Anthropic’s FlashProve Can Catch Hidden AI Model Swaps, but Is Still Experimental

Anthropic published research this week on FlashProve, an open-source system meant to let anyone confirm that an AI reply really came from the AI model that was named. 

Right now, a user cannot tell whether a service quietly swapped in a cheaper model or altered a reply along the way. 

Anthropic’s Frontier Red Team built it with researchers from EPFL, MIT, StarkWare and Succinct, and released the code, a protocol specification and a technical report under an Apache 2.0 license. 

The test model was Meta’s Llama 4 Maverick, not its Claude.

FlashProve Gives Each AI Reply a Receipt

The system works in two steps. First, a provider publishes a short fingerprint of its model’s weights, which stay private. 

Then, for every request, it builds a proof file showing that this exact model generated those specific output words for your prompt. 

So, anyone with the fingerprint, prompt, and reply can verify that proof without ever seeing the secret model weights.

Anthropic’s post lists the failures the system targets: a routing service quietly switching to a cheaper model, an attacker tampering with your reply, and a compromised AI inference server. 

TechCrunch compares it to secure email signatures and adds that labs cannot secretly use cheaper models to fake better test scores behind closed doors. The report also says that the design even protects users if the AI company itself tries to cheat. 

Simply put, users or companies could demand proof that a critical document or medical scan was actually reviewed by a top-tier model instead of a budget substitute. 

Llama 4 Maverick Tests Show Proofs Costing 70 to 95 Times Normal Compute

The numbers come from Anthropic’s post. The test used Llama 4 Maverick, a 400-billion-parameter model from Meta with about 17 billion active per token, running 4-bit weights on one H100 graphics card. 

Generating the proof ran at roughly 110 tokens per second, taking about 223 seconds for a batch of 24 requests. 

Compared to a standard AI server engine, that makes the process 72 to 94 times slower than normal.

Setting up the system takes about 39 minutes once per model, and that setup fingerprint lasts for around 16 million requests.

On the receiving end, each proof is about 19 MB for a 1,024-token request. Verifying that proof takes about 17 seconds on a 24-core processor with no graphics card. 

Put simply, verifying 1,000 replies means downloading roughly 19 GB of proofs.

A Progress That Claude Users Can’t Check Yet

Anthropic calls this release early progress rather than a finished product, and TechCrunch confirms there are no plans to roll it out for Claude or any other AI service yet. 

The current limitations are quite strict. The system only works if the AI writes in a rigid, robotic way without any creative randomness. The conversations are capped at 1,024 tokens, about 750 words, which is far shorter than a typical session in your everyday chatbot. 

The system does hide secret model weights; it does not hide the underlying architecture, nor does it prove the server wasn’t secretly training other models in the background.

Also, the proofs are made after the chat happened, not in real time. 

So the question of which model answered you now has a cryptographic answer on paper, but it works as an audit tool for later checks, not yet as a guarantee a user can rely on while chatting.

Source: Progress on provable inference for large language models