Anthropic has published FlashProve, an open-source research prototype that lets an AI provider prove, cryptographically, that a particular answer came from a particular model. The research post, dated November 2 and credited to Anthropic's Frontier Red Team with collaborators from EPFL, MIT, StarkWare and Succinct, ships with code, a protocol specification, a technical report and formal proofs written in the Lean proof assistant, all under the Apache 2.0 license.
Why it matters: today, when you call an API or use a chatbot, you mostly take the provider's word for which model answered. TechCrunch notes the obvious failure modes — a provider quietly swapping in a cheaper model to save money, or a stronger one to make benchmark results look better. FlashProve is designed so that even the lab running the model cannot fake the proof, and the weights stay secret, which is what would make it usable for closed commercial models.
How it works
Anthropic describes two phases:
- Offline, once per model: the provider publishes a short commitment to its weights — effectively a fingerprint. Anthropic says this takes about 39 minutes and the commitment covers about 16 million requests. A verifying client downloads about 6.5 MB of commitment data.
- Online, per request: the provider generates a proof that the committed model, given this prompt, produces these output tokens. Proofs are made after the fact, in batches, from completed responses.
The proofs are a zkSNARK (a zero-knowledge succinct argument): a checker learns that the claim is true but nothing about the weights or intermediate values. The model's architecture is not hidden.
The numbers
All figures are Anthropic's, measured on Meta's open Llama 4 Maverick (a 400B-parameter mixture-of-experts model with about 17B active parameters per token, at 4-bit precision):
| Metric | Anthropic's figure |
|---|---|
| Prover hardware | 1× H100 GPU + 24 CPU cores |
| Prover throughput | ~110 tokens/second |
| Proof size | ~18.78 MB per proof |
| Verification time | ~17 s on 24 threads, ~21 s on one thread |
| One-time setup | ~39 minutes per model |
| Overhead vs. vLLM serving (per GPU) | ~72x (66–77x across runs); ~94x at vLLM's highest tested load |
The trick that makes this tractable, per Anthropic, is that proving work scales with the roughly 17B parameters a mixture-of-experts model actually uses per token rather than all 400B.
For comparison, Anthropic cites earlier systems: zkLLM at about 2.5 tokens/second on a 13B model, DeepProve at 2.9 tokens/second for GPT-2, and VerInf at 14.3 hours for 1,000 tokens on the same Maverick model. Anthropic also mentions Attestable, which reports 53–77 tokens/second on a dense 31B model but has not released an open-source library. These are reported numbers from different setups, not a like-for-like benchmark.
What it doesn't do yet
Anthropic is unusually blunt about the gaps. Its own list includes:
- Proofs cover an integer version of the model under greedy decoding. Real deployments that use floating-point math or sample tokens may produce outputs that can't be proven.
- Contexts are capped at 1,024 tokens.
- The design assumes a mixture-of-experts model and doesn't hide the architecture.
- Side channels such as timing are out of scope.
- The fast C++ verifier has no formal guarantee; only the slower Lean verifier does, and nothing yet guarantees the executable code matches the formal protocol.
The post calls itself "intermediate progress, and not a completed research agenda." TechCrunch reports no plans to deploy FlashProve at Anthropic or any other lab. Anthropic also says the safety-roadmap goal this work was aimed at was met by a separate, non-cryptographic project that signs inference traffic and recomputes it on a trusted server.
What a 70–95x overhead means in practice
Proving every request would multiply serving costs many times over, so the realistic near-term use is selective: auditors or customers spot-checking a sample of responses, or proving only disputed ones. Data Studios, working from Anthropic's figures, estimates that proving 10,000 requests a day of 1,024 tokens each would need roughly one H100 running continuously — that is its own back-of-the-envelope estimate, not Anthropic's.
Who should care
- API buyers and resellers' customers: this is the first open, single-GPU path to checking that "Model X" really is Model X. It won't help you this month, but it is what to ask providers about.
- Regulators and auditors: Anthropic explicitly pitches provable inference as a tool for checking which model was used for a task.
- Researchers: the code, Lean proofs and spec are public at github.com/anthropics/FlashProve. Running it needs a single 80 GB GPU, plus Llama 4 Maverick weights obtained separately from Hugging Face under Meta's license.
What to watch: whether any provider — Anthropic included — commits to publishing weight commitments for production models, and whether the 1,024-token and greedy-decoding limits fall in the next version.
