Anthropic Can Now Suggest Which Model Answered

Gemini 4 Carbon scores 59 on Artificial Analysis' Intelligence Index V5¹. Claude Opus 5.5 scores 58². GPT-6 Astra (max) scores 57. Three frontier models sit inside a two-point band.

A band that tight makes silent swaps hard to catch. A cheaper model slipped in behind the same product name can still look fine to the customer. Anthropic said as much in its November 2, 2026 research post³: "Judging from the model's output alone is unreliable, even if it produces high-quality responses."

That post shipped FlashProve, an open-source prototype that proves a reply came from committed model weights without revealing them. On Llama 4 Maverick, a 400-billion-parameter⁴ model, Anthropic reports one H100 GPU proving about 110 tokens³ per second. Each 1,024-token request yields a proof of about 19 MB that verifies a single output token.

FlashProve ships under Apache 2.0, and its own repository calls it a research artifact that is not maintained. AICoder reports that proving costs roughly 70 to 95 times the GPU time of vLLM prompt-prefill processing⁵. No provider has publicly documented issuing FlashProve proofs in production. Even so, it shows how "trust us, it's Model X" could become a claim a buyer checks on an ordinary CPU.

Commit, prove, verify, and three identities

According to Anthropic's documentation, FlashProve works in three steps. First, the provider publishes a commitment, a short fingerprint that binds the service to one exact set of weights. Next, the GPU generates a proof that a specific reply came from those committed weights. Last, a customer or auditor checks the proof on a CPU and never receives the weights.

The engine underneath is a zkSNARK: a small cryptographic proof that a computation ran correctly, which reveals nothing about the private inputs. Anthropic built its version from hash functions and Merkle trees. No trusted hardware is involved. The authors include Roy Rinberg and Alex Allain of Anthropic. Their collaborators came from EPFL and StarkWare. Researchers at MIT and Succinct joined them.

Each fact in the release fits one of three kinds of identity. Cryptographic identity says this output matches commitment C. Commercial identity says commitment C is the model the contract promised. Behavioral identity says the model performs the way its product name implies.

FlashProve delivers the first kind. Anthropic's documentation says an accepted proof does not establish that the provider committed the advertised model, or that the response is complete. The space between a valid fingerprint and the brand on the invoice is the commitment gap. A provider could commit to a weakened or outdated model and honestly prove every reply against it.

The third kind is where the two-point Intelligence Index band bites. When models are that close on quality, behavior alone will never settle an identity dispute. A swap only becomes provable once the commitment is trusted, and that trust has to come from a contract.

Inside the proof pipeline, in dollars

Picture the commitment as a sealed recipe card filed with a notary. The kitchen never shows you the recipe. It hands you a receipt for each dish proving the dish matched the sealed card. Nobody checked whether the card on file is the recipe on the menu. In kitchen terms, that's the commitment gap.

Step one is the commitment. AICoder, citing FlashProve's performance page, reports about 39 minutes⁶ to commit a set of weights and about 270 GB of host memory for serving the public 4-bit files at batch size 24. Step two is proving, at Anthropic's reported 110 tokens³ per second on one H100. Step three is checking. AICoder reports the C++ verifier takes about 21 seconds⁵ on one CPU thread.

AI Weekly reports about 17 seconds⁷ on 24 threads, after a one-time commitment download that FlashProve's performance guide puts at 6.24 MB. So a buyer's laptop-class machine can handle the checking, while the GPU-heavy work stays with the provider.

The speed jump is real. AICoder reports the earlier VerInf system proved the same Maverick model at about 0.02 tokens³ per second. Per AICoder, the commercial Attestable system reached 53 to 77 tokens per second on the smaller Gemma 4 31B⁸. It has no open-source release.

The bill is where a builder should slow down. Say a request costs you one cent of GPU time to serve. At AICoder's 70 to 95 times⁵, proving that request costs 70 to 95 cents. Prove every request and your GPU spend for proving runs 70 to 95 times your serving spend.

Sampling fixes most of that. Prove 1 request in 100 and you add 70 to 95 cents for every 100 cents of serving⁵, which roughly doubles the GPU bill. Prove 1 in 1,000 and the extra drops to 7 to 9.5 percent. Storage adds up too: at 19 MB³ per proof, 1,000 proofs fill 19 GB.

The sources don't quite agree on the multiplier itself. i10x reads Anthropic's chart as 71.4 to 93.0 times for prefill and 20.1 times for decoding at 512 streams³. AI Weekly reports 72 to 94 times against a vLLM baseline. Our planning number is somewhere between 20 and 95, and we would budget for the high end.

The scope is narrow. Contexts top out near 1,024 tokens³. The prototype handles greedy decoding only, meaning the model always picks its single most likely next token. Anthropic's formal guarantees cover one commitment and one request per proof, with no batching. Real APIs batch heavily to keep costs down.

The trust stack also has two soft spots. AI Weekly notes the Lean formal proofs cover the protocol but leave the C++ verifier unproved. i10x reports that AI systems wrote the paper and code, and no independent human has reviewed them yet. We think the first serious buyers will be banks and model evaluators. They already pay for audits and only need proofs on disputed or sampled outputs.

Proof clauses may reach contracts by 2030

Speed is the clearest trend in FlashProve's numbers. Going from VerInf's 0.02 tokens³ per second to FlashProve's 110 is a 5,500x gain on the same 400-billion-parameter⁴ model. Mainstream use likely needs proving overhead to fall from 70 to 95 times toward a low single-digit multiplier⁵. Getting from 80 down to 5 is roughly a factor of 16.

Here's napkin math you can check. Start at 80 times. If overhead halves every year, it reads 40 in 2027, 20 in 2028, 10 in 2029 and 5 in 2030. The halving rate is our assumption. No source has measured a yearly pace.

At 5 times, proving 1 request in 10 adds about 50 percent to the GPU bill, which a premium enterprise tier could carry. Regulated buyers could then demand proof coverage as a standard clause, the way they already demand audit logs.

Buyers who move early get the better side of the trade. A sampled proof program at 1 in 1,000 costs 7 to 9.5 percent extra today. A silent swap on a premium endpoint means paying top-tier rates for a cheaper model on every single call. A small, known cost buys protection against a large, invisible one.

For labs, published commitments work as counterpositioning. A provider that routes quietly to protect margins can't easily match a rival that publishes commitments, because matching would expose its routing. Whether any lab, Anthropic included, will offer proof-backed endpoints soon is unclear. No production deployment is public as of November 2026.

The case against deserves weight. Buyers mostly care about accuracy and latency, and an outcome-based SLA might serve them better than frozen weights. A green check on a vaguely labeled commitment also invites false confidence. The likely middle ground is flexible routing for most traffic, with proofs reserved for disputed requests.

Set up a model-drift canary log

The cheapest model-identity check runs on your own API logs. A canary prompt is a fixed test question you rerun on a schedule to catch silent changes. With 20 canaries run daily, that is 600 calls a month, and you will see drift before your users do.

Step one: write 20 canary prompts from your real workload. Keep each prompt plus reply under 1,024 tokens³, so the set fits FlashProve's current limit if a vendor ever offers proofs. Include a few prompts where today's model has a known quirk or failure, because quirks shift first.

Step two: run them once a day at temperature 0. Temperature 0 approximates greedy decoding, the same mode FlashProve proves. Log the model name the API returns, a hash of each reply, latency and token counts.

Step three: compare each day against the past week. GPU floating-point math and batching can shift a temperature-0 reply even when the model stays the same. Set an alert for days when a quarter or more of your canaries change at once.

Step four: when the alert fires, read latency and token counts next to the diffs. A faster model giving shorter answers under an unchanged name is the pattern worth escalating. Send your vendor the dated log, the changed replies and the model field they returned.

Step five: bring two clauses to your next renewal. The first reads "Every response must be generated by model commitment X." The second reads "Fallback models must be disclosed and separately identified." Your canary log is the evidence that makes either clause worth the negotiation.

Step six: clone FlashProve from Anthropic's GitHub and read guide/performance.md before quoting it to a vendor. FlashProve v0.16.0's performance guide lists about 270 GB⁵ of host memory for serving, per AICoder, so most teams will stop at reading. Some canaries will break for boring reasons. Each false alarm shows you what normal drift looks like on your stack, which is exactly the baseline a proof clause will need.

Practise it step by step: Keep Your Judgment Sharp