When you pay for access to a named AI model, identifying it from its answers alone remains unreliable. A convincing reply can show that a service works, while leaving a more basic purchase question unresolved: did the model you selected actually do the work?
Anthropic's FlashProve research release, published Nov. 2, offers a way to check model computation without exposing the model's private weights. The catch is the work required to produce that assurance: roughly 70 to 95 times the GPU time of ordinary inference in the company's benchmark.
That makes FlashProve a potential safeguard for buyers using third-party AI services, with substantial distance still to travel before routine use. The demonstration uses Meta's Llama 4 Maverick, not a verification feature being switched on for Claude customers.
How the verification works
The process begins before a response is checked. A provider publishes a cryptographic commitment to its model weights, the numerical parameters that determine how the model computes an answer. Think of it as a fingerprint that fixes which weights subsequent proofs must match, while keeping those weights hidden.
The provider then produces a proof that the committed model, given the specified input, produces the checked output. A verifier can check that proof without downloading the weights or running the model again.
For readers familiar with blockchain, this uses the same broad family of zero-knowledge proof techniques used to verify computation in Ethereum layer-2 systems. Here, the useful property is that someone can check the computation without learning the private information behind it.
Trusted identity and answer truth remain separate
There is still an identity question at the start. FlashProve's repository says the commitment ID must come from a party the user trusts, rather than the server being checked or the files accompanying its proof. A proof against an arbitrary fingerprint would not establish that the fingerprint belongs to the premium model advertised.
Answer truth remains a separate question even after a successful proof. A model can faithfully perform its own computation and still produce a factual error or unsafe advice. FlashProve addresses the computation behind checked outputs; assessing their quality remains a separate job.
A proof can verify checked model computation while leaving answer truth and safety unproven.
Prototype limitations
FlashProve is a research prototype, not a deployed Claude feature. It supports context up to 1,024 tokens. The system proves an exact integer model's greedy computation, which can differ from ordinary sampled responses. Model identity requires a trusted commitment. Proofs do not certify answer truth or safety, and implementation assurance remains limited.
The costly part happens before verification
Anthropic's demonstration uses a public, 4-bit conversion of the 400-billion-parameter Llama 4 Maverick model. The proving system runs on one H100 GPU, while a user can check a proof on a CPU without a GPU.
The reported proof is about 19 MB per request. Verification takes 17 seconds on 24 CPU threads, or 21 seconds on one thread. That is a much smaller hardware requirement than running the model, but generating the proof remains expensive.
The technical report compares proving work per GPU with vLLM, an inference engine running the FP8 version of the same model on eight H100s. The roughly 70 to 95 times overhead compares those specific implementations.
Even the headline throughput figure needs care. The reported 110 tokens per second counts all tokens processed in each 1,024-token request. In the main benchmark, each proof checks one following output token. That figure describes processing throughput rather than 110 individually authenticated new tokens per second.
FlashProve also works after the fact, recomputing finished transcripts to produce proofs. That can keep proving work separate from delivering an answer, but it delays the assurance. As the report explains, detecting tampering afterward does not prevent a user from receiving the altered response first.
The current context limit is 1,024 tokens, restricting how much conversation a proof can cover. The system proves an exact integer model's greedy choices, meaning its highest-ranked next tokens. Ordinary floating-point computation or sampled responses can diverge from those choices.
There are implementation gaps too. Anthropic provides formal security statements in Lean, a system for checking mathematical proofs, but the fast executable code is not proved equivalent to that formal protocol. The report also says zero knowledge has not yet been formally proved for requests processed together in a batch. The repository labels the release an unmaintained research artifact.
For buyers, the route toward stronger protection is nevertheless concrete: a trusted commitment identifying the advertised model, proofs covering the relevant outputs, and a verifier that can reliably check them. FlashProve demonstrates important parts of that route while exposing their present limits.
