Can We Prove That AI Answer Was Truly Written by the Promised Model?

Whenever we ask artificial intelligence a question, we tend to take one thing for granted.

We assume that the AI model displayed on the screen actually generated the answer.

When we select an advanced model and enter a question, we expect that particular model to produce the response. If a company says it uses a specific AI model, we generally trust that statement.

But what if the model we selected was not the model that actually generated the answer?

A cheaper model might have been substituted for the premium AI system we paid to use.

An intermediary service connecting multiple AI models might have redirected requests to another model without informing users.

An attacker who compromised an inference server might even have manipulated the output.

The problem is that reading the answer alone rarely provides a reliable way to distinguish between these possibilities.

A response that sounds convincing and accurate does not necessarily prove that it came from the promised model.

Anthropic has introduced a new technical approach to this problem.

On November 2, 2026, the AI company published research titled Progress on Provable Inference for Large Language Models, introducing FlashProve, a system designed to cryptographically verify the inference results of large language models.

The central idea is to verify that a particular output is consistent with the computation performed by a committed AI model, without requiring the verifier to inspect all the model's internal parameters or rerun the entire model.

The technology relies on zkSNARKs, a family of cryptographic proof systems associated with zero-knowledge proofs.

Researchers implemented a working prototype using Meta's Llama 4 Maverick, a language model containing approximately 400 billion parameters.

Another notable aspect of the research is that Anthropic used its own AI model, Claude, to help improve the performance of the cryptographic proof system.

In other words, AI contributed to developing technology intended to verify the computations of other AI systems.

But the significance of FlashProve extends beyond improvements in cryptographic performance.

It represents a concrete attempt to support trust in AI services with independently verifiable technical evidence rather than relying solely on the promises and reputations of AI providers.

Trusting an AI Model's Name Is Different from Verifying Which Model Actually Ran

Today's AI users can choose from a growing range of models.

Individual consumers select chatbots and model versions according to their preferences.

Businesses compare AI models based on performance and pricing before signing contracts with providers.

Developers connect external models to their own applications through APIs.

Yet independently verifying which model actually executed a particular request remains difficult.

Most users rely on the model name displayed by the service and the information provided by the company operating it.

Naturally, a legitimate provider is expected to run the model specified in its agreement.

But the possibility of problems does not disappear.

Consider a business that purchases access to an expensive AI model.

If an intermediary secretly executes requests using a cheaper model while charging the original price, the customer may have difficulty detecting the substitution.

AI outputs vary depending on the prompt and execution conditions.

A response that is shorter or lower in quality than expected does not necessarily prove that a different model was used.

Conversely, a high-quality answer does not establish that it originated from the promised model.

Evaluating the quality of an AI response and verifying the identity of the model that produced it are separate tasks.

Anthropic's research focuses on the latter.

Its objective is to provide evidence that the requested model actually performed the relevant computation.

Does AI Need a Digital Identity Card?

Anthropic used an analogy involving human conversations to explain the research.

When speaking with a friend face to face, we can recognize the person through their appearance, voice, and behavior.

But AI services provide few comparable ways to verify who—or, more precisely, what—we are interacting with.

Users generally identify an AI model by the name displayed on the screen.

FlashProve seeks to address that uncertainty through cryptography.

The underlying concept is relatively straightforward.

First, the AI service provider makes a cryptographic commitment to the model it intends to use.

Then, when the provider claims that the model generated a particular output, it produces a separate cryptographic proof.

A verifier can examine that proof to determine whether the output matches the computation of the committed model.

Crucially, the verifier does not need to possess the model's complete parameters.

Parameters are the numerical values a model acquires during training.

Large language models may contain hundreds of billions of them.

Downloading all those parameters and independently repeating the computation would be impractical for ordinary users.

Commercial AI companies also frequently protect model weights as proprietary intellectual property.

FlashProve aims to address both challenges.

It seeks to make model computations verifiable while keeping the underlying weights private.

What Is a Zero-Knowledge Proof?

A zero-knowledge proof is a cryptographic technique that allows one party to demonstrate that a claim is true without revealing certain secret information supporting that claim.

Consider the concept of proving that you know a password without disclosing the password itself.

The verifier does not need to learn the secret.

The verifier only needs to determine whether the proof is valid.

The zkSNARK approach used in Anthropic's research belongs to a family of cryptographic proof systems designed to make verification compact and efficient.

Two properties are particularly important.

The first is secrecy.

A verifier should not learn the model's private weights simply by examining the proof.

The second is verification efficiency.

Checking the proof should require substantially fewer resources than independently repeating the AI model's complex computation.

Related cryptographic techniques have also been used in blockchain systems.

Applying them to large language models, however, has been especially challenging.

The reason is computational scale.

Producing cryptographic evidence about calculations involving models with hundreds of billions of parameters can require enormous processing resources.

Anthropic reported meaningful progress in reducing that burden.

How Does FlashProve Work?

FlashProve involves two broad stages.

The first is model commitment.

The service provider creates a cryptographic commitment associated with the weights of the model it intends to use.

A commitment is a cryptographic mechanism that binds a party to a particular value without necessarily revealing the value itself.

In simplified terms, it can function like a cryptographic fingerprint of the committed model.

It allows later verification of which weights were committed without requiring those weights to be publicly disclosed.

The second stage is inference verification.

After an AI system generates an output, the provider creates a proof showing that the output is consistent with the computation performed by the committed model.

The verifier uses the commitment, input, output, and proof to determine whether the claimed computation is valid.

The important point is that the verifier does not have to run the language model.

Nor does the verifier need access to its complete weights.

Instead, the verifier checks the cryptographic evidence.

This approach could help reduce information asymmetry between AI service providers and their customers.

Traditionally, users have had to accept a provider's statement about which model was used.

If systems such as FlashProve become practical, customers could ask for verifiable evidence in addition to those statements.

Anthropic Demonstrated Verification Using a 400-Billion-Parameter Model

Anthropic used Meta's Llama 4 Maverick in its experiment.

Llama 4 Maverick is a mixture-of-experts, or MoE, language model with approximately 400 billion parameters.

In an MoE architecture, the model does not activate every parameter for every computation.

Instead, it selects subsets of specialized neural networks, often called experts, according to the input.

In this case, approximately 17 billion parameters were active per token.

The researchers took advantage of that architecture.

Rather than proving an identical computation involving all 400 billion parameters for every token, they organized the proof process around the experts actually activated during inference.

That approach helps reduce the cost of generating proofs.

The experiment also used publicly available model weights quantized to four bits.

Quantization represents numerical values using fewer bits, reducing memory requirements and potentially lowering computational costs.

However, the experiment did not prove arbitrary outputs from every type of language model.

The prototype operated under specific conditions involving integer arithmetic and greedy decoding.

Greedy decoding selects the highest-scoring token at each generation step.

These constraints are important when considering whether the technology can eventually support a broad range of commercial AI services.

What Does Proving 110 Tokens per Second Actually Mean?

Anthropic reported a substantial performance improvement compared with earlier approaches.

The researchers ran FlashProve using a single NVIDIA H100 GPU and 24 CPU cores.

In a batch containing 24 requests, online proof generation took approximately 223 seconds.

The reported throughput was around 110 tokens per second.

Each proof file was approximately 18.78 megabytes.

A verifier could check the proof using CPUs without requiring a GPU.

Verification took approximately 17 seconds using 24 CPU threads and around 21 seconds using a single thread.

These figures are significant because they demonstrate that a complex model computation can be verified without rerunning the model itself.

However, the throughput figure requires careful interpretation.

Proving 110 tokens per second does not mean that an ordinary chatbot can generate 110 words every second while simultaneously completing real-time cryptographic verification of its entire response.

The experiment used an input context of 1,024 tokens and verified one output token per request.

Multiple requests were processed together in batches.

It did not measure the real-time verification of long, fully generated chatbot responses.

Proof generation also required substantially more computation than ordinary model inference.

These qualifications are essential to understanding the actual achievement.

The Major Limitation: Proof Generation Requires 70 to 95 Times More GPU Time

FlashProve represents progress, but that does not mean it is ready for universal deployment.

The largest obstacle is cost.

Anthropic reported that generating proofs with FlashProve required approximately 70 to 95 times more GPU time than ordinary model inference.

The comparison was made against inference performed using vLLM.

However, the systems being compared used different numerical representations and execution environments.

The exact multiplier should therefore not be assumed to apply to every deployment configuration.

Nevertheless, the overall conclusion is clear.

Cryptographic proof generation currently introduces substantial additional computing costs.

For companies operating AI services, this matters enormously.

A platform handling millions of requests every day could face significant expenses if it were required to generate cryptographic proofs for every output.

In consumer chatbots, response speed and pricing are especially important.

Absorbing the current proof-generation costs across all conversations could be difficult.

But not every AI application requires the same level of verification.

Financial transactions, security audits, independent model evaluations, and regulatory compliance may provide stronger reasons to pay for cryptographic evidence.

As a result, early applications of FlashProve-like systems may focus on verifying selected high-risk operations or auditing samples of inference results after the fact.

That is an assessment of potential use cases based on the prototype's current capabilities and limitations, not an announced commercial deployment plan.

Why Did Anthropic Choose to Generate Proofs After Inference?

FlashProve does not generate every proof simultaneously with the model's original response.

Instead, the researchers selected a post-hoc proving approach.

After an output has been generated, the system recomputes the relevant inference operation and produces cryptographic evidence that the claimed result is valid.

This offers several advantages.

Proof-generation workloads can be collected and processed in batches.

Rather than handling every request separately, the system can improve efficiency by grouping work.

Certain operations involved in proving model computations may also be shared.

However, there are limitations.

Because a proof may be delivered after the original answer, verification is not necessarily immediate.

The computation must also be represented and reproduced in a form suitable for proving.

Numerical nondeterminism presents another challenge.

Commercial language models use different numerical operations and token-selection methods.

Even small numerical differences can affect which token is selected at a particular generation step.

Consequently, a computation verified in the research environment must correspond to the computation actually used by the production service.

Anthropic identified these issues among the significant limitations requiring further work.

How Did Claude Contribute to the Cryptographic Research?

One especially interesting aspect of the project was Claude's role.

Anthropic said Claude contributed to improving FlashProve's performance by working with existing research in cryptography and security and helping optimize technical approaches.

This means AI was used as a research tool to develop systems intended to improve the verifiability of AI.

However, the result should not be interpreted as Claude independently inventing a new cryptographic proof system from nothing.

The researchers emphasized that FlashProve builds on established cryptographic design principles and previous research.

Claude contributed to combining and optimizing those methods.

There is also an important distinction between an AI system making sophisticated optimization decisions and those decisions being secure and correct.

The researchers recognized that challenge.

Code and designs produced with AI assistance may achieve impressive performance while remaining difficult for humans to inspect.

Rather than simply trusting the resulting system, Anthropic introduced a separate process intended to establish important security properties mathematically.

That process involved Lean.

How Can Researchers Trust Cryptographic Code Developed with AI Assistance?

Lean is a formal verification tool used to express mathematical theorems and logical claims and check proofs of those claims mechanically.

Anthropic used Lean to formalize key security properties of FlashProve.

The researchers focused on completeness, soundness, and zero knowledge.

Completeness means that a correctly generated proof for a valid claim should pass verification.

Soundness means that producing a convincing proof for a false claim should be computationally infeasible under the system's assumptions.

Zero knowledge means that verification should not reveal secret information such as model weights.

Formally expressing these properties makes it possible to conduct stronger forms of examination than ordinary software testing alone.

However, formal verification does not automatically solve every security problem.

Anthropic acknowledged two important gaps.

First, humans must confirm that the formal mathematical statements accurately represent the security properties the researchers intended to establish.

Second, the actual software implementation must be checked to ensure that it behaves consistently with the formally verified protocol.

The team released both a verifier implemented in Lean and a faster verifier written in C++.

The Lean implementation provides formal assurance about the properties covered by the verification effort.

The faster C++ verifier does not automatically inherit the same formal guarantees.

Nor was the complete proof-generation implementation, including every aspect relevant to the secrecy of model weights, formally verified.

These distinctions matter.

Even when a cryptographic protocol is mathematically sound, vulnerabilities can still emerge if the software implementing it contains errors.

What Could Change If AI Model Provenance Becomes Verifiable?

If FlashProve becomes practical, it could support several applications.

One important area is independent AI model evaluation.

Organizations assessing AI models may find it difficult to verify exactly which model a service provider executes during a test.

If a provider claims to use a particular model during evaluation but later deploys a different one, the relevance of the evaluation results may change.

Cryptographic proofs could provide evidence that assessed outputs are consistent with a specified model's computations.

Another application is enterprise contract verification.

A company purchasing access to a particular AI model could potentially verify that its service provider actually used the model specified in the agreement.

Security is another possible application.

If an attacker compromises an inference server, replaces a model, or manipulates output tokens, the attacker may be unable to produce a valid proof matching the committed model and output.

Such failures could help reveal inconsistencies.

However, a valid proof does not establish that an AI response is accurate or safe.

The original model itself can generate incorrect answers.

FlashProve seeks to verify computational provenance and integrity, not the truthfulness of the content.

That distinction is essential.

Could Cryptographic Verification Become Part of AI Regulation?

Anthropic also discussed potential connections between provable inference and AI governance.

Consider a hypothetical regulation restricting the use of AI models above a particular risk threshold.

A service provider might claim that it uses only approved models.

But verifying that claim directly could require regulators to examine the systems actually running on the provider's servers.

Such inspection can be difficult for large-scale AI infrastructure.

Commercial model weights are also frequently kept private.

A technology such as FlashProve could potentially provide evidence that a specified approved model performed a particular inference without revealing its internal weights.

Similar ideas may be relevant to proposals intended to regulate the pace of AI development.

Some policy approaches have contemplated restricting the use of computing resources for training new large models while allowing those resources to support inference using existing models.

Verifying that a provider actually served a committed model could contribute to certain forms of compliance assessment.

However, FlashProve cannot prove the complete purpose of a company's GPU usage.

Anthropic explicitly acknowledged that proving a particular inference occurred does not establish that the same hardware was not used to train another model at a different time.

Regulatory applications must therefore define precisely what the cryptographic evidence proves and what remains outside its scope.

Could FlashProve Also Verify the Origin of AI-Generated Content?

The research is relevant to debates over transparency in AI-generated content.

Several approaches to AI content disclosure already exist.

One is to attach a label indicating that a text or image was generated using AI.

Another is to record information about a content file's creation and editing history.

But the presence of a label does not cryptographically prove that the content was generated by a specific AI model.

FlashProve could address part of this problem.

It aims to verify that a particular output corresponds to a computation performed by a previously committed model.

For example, if a company claims that a specific AI model performed a security assessment, a proof could potentially help establish that the designated model actually performed the relevant inference.

However, important limits remain.

Proving that an output came from a particular model does not establish that no human was involved in preparing or modifying the content.

If an AI-generated passage is subsequently edited or combined with other material, the original inference proof cannot by itself explain the complete production history of the final content.

Content provenance technologies and cryptographic model-inference verification therefore serve different purposes.

One aims to document how content was created and modified.

The other aims to verify that a particular computation was performed by a specified model.

Combining these approaches could eventually support stronger systems for verifying the origin and production history of AI-generated content.

FlashProve Cannot Yet Prove Every AI Answer

Anthropic described FlashProve as a research prototype, not a completed commercial product.

Its most important limitation is the scope of the computations it can verify.

The current system operates with contexts of up to 1,024 tokens.

That is limited compared with modern AI services capable of processing tens or hundreds of thousands of tokens.

The proof system is also tailored to specific model computations involving integer arithmetic and greedy decoding.

Commercial language models may use floating-point operations and various token-sampling methods.

These differences can cause inconsistencies between computations used in production and those supported by the proof system.

Another limitation is that FlashProve does not conceal the model architecture.

It protects model weights, but the underlying structural design of the model is not hidden.

The researchers also did not establish protection against every possible side channel, such as the potential disclosure of information through proof-generation timing.

Above all, proof generation remains computationally expensive.

The current results should therefore not be interpreted as evidence that all AI services can immediately offer real-time cryptographic verification for every response.

What the researchers demonstrated is a substantial improvement in the feasibility and performance of zero-knowledge proofs for large-model inference.

Practical deployment will require further progress in cost, numerical consistency, supported model architectures, and the range of computations that can be verified.

The Basis of Trust in AI Could Begin to Change

Until now, trust in AI services has largely centered on model performance and the reputation of the provider.

Users evaluate whether answers appear accurate.

They consult published benchmarks, company disclosures, and safety policies.

But as AI systems are delivered through increasingly complex networks of providers and intermediaries, new questions become important.

Which model actually generated this answer?

Was the model specified in the contract really used?

Was the output modified somewhere along the way?

How independently can an evaluation organization verify the claims made by a service provider?

FlashProve offers a potential technical response to some of these questions.

It makes it possible, within its supported conditions, to verify the provenance of a model computation without rerunning the entire model.

The ability to protect internal model weights is particularly important for commercial AI.

Companies want to safeguard their intellectual property.

Customers and regulators want to confirm which models are actually being used.

Zero-knowledge proofs may offer a way to address both concerns.

However, cryptographic verification alone does not complete the task of establishing trust.

A verified model can still produce a false answer.

Errors can also arise in external data sources, tools, or subsequent processing stages that fall outside the proven computation.

Reliable AI therefore requires more than model provenance verification.

Performance evaluation, safety testing, data protection, and operational controls remain necessary.

From Asking What AI Answered to Proving Which AI Answered

Anthropic's FlashProve research highlights an emerging challenge in the AI industry.

As AI systems become more capable, users increasingly rely on them for complex work.

Businesses purchase access to advanced models, connect AI through external platforms, and use the technology in important operational decisions.

But if customers cannot verify that the promised model was actually used, a new form of trust problem emerges.

Anthropic is exploring cryptographic proofs as a solution.

Its research demonstrated proof-generation throughput of approximately 110 tokens per second using a model containing 400 billion parameters.

Verification could be performed without possessing the complete model weights or using a high-performance GPU.

Claude contributed to optimizing the system, while the researchers used Lean to formally express and examine important security properties.

At the same time, the limitations remain substantial.

Proof generation required approximately 70 to 95 times the GPU time of ordinary inference.

Verification was demonstrated only under relatively short-context and specific computational conditions.

Considerable technical progress will be needed before the approach can be broadly deployed in commercial AI services.

Nevertheless, the research illustrates a meaningful change in direction.

Until now, AI users have generally had to trust a provider's claim about which model generated a response.

In the future, technologies may increasingly allow those claims to be checked against independently verifiable computational evidence.

This matters because AI is moving beyond everyday conversation into systems with significant economic and social consequences.

As AI becomes more deeply integrated into finance, cybersecurity, enterprise operations, and public services, verifying model performance alone may no longer be enough.

Organizations may also need evidence identifying which model actually ran and whether its computation was preserved without unauthorized alteration.

Trust in the AI era may no longer be established solely by the ability to generate a good answer. It may increasingly require evidence that the answer was generated by the model the provider promised to use.

FlashProve cannot yet prove every AI response.

But it represents a concrete attempt to turn claims made by AI service providers into evidence that external parties can verify.

The AI industry may be entering a new phase of competition.

One in which the question is no longer only what artificial intelligence said, but whether we can prove which AI actually said it.