Anthropic Unveils FlashProve to Verify AI Model Outputs Without Revealing Weights
Anthropic's open-source research prototype uses cryptographic proofs to show which model produced a response.
Published
Last updated / Fact-checked on
Anthropic has released FlashProve, an open-source research prototype that lets users check that an AI response came from a specific committed model without seeing its weights. Anthropic says one H100 generates proofs at about 110 tokens per second on a 400B-parameter model.
Photo: Steve Buissinne / Pixabay
FlashProve at a glance
| What | Open-source provable-inference prototype (zkSNARK) |
| Test model | Llama 4 Maverick, 400B MoE, 4-bit |
| Proving speed | ~110 tokens/sec on one H100 |
| Proof size | ~19 MB per 1,024-token request |
| Verification | ~17 sec on a 24-thread CPU, no GPU |
| Overhead | ~70-95x vLLM GPU time |
| License | Apache 2.0 |
In a November 2 research post titled "Progress on provable inference for large language models," Anthropic's Frontier Red Team described the system as a research prototype built around a cryptographic technique called a zero-knowledge succinct argument of knowledge, or zkSNARK.
According to Anthropic, FlashProve could help detect unauthorized model substitutions, identify tampered outputs and provide evidence that providers are serving approved models.
The research involved collaborators affiliated with EPFL, StarkWare, MIT and Succinct.
How FlashProve Verifies AI Responses
FlashProve operates through two phases, according to Anthropic.
First, a model provider publishes a cryptographic commitment representing a specific set of model weights. The commitment acts as a fingerprint without exposing the weights themselves.
During inference verification, the provider generates a proof demonstrating that the committed model produced the specified output for a given input.
A verifier can check the proof using the commitment, prompt and response without possessing the model weights or running the original model.
Anthropic says the system provides cryptographic guarantees covering completeness, soundness and zero knowledge.
The company also credits Claude with producing improvements to the zkSNARK techniques used in FlashProve.
To make those improvements auditable, Anthropic used Lean, a formal verification language, to express and prove mathematical security properties.
Anthropic released the research under the Apache 2.0 license, including its blog post, technical report, protocol description, prover implementation, fast C++ verifier, formally verified Lean verifier and Lean proofs.
Performance on a 400-Billion-Parameter Model
Anthropic evaluated FlashProve using Meta's Llama 4 Maverick, a mixture-of-experts model containing approximately 400 billion parameters, with roughly 17 billion active for each token.
The experiments used publicly available 4-bit quantized weights.
According to Anthropic's benchmark results, a server equipped with one NVIDIA H100 GPU and 24 CPU cores generated proofs at approximately 110 tokens per second.
Each proof measured 18.78 MB for a 1,024-token request.
Verification required approximately 17 seconds using 24 CPU threads or 21 seconds using a single thread. No GPU was necessary for verification.
The initial commitment phase took approximately 39 minutes per model.
However, generating proofs remains computationally expensive. Anthropic measured GPU-time overhead roughly 70 to 95 times greater than ordinary inference using vLLM.
Anthropic reports that VerInf demonstrated approximately 0.02 tokens per second when proving the same Llama 4 Maverick model.
Commercial developer Attestable reports 53 to 77 tokens per second on a dense 31-billion-parameter model, although Anthropic notes that Attestable had not released a corresponding open-source library.
Potential Applications and Remaining Limitations
Anthropic identifies several potential applications for provable inference, including verifying that third-party AI routers deliver the requested models and detecting unauthorized changes to inference servers.
Nevertheless, Anthropic explicitly cautions that FlashProve remains a research prototype, not a completed product.
Its fast C++ implementation has no formal guarantee of matching the Lean specification, although Anthropic says the two verifiers agreed across its tests.
The system proves computations using an exact integer model under greedy decoding. Outputs generated through floating-point inference or sampling may not match those proofs.
FlashProve also hides model weights but not model architecture. Potential side-channel attacks fall outside its security guarantees, and supported contexts are limited to 1,024 tokens.
Anthropic separately clarified that its September 30 prototype milestone was satisfied through another project that signs inference traffic and recomputes outputs on a trusted server.
What to watch
- Longer contexts. Whether FlashProve moves past its 1,024-token limit.
- Architecture hiding. Anthropic lists hiding model architecture as future work.
- Outside audits. Independent review of the Lean statements and the C++ code.
- Adoption. Whether providers or routers attach proofs to real traffic.
More coverage is on our Artificial Intelligence hub.
How we reported this
Everything here comes from Anthropic's research post; performance figures are Anthropic's own and were not independently measured. Comparisons with VerInf and Attestable use different setups.
Published and fact-checked November 3, 2026.
Sources
- Anthropic Frontier Red Team, "Progress on provable inference for large language models," Nov. 2, 2026: https://www.anthropic.com/research/provable-inference
DailyMech used AI tools to help research and draft this article; it was fact-checked by our editors.