Summary
Anthropic released FlashProve, an open-source research prototype that lets a verifier check a cryptographic proof linking an AI response to a committed set of model weights. In tests on a 4-bit Llama 4 Maverick model, proof generation reached 110 tokens per second on one H100 GPU.
Anthropic released FlashProve on Nov. 2, 2026, an open-source research prototype for checking whether an AI response came from a particular set of model weights. It uses a cryptographic proof so a verifier can check the claim without access to those weights or the computing resources needed to run the model. In tests on a 4-bit version of Meta’s 400-billion-parameter Llama 4 Maverick, Anthropic reports proof generation at 110 tokens per second on a single H100 GPU.
The aim is to address a basic trust problem: a user receiving text from an AI service generally cannot tell from the response alone whether the requested model produced it, or whether a routing service or compromised server substituted something else. Anthropic presents provable inference as a possible way for customers and independent evaluators to check model identity.
How FlashProve links a response to a model
FlashProve uses a type of cryptographic system called a zero-knowledge succinct argument, or zkSNARK. In general terms, this lets one party provide a compact proof that a computation was carried out correctly, while concealing information beyond what the proof’s claim reveals.
The provider first publishes a commitment to its model weights: a compact fingerprint that fixes which exact weights are being used without disclosing them. For a request, the provider then produces a proof tied to that commitment, the prompt and the output token. A verifier can check the proof using the commitment, prompt and response, without possessing the weights or rerunning the model. The proof is designed to reveal neither the weights nor intermediate computation details; it does not hide the model’s architecture.
Anthropic has also released executable code, a protocol specification, Lean formalizations and proofs, and a visualizer for the Lean theorems. The code, Lean proofs and documentation are released under the Apache 2.0 licence. The top-level security properties are formalized in Lean, a proof assistant used to make mathematical statements machine-checkable. Anthropic notes that the formal statements still need human review, and that the fast C++ verifier is not formally guaranteed to match the Lean implementation.
Performance and the prototype’s boundaries
The evaluation used publicly available 4-bit weights for Llama 4 Maverick, a mixture-of-experts model with 400 billion parameters and about 17 billion used per token. The prover ran on one H100 GPU and 24 CPU cores. For a batch of 24 requests, its online phase took about 223 seconds, or 110 tokens per second. Each proof was 18.78 MB. A verifier needed no GPU: checking a proof took 17 seconds on 24 CPU threads, or 21 seconds on one thread. The verifier also downloads a model commitment of about 6.5 MB. Creating that commitment took about 39 minutes and, for technical reasons, must be repeated after about 16 million requests.
These results come with substantial compute overhead. In Anthropic’s comparison, proving a batch of 24 requests took about 72 times longer per GPU than processing the same batch with vLLM, with results ranging from 66 to 77 times across runs. The ratio reached about 94 times at the highest vLLM load tested. FlashProve is therefore a research prototype for adding verifiability, not a drop-in way to make ordinary inference faster.
The proof is for an integer version of the model under greedy decoding, which selects the highest-probability next token. Outputs from floating-point inference or sampled decoding can differ from that computation. The current system also handles contexts of up to 1,024 tokens and is designed for mixture-of-experts models. It proves responses after they have been generated in batches, rather than inline as they are produced, so verification is delayed. Anthropic describes the release as intermediate research progress and invites further work on the system.