Anthropic released FlashProve, a proof that a reply came from a named model

For the first time a user can ask an AI vendor to prove which model answered them. Anthropic released FlashProve on 2 November. It is an open-source system that lets a vendor produce a short cryptographic proof with each reply. The user can check that proof on a laptop. The model weights stay secret.

Anthropic frames the problem in plain words. A user cannot check that a reply came from the model the vendor named, the research post says. A vendor can swap in a cheaper model to save money. A vendor can also claim a reply came from a stronger model than it did. Nothing in the API tells the user which happened.

How the proof works

The vendor first publishes a commitment, a short string that binds to one set of weights. The weights themselves are not published. For each reply, the GPU produces a short proof that the reply matches the committed weights. The proof is a type of zero-knowledge argument called a zkSNARK. A verifier program then checks the proof on a CPU, without needing the weights.

The numbers Anthropic reports

Anthropic ran FlashProve on Llama 4 Maverick, a 400 billion-parameter mixture-of-experts model. The model uses about 17 billion parameters per token. One NVIDIA H100 GPU with 80 GB of memory produces 110 tokens per second this way. The proof for a 1,024-token reply is about 19 MB. Checking the proof takes 17 seconds on 24 CPU threads, or 21 seconds on one thread. Proving a batch of 24 requests takes about 72 times longer than the same batch on vLLM. The cost rises to about 94 times longer when vLLM is under its highest load.

What it cannot do yet

Anthropic is direct about the limits. FlashProve proves inference for integer-valued models under greedy decoding only. It does not formally prove the fast GPU code, only the Lean 4 verifier that checks the proofs. The model architecture is public, so only the weights stay secret. Context is capped at 1,024 tokens, far short of what a working agent needs. Side-channel attacks on the proving hardware are not covered. The post calls itself "intermediate progress, and not a completed research agenda."

The authors are Roy Rinberg and Alex Allain at Anthropic. They worked with Alessandro Chiesa at EPFL and StarkWare and Miranda Christ at MIT and RESI. Giacomo Fenzi and Guy Weissenberg at EPFL also contributed. Rahul Dalal joined from the Anthropic STEM Fellows Program and Succinct. Ben Mayer joined from the Anthropic Fellows Program and MIT. The code is on GitHub under Apache 2.0 at anthropics/FlashProve.

A buyer does not need every reply proved. A buyer needs a way to spot-check that the vendor served the model named in the contract. FlashProve is slow and narrow in what it can prove. It is the first system that makes that spot check possible without handing over the weights. Model identity used to be a trust question. It is now at least a research question with running code.

Source

• Progress on provable inference for large language models, Anthropic
• anthropics/FlashProve, GitHub