputs can later be matched against those fingerprints and checked cryptographically, so the check rests on mathematics rather than on the provider's word. The fingerprints do not reveal a model's weights, the trained parameters that define its behaviour. The system is also meant to hold up when the party attempting a substitution is the lab that built and operates the model, which is the case the design most explicitly targets.

Anthropic's researchers say the scheme could prevent an AI company from quietly swapping in a cheaper model to cut serving costs, or a more capable model to inflate reported performance. Both cases are, at present, a matter of trust in the provider's account of what served a request. A customer cannot independently check either today.

On performance, Anthropic's research page, titled "Progress on provable inference for large language models," reports that FlashProve achieves provable inference at 110 tokens per second on a single H100 GPU. The same page says it generates 19 MB proofs that can be verified in seconds. TechCrunch adds that the system is designed to be light enough that verification could run on a local device.

Anthropic has also released material for engineers to examine. A technical report, "FlashProve: an open-source library for provable inference," describes the system. According to TechCrunch, the researchers released a detailed technical specification and working code for parts of FlashProve under an open-source license on GitHub. The release covers parts of the system, not the full stack described in the report.

In my view, the practical questions sit in the operational details rather than the cryptography headline. A verifier needs to trust how a model fingerprint was produced and published, so the integrity of the publication step matters as much as the proof itself. Throughput of 110 tokens per second on one H100 is a research measurement. Whether it holds under production batching, multi-tenant serving and the latency budgets of interactive products is a separate question. A 19 MB proof per output is also meaningful overhead for a high-volume API, even if it verifies quickly.

The broader context here is that model substitution is hard for a customer to detect. Benchmark claims, pricing tiers and model names all rest on the provider's word about what runs behind an endpoint. A scheme that turns that word into a cryptographic artifact, checkable on modest hardware, would shift who carries the burden of proof. That is the potential upside. FlashProve has not been deployed, and the research team has said so.

For engineers, the immediate value is the open code and specification. Anyone who wants to test the fingerprinting approach, benchmark proof generation or examine the verification path can do so now, without waiting for a product decision. Whether FlashProve moves from library to standard depends on adoption by labs that have, so far, announced no plans to use it.