Anthropic has released FlashProve, an open-source research prototype that lets anyone cryptographically verify that an AI response came from a specific model, without seeing that model's weights. Running on Meta's 400-billion-parameter Llama 4 Maverick, the system generates proofs at about 110 tokens per second on a single Nvidia H100 GPU.
The technique is called provable inference. A model provider first publishes a short commitment, effectively a fingerprint of the weights, that keeps the weights themselves hidden. For each request, the provider then produces a proof that the committed model generates the given output from the given prompt, and anyone holding the commitment, the prompt and the reply can check it.
Anthropic's Frontier Red Team, which published the work, frames it around trust in model serving. Provable inference would let a user confirm that a routing service has not quietly substituted a different model, detect tampering by attackers, and give auditors a way to check compliance claims. It could also stop a provider from swapping in a cheaper model to cut costs, or a stronger one to inflate benchmark results.
Key facts
- 01Anthropic's Frontier Red Team released FlashProve, an Apache 2.0 provable-inference prototype, on GitHub.
- 02On the 400B-parameter Llama 4 Maverick, it proves about 110 tokens per second on a single H100 GPU.
- 03Proving costs about 70 to 95 times the GPU time of serving on vLLM; verification takes about 17 seconds on CPU.
- 04Each proof covers a 1,024-token window at about 19 MB; a 39-minute setup covers roughly 16 million requests.
- 05Collaborators come from EPFL, StarkWare, MIT and Succinct; no lab has plans to deploy it yet.
FlashProve is built on a zkSNARK, a succinct zero-knowledge proof. Anthropic compiles an interactive oracle proof into a hash-based proof, which the authors say offers post-quantum security, and proves inference after the fact in batches rather than inline with generation. The proofs reveal nothing about the weights or intermediate values, though the model architecture is not hidden.
Speed is the main advance over earlier open systems. Anthropic cites zkLLM at about 2.5 tokens per second on a 13B model and VerInf at about 0.02 tokens per second on Llama 4 Maverick. FlashProve's proving overhead runs about 70 to 95 times the GPU time of serving the same model on vLLM, measured at roughly 72x for a batch of 24 requests and about 94x at the highest load tested.
Verification is light. Checking a proof takes about 17 seconds on 24 CPU threads, or 21 seconds on one, plus about 6.5 MB of commitment data. Each proof covers a 1,024-token window and weighs about 19 MB, and the one-time offline setup takes about 39 minutes per model and covers roughly 16 million requests.
Anthropic also used the Lean proof assistant to formally prove the protocol's completeness, soundness and zero-knowledge properties. The authors caution that only the Lean protocol and proofs are formally verified, not the fast executable code, and that human audits of the formal statements are still needed.
The authors list other limits. The proof covers an exact integer version of the weights under greedy decoding, so sampled or floating-point outputs could diverge. The 1,024-token context is far shorter than typical chat sessions, the design assumes a mixture-of-experts architecture, and side-channel attacks such as timing are out of scope.
The project is a collaboration between Anthropic researchers including Roy Rinberg and Alex Allain and academics including Alessandro Chiesa of EPFL and StarkWare and Miranda Christ of MIT. The code, Lean proofs and a protocol specification are on GitHub under the Apache 2.0 license; model weights must be downloaded separately under Meta's Llama 4 license.
Anthropic described the release as intermediate progress rather than a completed research agenda, and there are no current plans to deploy FlashProve at Anthropic or any other lab. The work traces to a commitment in Anthropic's Frontier Safety Roadmap to develop a provable inference prototype by September 30, 2026.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
