Anthropic open-sources FlashProve, a cryptographic tool to verify which model answered
Anthropic published FlashProve on November 2, 2026, an open-source research prototype built by its Frontier Red Team with researchers from EPFL, MIT and StarkWare. It attaches a cryptographic proof to a model's reply so a recipient can confirm that a specific committed set of weights produced it, without the weights being disclosed. The system uses a zkSNARK in a software-only design rather than trusted hardware. Anthropic describes the release as intermediate progress, not a finished research program, and invites outside researchers to inspect and extend it.
The test case was Meta's Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, run from a third-party 4-bit conversion on Hugging Face. The model weights are not included in the release. On a single H100 GPU, proof generation reaches about 110 tokens per second, and each proof is about 19 MB. A standard CPU verifies a proof in roughly 17 to 21 seconds. The overhead is steep: proving takes about 70 to 95 times the GPU time of serving the same model with vLLM. In a comparison with FP8 inference on eight H100s, Anthropic measured about 72 times the per-GPU time for the same batch and about 94 times at the highest load tested.
The repository, licensed under Apache 2.0, includes a prover, a fast C++ verifier, a slower Lean verifier, a protocol specification and Lean proofs of top-level claims. The limits are real. Contexts are capped at 1,024 tokens, and floating-point or sampled decoding can depart from the computation being proved. The scheme confirms computation, not whether an answer is accurate, safe or unbiased.
Why it matters
For teams that resell or route model access, buyers currently have to trust that the model they paid for is the one that answered. A router could substitute a cheaper model, or someone with access to the inference server could alter the token stream while the reply still reads as competent. Verifiable serving could become a product feature and a procurement line item, where vendors supply proof artifacts instead of assurances.
For operators and investors, cost is the binding constraint. At 70 to 95 times normal GPU time, the approach is a research demonstration rather than a serving option for high-volume traffic, so early value sits in audits, evaluations and high-stakes verification. Anyone pitching verified inference should show a credible path to lower overhead. Teams that depend on third-party inference providers can start writing verification requirements into contracts now, before proof tooling matures.
Key points
- 1FlashProve was published November 2, 2026 as an open-source research prototype under the Apache 2.0 license.
- 2Proof generation for Llama 4 Maverick reaches about 110 tokens per second on a single H100 GPU.
- 3Proving costs roughly 70 to 95 times the GPU time of serving the same model without proofs on vLLM.
- 4Each proof is about 19 MB, and a standard CPU verifies one in roughly 17 to 21 seconds.
- 5
