When you pay for a specific AI model through an app or a reseller, you have no way to check that your answer really came from that model rather than a cheaper one quietly swapped in to save money. Anthropic's FlashProve, released as an open-source prototype, is an early attempt to close that gap with cryptography, and it is the first version of the idea that looks close to practical.
The tool uses a zkSNARK, a type of cryptographic proof that lets a server convince you a computation was done correctly without revealing anything else, in this case without exposing the model's weights. The provider first publishes a commitment, a short fingerprint pinning down one exact set of weights. Then, for each reply, it generates a proof that those committed weights, run on your prompt, produced exactly those tokens. Anyone with the commitment, the prompt and the reply can verify it quickly on ordinary hardware, without the weights and without re-running the model. That matters for consumer trust, for a company proving a frontier model really reviewed its code, and for regulators checking that only approved models are served.
The speed is the headline. On Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model we review, a single H100 GPU produces proofs at about 110 tokens a second, with a proof around 19 MB per 1,024-token request, using 4-bit quantised weights. The only earlier open-source attempt ran near 0.02 tokens a second, so this is a jump of several thousand times. Anthropic ships the prover, a fast C++ verifier and a separate verifier proved correct in Lean, all under Apache 2.0, and frames it as intermediate progress rather than a finished system.
The cost is the obvious catch. Generating the proof takes roughly 70 to 95 times the GPU time of just serving the model on vLLM, so running FlashProve on every request would multiply inference cost many times over. That alone keeps it out of routine production for now.
The other limits are worth stating plainly. Proving is restricted to greedy decoding and a 1,024-token context, which rules out the long contexts and sampled outputs most products rely on. And the fast C++ verifier does not carry the formal guarantees of the Lean-checked one, so the convenient path is not yet the proven path. Anthropic has published this to be built on, and that is the right way to read it: a credible proof of concept for verifiable inference, not something you can demand from your model provider today.