Anthropic FlashProve: Proving Which AI Model Answered

The short answer: FlashProve is a research prototype that Anthropic published on 2 November 2026. It attaches a cryptographic proof to an AI reply showing that one specific, pre-declared model produced it. Anyone can check that proof on an ordinary computer without seeing the model’s secret weights. It is not a product. According to TechCrunch, there are no plans to deploy it at Anthropic or at any other lab.

This post rests on Anthropic’s announcement, the public repository and the launch coverage. We have not run FlashProve ourselves, and most of it needs an NVIDIA H100, a data-centre GPU.

The problem it is trying to solve

When you pick Claude or GPT in an app, you trust that this model is the one answering. You cannot check. Anthropic gives two examples of how that trust can fail. A routing service, which passes requests on to different models, quietly swaps in a cheaper one to save money. Or an attacker tampers with the reply on its way to you. Neither shows up in the text itself, even when the text is good.

It is not only an individual’s problem. Anthropic also points to independent evaluators, who test models before and after release and need to know they are testing the model actually being served, and to regulators, who might one day require that only approved models run. The question is the same in each case: which model really produced this reply?

How it works, without the maths

The GitHub repository breaks it into three steps:

1. 01Commit: the provider publishes an ID that binds it to one exact set of model weights. The weights stay secret.
2. 02Prove: for each reply, the provider’s GPU produces a proof that the reply is the committed model’s output.
3. 03Verify: anyone checks the proof on an ordinary CPU in seconds, without the weights.

The technique is called a zkSNARK, a kind of zero-knowledge proof: a proof that a computation was done correctly which reveals nothing else. TechCrunch compares it to the email signatures that let you check a message came from the sender it claims. One unusual detail: Anthropic says Claude found many of the improvements and wrote the protocol specification. Because those choices are hard for people to audit, the team also supplies the main security claims as formal proofs in Lean, a language for machine-checked mathematics.

What the prototype can do today

The model it proves is not Claude. It is Llama 4 Maverick, an open model with 400 billion parameters, run in a 4-bit compressed form. Per the announcement, a single H100 generates proofs at about 110 tokens a second, and a proof is about 19 MB for a 1,024-token request. The cost is roughly 70 to 95 times the GPU time of simply running the model. Anthropic says earlier open-source systems were orders of magnitude slower. The detail is in the technical report.

There is a public commitment behind it. In its Frontier Safety Roadmap, Anthropic promised a prototype of this kind of proof by 30 September 2026. The company says it met that goal through a separate project, which signs its own inference traffic and recomputes it on a trusted server. FlashProve chases the same aim by a different method.

The limits Anthropic lists itself

• —Short context: a proof covers at most 1,024 tokens, far less than a long conversation or an uploaded document.
• —One architecture: it assumes a mixture-of-experts model. Other widely used designs are not covered.
• —Not your usual reply: it proves an exact integer version of the model that always picks the most likely next word. A normal chat reply, with some randomness in it, can drift away from that.
• —Not a complete guarantee: Anthropic does not guarantee the fast code, the report and the Lean proofs match exactly. Side channels, such as how long a proof takes, could leak information about the weights.
• —Not maintained: the repository calls itself a research artifact and does not accept contributions. Licence: Apache 2.0.

Anthropic describes the release as intermediate progress, not a finished research agenda, shared so that others can take it and improve it.

What FlashProve does not prove

This is the part the headlines skip. A proof like this tells you who answered. It says nothing about whether the answer is right. A model whose identity is proven can still invent a source or copy a number wrongly. Authentic and accurate are different questions, and FlashProve answers only the first.

The second question is still yours. Our guide on how to check an AI answer when you are not the expert covers the habits that catch the usual errors. And knowing which model wrote something does not tell you how it was trained or what it was told; the difference between generative and agentic AI matters more for what can go wrong.

What it changes for you today

For now, nothing. No consumer chatbot ships proofs like this, and TechCrunch reports Anthropic has no plans to. If it matters which model answers you, going straight to the vendor’s own app is still the most reliable route. Every service in between is one more party you have to trust.

Longer term, FlashProve is about trust in AI that acts on its own. An agent that can take control of a computer does more damage if its model is quietly swapped than a chatbot that only drafts text. For Anthropic’s own agent, we went through what to check in is Claude Duet safe. The same questions about access applied to open prototypes like DeepSeek Super-agent.

Where Coursium fits, and where it does not

Coursium does not produce model proofs and cannot tell you which model sits behind an app. It is an iOS app for learning to use AI at work, with courses such as Claude Essentials and ChatGPT Essentials. What it practises is the part FlashProve leaves open: writing a prompt that works first time and checking the reply before you pass it on. You can see the approach on the Coursium home page or try the free practice example.