Anthropic’s FlashProve gives customers a way to check which model answered. A provider publishes a fingerprint of its model’s learned numbers, then supplies a mathematical proof tying checked tokens to that model. Customers can verify it without downloading the model.

The research account explains both the mechanism and its substantial costs:

  • The headline speed needs its denominator. The authors report about 110 processed prompt tokens per second on one H100 graphics card. Each 1,024-token request in that experiment checks one token.
  • Proofs remain expensive. A batch of 24 requests takes about 223 seconds, with an 18.78 MB proof per request. Checking one takes 17 seconds on 24 CPU threads.
  • The comparison costs 70–95 times ordinary inference’s GPU time. The baseline uses vLLM, model-serving software, with a different numerical format on eight H100s.
  • Exact checks cover a restricted model. The prototype checks an integer model’s highest-scoring token choices within 1,024-token contexts. Randomly sampled answers or floating-point calculations can diverge.

The authors use Lean, a machine-checked proof language, to make their security claims inspectable. The fast C++ verifier has no formal guarantee of matching that specification. This remains a research prototype with a gap between the mathematical protocol and its executable implementation.

What the thread adds

The 76-comment thread on Hacker News asks what this guarantee buys, and who pays to check it:

  • ajb — separates model identity from other protections: “It’s not telling you that your data hasn’t been exfiltrated, and it’s not telling you any useful property of the answer.”
  • velcrovan — pushes back on calling identity “table stakes”: “there no existing mechanism by which those users could verify it is or isn’t happening.” They argue this addresses a real customer complaint.
  • nemo1618 / IanCal — dispute the economics of rerunning an open-weight model. IanCal asks, “Is it cheaper to rerun it?” Their point is the client’s cost of verification, rather than the provider’s total compute bill.
  • vessenes — raises an integration question about hidden provider instructions: “I haven’t read this newest scheme closely enough to determine if they have a way to hide parts of the prompt with the proof.” This is a question, not a demonstrated failure.

Handles are pseudonymous; HN publishes no per-comment scores. The sample comes from HN’s ranking order and is a slice of the thread, not a consensus.