Anthropic has released FlashProve, a research prototype that produces mathematical proofs that a reply, or the parts of it checked, came from a particular AI model. Anthropic says Claude, its AI, built the system and found new ways to apply existing tools from cryptography, the math of keeping information secret and tamper-proof. The work lists researchers from Anthropic, EPFL and MIT among its authors.
Anthropic says that today, a person using an AI model has no way to check that the reply came from the model they chose. A middleman service that routes people's requests to AI models could quietly swap in a cheaper model to save money, the company says, or an attacker could tamper with the replies. Even a good answer is not reliable evidence of which model wrote it.
FlashProve uses a zero-knowledge proof, a kind of cryptographic proof that convinces someone a statement is true without revealing anything beyond the fact that it is true. Here the statement is that one particular model, which the company serving it has pinned down with a short digital fingerprint, produced the text being checked. The person checking learns nothing about the settings the model learned in training, which companies usually keep secret, though the model's overall design is not hidden. The proofs are made after the fact, in batches. In Anthropic's tests, each proof checked one token, one of the small chunks of text, often parts of words, that AI models read and write.
Anthropic tested it on Llama 4 Maverick, a large model from Meta that is publicly available under Meta's license, in a compressed version. Making the proofs on a single H100 AI chip took about 70 to 95 times as much chip time as running the model the usual way with a widely used program, counted per chip. Each proof is about 19 megabytes. Checking one took about 17 seconds on a regular computer processor working on 24 tasks at once, and 21 seconds on one, with no AI chip. Anthropic says earlier open-source systems were far slower, and that the cost is much lower than was previously expected.
Anthropic says proofs like these could let regulators check that a company serves only models approved as safe, and let outside testers confirm they are testing the model a company actually runs. They could also expose a hacked server, or a more capable AI model secretly running in place of the approved one to avoid the safety checks meant for it. Anthropic notes a limit: a proof shows a company's chips answered requests with the claimed model, but not that the same chips weren't also being used on the side to train a new one.
It is a research prototype with clear limits. It covers only short exchanges, much shorter than the conversations that build up in a chat app, Anthropic says. It works only on mixture-of-experts models, a design that switches on only part of the model for each piece of text. It also proves an exact whole-number version of the model that always picks its single most likely next word, so replies from a model run the usual way, with some randomness, may not match exactly.
The math behind its security is checked by computer in Lean, a programming language for proofs. The fast program people would use to check proofs carries no such guarantee, though Anthropic says it agreed with the slower, computer-checked one on every proof in its tests. Anthropic released the code, proofs and documentation under a license that lets anyone use, change and share them free of charge, and says it hopes others will improve them. Meta's model itself is not part of the release.
Anthropic had set itself a goal of building, by Sept. 30, a prototype that ties replies to a specific model. It says it met that goal through a separate project that already runs on its live systems and checks that replies come from a specific model. That project signs all of Anthropic's internal AI traffic and repeats the model's work on a trusted computer. Anthropic has not said whether people using Claude will receive proofs like the ones FlashProve makes.