Anthropic open-sources FlashProve to prove which AI model wrote a reply
Anthropic has released FlashProve, an open-source research prototype that produces cryptographic proofs showing that a specific large language model generated a specific response to a specific prompt. The work was published on November 2, 2026 by the company's Frontier Red Team under the title "Progress on provable inference for large language models", together with a technical report, a protocol description, a prover, two verifiers and formal proofs written in the Lean theorem prover. Everything is released under the Apache 2.0 license in the anthropics/FlashProve repository.
The system is a zero-knowledge succinct argument, usually shortened to zkSNARK. A model provider first publishes a short commitment to its model weights without revealing them. For each later request, the provider can then generate a proof that the committed model, run on the given prompt, produces the given output tokens. Anyone holding the commitment, the prompt and the reply can check that proof without access to the weights, and the proof reveals nothing about the weights, the intermediate activations or which experts of a mixture-of-experts model were activated.
Anthropic tested FlashProve on Meta's Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with roughly 17 billion parameters active per token, using its public 4-bit weights. On a single NVIDIA H100 GPU the prover reached about 110 tokens per second, proving a batch of 24 requests in about 223 seconds. The price of that guarantee is compute: proving took roughly 72 times the per-GPU time that the vLLM inference engine needed to serve the same 24 requests, and about 94 times at the highest load Anthropic tested.
··········
WHAT ANTHROPIC'S FLASHPROVE PROVES ABOUT AN LLM RESPONSE.
Users of a chatbot or an API today have no technical way to confirm which model actually answered them. A provider can silently swap in a cheaper model, a routing service can send traffic to a different backend than the one a customer selected, and an attacker with access to a server can alter the token stream before it reaches the user. Anthropic's post frames FlashProve as a response to that gap and lists the groups that would benefit from verification: independent evaluators who test models before and after release, customers who reach a model through a third-party router, and regulators who want evidence of which models a provider is serving.
The post organizes the problem around four challenges. The first, which Anthropic calls pacing, concerns regulators who want to confirm that a provider's hardware is serving inference rather than quietly training a new model. The second is tamper detection: a compromised server or a substituted model would have to produce valid proofs for the expected weights, which it cannot do. The third is text provenance, meaning a way for a user to check that the stated model was really run on a given input so that logs cannot be fabricated. The fourth is model approval, where a regulator wants assurance that only approved models are being served, since each proof ties a request to the committed weights.
FlashProve works in two phases. In the offline phase, which runs once per model and took about 39 minutes for Llama 4 Maverick, the prover builds the weight commitment. A client downloads about 6.5 MB of commitment data in total, and one commitment is good for about 16 million requests before the provider must commit again. In the online phase the prover works after the fact, taking completed text in batches and producing proofs that can be checked by anyone. The underlying construction is an interactive oracle proof compiled into a hash-based argument, which the authors say gives post-quantum security.
··········
FLASHPROVE BENCHMARK RESULTS ON LLAMA 4 MAVERICK.
The figures below are the ones Anthropic reports for its open-source evaluation. The quantized model occupies about 232 GB, yet the prover fits on one 80 GB GPU because it streams weights from roughly 290 GB of host memory.
........
Metric | Reported value |
Model | Llama 4 Maverick, 400B MoE, 4-bit public weights |
Hardware | 1 NVIDIA H100 (80 GB), ~290 GB host memory, 24 CPU cores |
Proving throughput | ~110 tokens per second |
Batch of 24 requests | ~223 seconds |
Request window | up to 1,024 tokens |
Proof size | 18.78 MB |
One-time setup per model | ~39 minutes |
Commitment download | ~6.5 MB, valid for ~16 million requests |
Overhead vs. vLLM (FP8, 8 H100s) | ~72x per GPU at batch 24, ~94x at highest load |
Verification time | ~17 s on 24 threads, ~21 s on one thread |
........
The throughput and batch figures are internally consistent. Twenty-four requests with a 1,024-token window add up to 24,576 tokens, and proving them in 223 seconds works out to about 110 tokens per second. The overhead figure needs a careful reading: Anthropic compared FlashProve on one H100 against vLLM running the FP8 release of the same model on eight H100s, and expressed the result per GPU. The 72x ratio applies to a batch of 24 requests, with runs ranging from 66x to 77x, while the 94x figure was measured when vLLM ran at the highest load in Anthropic's tests and therefore used its GPUs more efficiently.
··········
HOW FLASHPROVE COMPARES WITH EARLIER ZKML SYSTEMS.
Zero-knowledge proofs for machine learning, often called zkML, have existed for several years, but earlier systems were orders of magnitude too slow for frontier-scale models. Anthropic's post places FlashProve against several of them using figures each project published. The comparison is not like-for-like, since the models, quantization schemes and hardware differ, and the table should be read as a rough indication of scale.
........
System | Model tested | Hardware | Reported speed |
FlashProve (Anthropic) | Llama 4 Maverick, 400B MoE | 1 H100 | ~110 tokens/s |
Attestable | Gemma 4 31B (dense) | 1 H100 | 53-77 tokens/s |
zkLLM | 13B model | 1 A100 | ~2.5 tokens/s |
DeepProve | GPT-2 / Gemma 3 | 1 machine | ~2.9 / ~1.4 tokens/s |
VerInf | Llama 4 Maverick | DGX Spark | 14.3 hours per 1,000 tokens (~0.02 tokens/s) |
........
The most direct comparison is with VerInf, which was also run on Llama 4 Maverick. At 14.3 hours for 1,000 tokens it proves about 0.019 tokens per second, which puts FlashProve several thousand times ahead on throughput, although on different hardware. Attestable reports speeds in the same range as FlashProve on a dense 31-billion-parameter model, and Anthropic points out that Attestable has not released open-source code, while FlashProve ships its prover, its verifiers and its formal proofs.
··········
[[ADPLUS_300x250_1]]
WHAT FLASHPROVE COSTS IN GPU TIME: A WORKLOAD EXAMPLE.
Anthropic publishes throughput and overhead rather than a dollar price, so the clearest way to read the numbers is in GPU-hours. The calculation below uses only the reported 110 tokens per second on one H100 and the reported 72x and 94x overhead ratios, applied to a hypothetical service that answers 10,000 requests a day, each using the full 1,024-token window.
........
Item | Calculation | Result |
Tokens proved per day | 10,000 x 1,024 | 10.24 million |
Proving time | 10.24M / 110 tokens per second | ~25.9 H100-hours per day |
GPUs needed for proving | 25.9 / 24 hours | ~1.1 H100s running continuously |
Proving cost per 1M tokens | 1M / 110 / 3,600 | ~2.53 H100-hours |
Serving cost per 1M tokens at 72x | 2.53 / 72 | ~0.035 H100-hours |
Serving cost per 1M tokens at 94x | 2.53 / 94 | ~0.027 H100-hours |
Lifetime of one weight commitment | 16M requests / 10,000 per day | ~1,600 days |
........
For a service of that size, adding proofs for every request would require roughly one extra H100 running around the clock, on top of a serving fleet that spends a small fraction of an H100-hour per million tokens. Because FlashProve proves text after it has been generated, a provider could also prove a sample of requests, or only those that a customer or auditor asks about, which would cut the cost in proportion. Anthropic's post does not prescribe a sampling policy, and that choice would decide whether proofs work as a spot-check or as a guarantee for every response.
··········
WHO CAN USE FLASHPROVE TODAY AND WHAT IT MEANS FOR CLAUDE USERS.
FlashProve is a research release, and Anthropic says so plainly: the post describes it as a prototype meant to share intermediate progress, and the authors say they hope others will take the code and improve it. There is no statement that Anthropic runs FlashProve on Claude or plans to offer proofs to Claude.ai or Claude API customers. The published evaluation uses Llama 4 Maverick because its weights are public, which lets outside researchers reproduce the results; readers who want background on that model can see our comparison of Llama 4 Scout, Maverick and Behemoth.
Researchers and infrastructure teams who want to experiment need the code from the anthropics/FlashProve repository, the Llama 4 Maverick weights downloaded separately from Hugging Face under Meta's Llama 4 license, a single 80 GB GPU such as an H100, about 290 GB of host memory and a multi-core CPU. The release includes a prover, a fast C++ verifier, a verifier in Lean, Lean proofs of the top-level security statements and an interactive visualizer intended to help auditors read those statements.
The practical audience is therefore narrow for now: model hosts and inference platforms that want to offer verifiable serving, evaluation organizations, auditors, and teams that buy model access through routers and want evidence of what they are paying for. Serving integrity has become a live concern in recent months, as shown by incidents such as the Cloudflare Workers AI KV cache exposure affecting GLM 5.3 responses, where data from other customers' requests leaked into 155 responses.
··········
FLASHPROVE, ANTHROPIC'S ROADMAP AND THE ROLE OF CLAUDE.
The project connects to a commitment in Anthropic's Frontier Safety Roadmap to develop a prototype of provable inference by September 30, 2026. The post says Anthropic met that goal through a separate but related project, which signs inference traffic and recomputes inference on a trusted server, and presents FlashProve as a different method aimed at the same objective. A footnote dated October 19, 2026 adds that Anthropic now uses the term "inference verification" for this area rather than "provable inference".
The authors are Roy Rinberg and Alex Allain of Anthropic, Alessandro Chiesa of EPFL and StarkWare, Giacomo Fenzi and Guy Weissenberg of EPFL, and Ben Mayer of the Anthropic Fellows Program and MIT. Anthropic writes that Claude contributed to the engineering, producing improvements to zkSNARKs for inference and finding new ways to apply existing cryptographic tools. The team also observed that Claude's optimizations were sometimes hard to evaluate, and gave that as a reason for stating the top-level security properties in Lean, where completeness, soundness and zero-knowledge are proven in the random oracle model and can be audited by people.
··········
FLASHPROVE LIMITATIONS STATED BY ANTHROPIC.
The authors list several limits that matter for anyone considering the prototype. A proof covers an integer version of the model and asserts that each checked token is that model's greedy choice, so outputs produced with floating-point arithmetic or with sampling may diverge from what can be proven, and adversarially designed prompts are not specifically addressed. The system currently handles contexts of up to 1,024 tokens, far shorter than the context windows of production chat models.
The proofs hide the weights but not the architecture, and the current design assumes a mixture-of-experts model. Side-channel attacks such as timing analysis are declared out of scope for this release. On assurance, the fast C++ verifier has no formal guarantee, although it agreed with the Lean verifier on every test, and the authors note two remaining trust gaps: the Lean statements must be audited by hand, and nothing yet guarantees that the executable code matches the formal protocol. The post also leaves one point ambiguous, describing each proof as checking one token while elsewhere referring to one proof per request, so the exact proof granularity should be read from the technical report.
··········
ANTHROPIC FLASHPROVE: CONFIRMED FACTS AND OPEN QUESTIONS.
The verified facts are the release itself, its Apache 2.0 license, its contents and the benchmark figures Anthropic reports on Llama 4 Maverick: about 110 tokens per second on one H100, 18.78 MB proofs, 17-second verification on 24 threads, a 39-minute one-time setup and an overhead of roughly 72x to 94x compared with vLLM serving. Those numbers move zero-knowledge proofs of inference from the scale of small models into the range of a 400-billion-parameter mixture-of-experts model on a single GPU.
What remains open is whether the approach can reach production conditions. The 1,024-token context limit, the restriction to greedy decoding of an integer model and the absence of formal guarantees for the fast verifier all separate the prototype from a service that could attest every chatbot reply. Anthropic has not said whether it will apply the technique to Claude, and its own roadmap goal was met with a different design based on signed traffic and trusted recomputation. For now, FlashProve gives researchers, auditors and model hosts a public, reproducible baseline for measuring how much verifiable inference costs, and that cost stands at roughly two orders of magnitude more GPU time than serving the same text.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
