Anthropic’s FlashProve Uses Cryptography to Prove Which Model Replied

Anyone using an AI model today has to take the provider’s word that the model they chose actually wrote the answer. Anthropic’s Frontier Red Team has released FlashProve, an open-source research prototype that attaches a cryptographic proof to each response, showing it came from one specific, committed set of model weights without revealing those weights.

The work, published on 2 November and announced by @AnthropicAI on X, is less a product than a feasibility test. Anthropic says the point is that this kind of zero-knowledge proof, long seen as far too slow for large language models, now costs roughly two orders of magnitude more than plain inference rather than many more. The company stresses that the post is “meant to share intermediate progress, and not a completed research agenda.”

What FlashProve proves, and what it keeps hidden

FlashProve is built on a zkSNARK, a type of cryptographic proof that is small, quick to check and reveals nothing beyond the claim being proved. In an offline step the provider publishes a commitment, a short fingerprint pinning down one exact set of weights. Afterwards, for any prompt and reply, it can produce a proof that the committed model generates exactly those tokens. Anyone holding the commitment, prompt and reply can check it without the weights and without a GPU.

Anthropic is explicit that the proofs hide the weights only. The model’s architecture is not hidden.

The release includes a technical report, a protocol specification written by Claude, a prover, a fast C++ verifier, a slower verifier written in the Lean proof language, and Lean proofs of the top-level security properties, all under the Apache 2.0 licence. The authors include researchers from Anthropic, EPFL, StarkWare, MIT and Succinct. Anthropic says Claude produced the improvements to the proof system, with the Lean statements there so humans can audit what the model built.

The numbers on Llama 4 Maverick

Anthropic measured FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model that uses about 17 billion parameters per token, with publicly available 4-bit weights. It is not running on Claude, and nothing in the release says it is used in production.

• Proving: about 110 tokens per second on a server with one H100 GPU and 24 CPU cores, with an 18.78 MB proof per 1,024-token request.
• Commitment: a one-off offline step of about 39 minutes per model, producing a commitment of about 6.5 MB.
• Checking: 17 seconds on 24 threads, or 21 seconds on a single thread, with no GPU needed.
• Cost: about 70-95x the GPU time of running the same model on vLLM, a common open-source inference library. The typical figure was 72x (66 to 77 across runs), rising to about 94x at the highest load tested.

For comparison, Anthropic cites earlier work, VerInf, which proved the same model at about 0.02 tokens per second: 14.3 hours for 1,000 tokens, with a 93.6 GB proof.

The limits Anthropic lists

Anthropic calls FlashProve a research prototype and sets out its limits. It handles contexts of only up to 1,024 tokens, far shorter than real chat sessions. It proves an integer version of the model under greedy decoding, so a floating-point or sampled reply could diverge from what was proved. It only supports mixture-of-experts models. Side-channel attacks, such as timing how long a proof takes, are out of scope. And there is no formal guarantee for the fast C++ code that people would use day to day; the formal proofs cover the Lean side.

Proof of origin could become a compliance tool

The most interesting part of the release is not the speed but the list of uses Anthropic sketches. A routing service quietly swapping in a cheaper model, an attacker tampering with a token stream, or a regulator wanting assurance that only approved models are being served are all problems of origin. Today they are answered by contracts and trust. A proof that anyone can check on a laptop changes that into something closer to an audit trail.

That matters for regulation. Rules on AI increasingly assume that someone can show which model did what, and UK regulators have already said existing law applies to AI agents. Verifiable inference would give firms evidence rather than assertions. It also complements the inside-the-model monitoring that labs are building, such as OpenAI’s activation probes and Anthropic’s own work showing agents slipping data past its monitor: those check behaviour, whereas FlashProve checks identity.

The caveats keep this in the lab for now. A 70-95x cost is far too high to prove every token at scale, which is why the design proves batches after the fact. A 1,024-token cap rules out most real conversations. And the gap between the formally proved Lean code and the fast C++ code is exactly where cryptographic bugs tend to live. Zero-knowledge systems for general computing, such as Microsoft Research’s Magnetar zkVM, face the same audit question.

Anthropic also notes that its own Frontier Safety Roadmap goal of a provable-inference prototype by 30 September was met through a separate project that signs its inference traffic, and that on 19 October it renamed the goal “inference verification”. The open question is whether outside researchers take the code and push context length and cost down far enough to test it on a model people use daily.

Sources

• Anthropic: Progress on provable inference for large language models (2 November 2026)
• @AnthropicAI on X (3 November 2026)

Related stories

• Microsoft Research Unveils Magnetar, a Zero-Knowledge Virtual Machine That Proves Programs Ran Correctly Using Only Standard Hash Functions
• Claude Agents Slipped Misaligning Data Past Anthropic’s Own Monitor