Anthropic releases FlashProve, an open prototype that cryptographically proves which model weights produced a response

On November 2, 2026, Anthropic's Frontier Red Team released FlashProve, an open-source research prototype that attacks a question usually left to trust: when a router serves a big model and a strong answer comes back, was it really the model you paid for?

The team argues that the answer itself cannot tell you. Instead, FlashProve works at the serving layer: for each response, the service generates a cryptographic proof that the reply came from a particular set of committed model weights. A verifier can check that proof with a tool called cp_verify on an ordinary CPU, without ever touching the weights. That release then surfaced through tech press. On November 4, 2026, Techmeme reported that Anthropic had released the prototype to cryptographically verify that an AI response came from a given model rather than one swapped in by a router. The report credited Roy Rinberg and Alex Allain from Anthropic, with Alessandro Chiesa from EPFL and StarkWare, Miranda Christ from MIT and RESI, Rahul Dalal, and other researchers from EPFL and MIT. Later the same day, MarkTechPost described FlashProve as an Apache 2.0 zkSNARK prototype that proves a reply came from committed weights without revealing those weights. In the described setup, it verifies Llama 4 Maverick at 110 tokens per second on one H100, with proofs of 19 MB. On November 4, 2026, a DEV Community piece by xgabriel presented the same release from the verifier's side. It said the serving party generates a proof for every reply, that the verifier can validate it with cp_verify on a standard CPU, and that the entire process avoids direct access to the weights. The author also gave a sharper cost picture: the current demo runs only on Llama 4 Maverick with 400B parameters, and proof generation takes 70-95 times the GPU time of vLLM. Those accounts agree on the core design but differ in emphasis. Techmeme frames FlashProve mainly as protection against router substitution. MarkTechPost specifies the license, the zkSNARK framing, and the headline throughput and proof size. DEV Community adds the 400B parameter scale and the very large compute overhead relative to vLLM. The project remains a research prototype, with the published performance numbers tied to a single-model demo, and no further updates are described in these reports.