Anthropic open-sources FlashProve to prove which AI model wrote a reply

Anthropic has released FlashProve, an open-source research prototype that generates cryptographic proofs that a response came from a specific AI model. The company says it does this without revealing the model’s weights. Unite.AI dates the release to November 2, 2026. The headline cost is significant. On a 400-billion-parameter model, Anthropic reports that proving takes about 70-95x the GPU time of simply running the model on vLLM, a common open-source inference library.

Anthropic presents the work as intermediate progress, not a finished system. It says it is sharing the work so that others can examine it, take it and improve it.

The problem FlashProve targets: who actually wrote this reply?

Anthropic frames the gap this way. A user querying a model cannot check that a response came from the model the developer claims is answering. A routing service could secretly substitute a cheaper model, or an attacker could tamper with the token stream. Judging from output quality alone is unreliable. Anthropic also notes that checking a response by rerunning the model is not an option for most users. Frontier weights are usually private, and running the model takes far more computing power than a typical user or evaluator has.

The company names three groups who would benefit from proof of origin:

• Independent evaluators, who test models before and after release and need to know the model they evaluate is the one being served.
• Customers of third-party routing services, who want assurance that the tokens came from the model they paid for.
• Users facing a tampered token stream, who today have no way to detect an attacker posing as a given model.

Anthropic calls the goal “provable inference” (PI). The aim is to let a user with limited computing resources, and no knowledge of the weights, verify that a response came from the requested model. The company also links PI to regulation. It says such proofs could help providers show they meet commitments and legal obligations, and could contribute to verifying compliance with AI pacing requirements, meaning limits on how fast frontier AI development proceeds.

How FlashProve proves a response without exposing weights

FlashProve is built on a zkSNARK, short for zero-knowledge succinct argument of knowledge. This is a kind of cryptographic proof that is small, quick to check, and reveals nothing beyond the fact being proved. Anthropic says this type of proof is uniquely suited to provable inference because of its strong hiding and efficiency properties. Unite.AI notes that the design is software-only and does not depend on trusted hardware.

The flow has two stages, as Unite.AI describes it:

1. Commitment (offline). The provider publishes a short commitment that identifies one exact set of weights while keeping them secret.
2. Proof (per response). For completed prompt-and-response pairs, the system produces a proof that the output tokens are the committed model’s output. Anyone holding the commitment, the prompt and the reply can check the proof without access to the weights.

The intended properties are completeness, soundness, zero knowledge and succinctness. In plain terms, honest proofs are accepted, faking a proof should require breaking widely believed cryptographic assumptions, and checking a proof reveals neither the weights nor intermediate values. The design also hides which mixture-of-experts subnetworks ran for each token. Anthropic says hiding the model’s architecture is not a goal; only the weights are hidden.

The implementation uses the mixture-of-experts structure of its test model, Meta’s Llama 4 Maverick. According to Unite.AI, prover work scales with the roughly 17 billion parameters active for each token rather than all 400 billion, while still hiding the expert choices. Weights are streamed in segments from host memory, so the prover fits on one 80 GB GPU with about 290 GB of host memory alongside it.

FlashProve speed and cost, in Anthropic’s own tests

All performance numbers below come from Anthropic’s evaluation. They have not been independently reproduced in the sources available. Anthropic says the system is substantially faster than prior open-source systems, and that those earlier systems are orders of magnitude slower.

Measure	Reported figure
Test model	Llama 4 Maverick, 400B-parameter mixture of experts, 4-bit quantized weights
Proving throughput	Around 110 tokens/second on a single H100 GPU
Proof size	About 19 MB per 1,024-token request (18.78 MB in the batch test)
Batch test	24 requests proved in about 223 seconds on one H100 with 24 CPU cores
Offline commitment step	About 39 minutes
Commitment download for verifier	About 6.5 MB
Verification time (CPU only)	17 seconds with 24 threads; 21 seconds with one thread
Overhead vs. vLLM	About 70-95x the GPU time

The overhead range comes from a specific comparison. Unite.AI reports that, against FP8 inference on eight H100s running vLLM, proving took about 72x as much per-GPU time for the same batch, and about 94x as much at the highest vLLM load tested. Anthropic’s throughput figure also depends on 4-bit weights and integer arithmetic during prefill, the phase in which the model reads the prompt.

The asymmetry is the main design point. Proving is heavy and needs a GPU, while checking runs on a CPU in under half a minute in Anthropic’s tests. Anthropic’s stated ideal for a provable-inference system is a short proof of a few megabytes that a user can verify in seconds on a CPU.

What Anthropic released, and under what licence

Anthropic lists five artifacts in the release:

• A blog post outlining the system and its possible uses.
• A technical report with the system’s details.
• A protocol description.
• Executable code: a prover and two verifiers, one fast verifier in C++ and one provably correct verifier in Lean, a formal verification language.
• Lean proofs of the top-level mathematical statements, plus an interactive visualizer of the Lean theorems to help with auditing.

The code, Lean proofs and documentation are released under the Apache 2.0 licence. Builders should not expect an actively maintained project, however. Unite.AI reports that the repository labels version 0.16.0 as an unmaintained research artifact that does not accept contributions.

The research team includes Anthropic researchers Roy Rinberg and Alex Allain, along with collaborators from EPFL, StarkWare, MIT and Succinct, some of them through Anthropic’s fellows programs.

Claude built much of it, and Lean proofs act as the check

Anthropic says Claude produced the improvements to zkSNARKs for inference. According to the company, Claude found new ways to apply existing tools from the cryptography and security literature while following well-established design principles for proof systems. Anthropic is also open about the risk this creates. It says Claude “is good at optimization, but often makes decisions that are hard to evaluate, especially in large complex systems.” Its answer is to state the claimed security guarantees as top-level statements in Lean that humans can audit.

Unite.AI reports that the project’s known-limits documentation says AI systems working under human direction wrote nearly all of the software, Lean proofs and documentation, and also ran the reported tests. The Lean work covers completeness, soundness and zero knowledge in the random-oracle model, a standard idealized assumption in cryptography. Two caveats apply. First, the formal statements still need manual review to confirm they express the intended guarantees. Second, only the slower Lean verifier is formally connected to the soundness theorem. The fast C++ verifier, meant for routine use, carries no formal guarantee and was instead tested for agreement with the Lean verifier.

The same review gap appears in an earlier Claude project. In September, Superpower Daily reported that Claude had generated a Lean 4 formalization of Fermat’s Last Theorem. In that case, software could confirm that the encoded statements follow from one another, but could not establish that each lemma’s name and description match the mathematics it claims to express. FlashProve’s guarantees face a similar question: machine-checked proofs still depend on people confirming that the theorems say what they are meant to say.

Limits and open questions for builders

The restrictions are substantial. According to Unite.AI’s reading of the release:

• No independent security audit has been done, and testing of weight hiding and of adversarial proofs remains limited.
• Exact integer weights and greedy decoding only. Greedy decoding means always picking the most likely next token. Floating-point inference or sampled decoding, which most production APIs use, can depart from the computation being proved.
• 1,024-token contexts. Longer prompts and responses are not covered.
• Side channels are out of scope. Timing and similar attacks fall outside the guarantee.
• Post-hoc proving. Proving after the fact adds recomputation, delays assurance and introduces non-determinism compared with proving alongside inference.
• Generic error testing does not cover adversarially designed prompts.

There is also a limit on the compliance use case. An inference certificate could attest that requests were served by a claimed model, but it would not show that the same hardware was not also training another model. That limits what such certificates can demonstrate about rules based on how computing capacity is used.

For developers, the practical picture is clear. FlashProve is not something to put in front of production traffic today. A 70-95x GPU overhead, greedy-only decoding and short contexts rule that out. Its value is as a reference design. It shows that a large mixture-of-experts model can be bound to a hidden-weights commitment, and that a client without a GPU can check the binding in seconds. Teams building routers, evaluation harnesses or multi-provider gateways may want to follow it, since provenance of model output is exactly the gap Anthropic describes. Unicorn API has also covered a different approach to output provenance: text watermarking, both by Anthropic and by xAI.

What to watch next for provable inference

Unite.AI identifies where the remaining work lies: lowering proving cost, supporting less restrictive decoding and longer contexts, and connecting the fast implementation more firmly to the formal protocol. Signals worth tracking:

• Independent security audits, and outside attempts to reproduce Anthropic’s throughput and overhead figures.
• Forks or follow-up systems that support sampled decoding or longer contexts, since the official repository does not accept contributions.
• Whether any provider, router or evaluator adopts proofs of inference for real traffic. Anthropic lists customer integrity checks, independent evaluations, regulatory tools and enforcement of approved-model requirements as possible uses.
• Human review of the Lean statements, the step Anthropic relies on to check Claude’s design decisions.