Anthropic Releases FlashProve, an Open-Source Prototype to Prove Which Model Produced a Response
On November 2, Anthropic released FlashProve, an Apache 2.0-licensed prototype that generates cryptographic proofs (zkSNARKs) certifying that a response indeed originates from a specific model, without revealing its weights. Tested on Llama 4 Maverick, it remains 70 to 95 times more expensive than standard inference.
Anthropic released FlashProve on November 2, 2026, an open-source prototype addressing a deceptively simple question: when querying an AI model, how can you be sure that it was indeed the one that responded? The system produces, for every response, a cryptographic proof that it originates from a specific model, without revealing its weights. Code, formal proofs, and a technical report are published under an Apache 2.0 license.
The Problem: You Don’t Know Which Model Is Responding
Today, users have no way to verify that a response comes from the advertised model. Anthropic highlights several scenarios: a routing service quietly swapping an expensive model for a cheaper alternative, an attacker altering the token stream on a compromised server, or an independent evaluator needing to confirm that the evaluated model is genuinely the one being served. The post also points to regulatory use cases: proving to a regulator that a provider only serves approved models, or verifying that its hardware is genuinely running inference.
How FlashProve Works
The approach operates in two stages. First, the provider publishes a commitment to its weights—a short fingerprint that fixes a specific set of weights without disclosing it. Then, for a given request, it produces a proof asserting that “the committed model produces these output tokens.” Anyone with the commitment, prompt, and response can verify it without access to the weights and without heavy hardware.
The underlying technique is a zkSNARK, a family of zero-knowledge proofs already employed across various blockchains. The proof discloses neither the weights, nor the intermediate computations, nor the experts activated at each layer. However, the model’s architecture is not concealed.
Reported Figures
| Metric (Llama 4 Maverick, 400B parameters, 4-bit) | Value published by Anthropic |
|---|---|
| Proof generation speed (1 H100 GPU) | approximately 110 tokens/s |
| Proof size (1,024-token request) | approximately 19 MB |
| CPU verification (24 execution threads) | approximately 17 s |
| Overhead compared to vLLM | approximately 70x to 95x GPU time |
Anthropic compares these results to earlier work: according to its blog post, the only prior proof of this same model known to the team, VerInf, required 14.3 hours for 1,000 tokens, generating a 93.6 GB proof. The system leverages the mixture-of-experts design: proving effort scales with the roughly 17 billion active parameters per token, rather than the full 400 billion.
Claude as Coauthor, Lean as Safeguard
Anthropic notes that Claude generated improvements to zkSNARKs for inference. To offset optimization decisions that are difficult to evaluate in a complex system, the security properties (completeness, soundness, zero-knowledge) are formulated and proved in Lean, a formal verification language. The repository includes a fast C++ verifier alongside a slower, yet formally proven, verifier in Lean.
Recognized Limitations
Anthropic presents FlashProve as a research prototype, and the GitHub repository is marked as “unmaintained.” The documented limitations are clear: context length is restricted to 1,024 tokens, proofs cover an integer version of the model using greedy decoding (sampled responses or floating-point calculations may diverge), the architecture remains exposed, side-channel attacks fall out of scope, and there is no formal guarantee that the fast code strictly matches the protocol verified in Lean. The post also notes that Anthropic had previously achieved its inference verification prototype objective through an alternative method, which signs traffic and recomputes inference on a trusted server.
Our take
FlashProve changes nothing for Claude users today: it is demonstrated on an open-weight model from Meta, with an extremely short context window and an overhead spanning roughly two orders of magnitude. Its value lies elsewhere. It proves that cryptographically certifying that a response originated from a 400-billion-parameter model is now feasible on a single GPU, rather than requiring hours of computation per output. This is a foundational building block for highly practical concerns: establishing trust in API resellers who might silently swap models, hardening inference server security, and ultimately enabling regulatory oversight of deployed models. It remains to be seen whether other AI labs will adopt this approach, and whether providers will agree to publish commitments to their proprietary weights.
Sources
- Anthropic — Progress on provable inference for large language models (November 2, 2026) Primary source
- GitHub — anthropics/FlashProve (code, Lean proofs, Apache 2.0 license) Primary source
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
