News · Infrastructure · News
Anthropic releases FlashProve to prove which model answered
Anthropic's Frontier Red Team has released FlashProve, an open-source research prototype for provable inference. FlashProve is a zkSNARK system that proves a reply came from a committed model. The proof reveals nothing about the model weights. On Llama 4 Maverick, a 400B mixture-of-experts model, it proves about 110 tokens per second on one H100. That is far slower than normal inference, but the goal is not speed. The goal is evidence.
Today you do not actually know which model answered your API call. A routing service could swap in a cheaper model. An attacker could tamper with the token stream. FlashProve gives a mathematical guarantee that a specific model produced the response, while keeping the model weights private. It is a research prototype, not a product, and Anthropic has no plans to deploy it.
In one line: Anthropic has released FlashProve, an open-source zkSNARK prototype that creates cryptographic proof that a response came from a specific committed model without exposing the model weights.
What provable inference solves
When a user queries a model, output quality alone is not a reliable way to tell which model answered. Anthropic lists four use cases for FlashProve:
- Regulators could confirm hardware serves inference, supporting AI pacing rules.
- Labs could detect tampered inference servers.
- Users could verify text provenance.
- Regulators could enforce serving of approved models only.
TechCrunch adds another angle. A lab could secretly swap in a cheaper model to cut costs, or a more expensive model to inflate performance results. A developer might claim a library was scanned by a frontier cybersecurity model, and a user would have no way to check. FlashProve is designed to let labs publish a fingerprint of a model that can be matched to specific outputs and verified cryptographically. The fingerprint does not reveal the weights.
How FlashProve works
FlashProve has a prover (the model provider) and a verifier (the user). It runs in two phases. In an offline phase, the provider publishes a commitment. This is a short fingerprint binding one exact set of weights. It takes about 39 minutes and covers about 16 million requests. In the online phase, for each request the GPU produces a proof that the committed model produced those tokens.
The proof system compiles an interactive oracle proof into a cryptographic proof using hash functions. Anthropic says this offers post-quantum security and is in the same family used by validity-proof L2 networks such as Starknet.
Three engineering choices drive the speed. Prover work scales with the roughly 17B active parameters, not all 400B. Requests are proved in batches after the fact, like prefill. Weights stream from host memory, so a single 80 GB GPU suffices. The prover needs one H100 80 GB, 24 CPU cores and about 290 GB host RAM. The verifier runs on a CPU with no GPU.
This is not the first infrastructure prototype Anthropic has open-sourced. Earlier they released sandbox-runtime for OS-level agent sandboxing with a similar goal of giving teams stronger guarantees around AI systems.
Benchmarks and limits
Anthropic measured the public 4-bit Maverick weights on one H100 with 24 CPU cores. The numbers from the repo performance guide:
- Batch of 24: 111.23 tokens per second, about 221 to 226 seconds per batch.
- Batch of 1: 17.41 tokens per second. Batch of 64: 123.31 tokens per second, flagged as unreliable on 80 GB cards.
- Proof size: 18.78 MB. The client downloads about 6.5 MB once per commitment.
- Verification: 17 seconds on 24 threads, 21 seconds on one thread.
Against vLLM running FP8 Maverick on 8 H100s, proving costs about 72 times the GPU time per batch. At vLLM's highest tested load, the gap is about 94 times.
Context is capped at 1,024 tokens per request. FlashProve currently supports MoE models and greedy decoding only. The proof system has been formalized in Lean. It proves completeness, soundness and zero knowledge. The README states a cheating provider is caught except with probability about q divided by 2 to the power 124 plus 2 to the power minus 101. Two verifiers ship: a fast C++ one for daily use and a slower Lean verifier with a formal guarantee.
What this means for client delivery
For teams like mine that ship RAG chatbots and agentic coding workflows, FlashProve addresses a real gap: proving which model actually produced an answer. Clients in regulated sectors sometimes ask how we know the model did not change between evaluation and production. Today the answer is process and logging, not cryptography. A proof would be stronger.
But FlashProve is not ready for that. The 1,024 token context cap rules out most long document retrieval tasks. The cost is high, 70 to 95 times normal GPU time. Anthropic says it is intermediate progress, not a completed research agenda.
Two things I would watch. First, the commitment model. A provider can publish one commitment and then prove many requests against it. That fits how a small team with a proxy could publish a commitment for an internal model and verify each call. I wrote about giving 19 developers AI access through one proxy, and a future version of this could add an audit trail for which model served each request. Second, the verification cost. Verification on a CPU in 17 seconds is slow for interactive use but fine for offline audits.
For now, the practical guardrail for a chatbot's output quality remains evaluation, not cryptographic proof. My 21-case test for shipping a RAG chatbot still matters more for correctness. FlashProve proves the model was the one you selected, not that the answer is right.
Quick answers
What is Anthropic FlashProve?
FlashProve is Anthropic's open-source zkSNARK research prototype for provable inference. It proves that a model's response came from a specific committed set of weights without revealing those weights. Anthropic has no plans to deploy it.
How fast is FlashProve?
On Llama 4 Maverick (400B mixture-of-experts) with one H100, FlashProve proves about 110 tokens per second in a batch. Proofs are 18.78 MB and verify on a CPU in 17 seconds. Proving costs about 70 to 95 times the GPU time of plain vLLM inference.
Does FlashProve reveal model weights?
No. FlashProve publishes a commitment fingerprint of a model's weights. The proof shows the committed model produced the response, but it reveals nothing about the weights. Labs can publish fingerprints without exposing their most valuable asset.