FlashProve: Anthropic proves which model gave the answer

On November 2, Anthropic’s Frontier Red Team published FlashProve, an open prototype of provable inference. With it, a model provider can cryptographically prove that a specific response came from a specific, previously committed set of weights, without revealing the weights themselves. The code is on GitHub under the Apache 2.0 license.

What problem does FlashProve solve?

When we query a model through an API, we have no way to check that the answer really came from the model we are paying for. The authors give the example of a middleman service that quietly swaps the model “for cost reasons”, and of a provider that could serve a cheaper or degraded version and forge the logs.

FlashProve’s answer is a zkSNARK, a short zero-knowledge proof. It works in two steps:

1. Once per model, the provider publishes a commitment to the weights: a short “fingerprint” that binds it to one set of weights without giving them away.
2. For every request, the server generates a proof that the committed model produced those exact tokens. Anyone can check that proof on an ordinary CPU, with no access to the weights.

The proof has a few properties: an honest proof always passes, a forged one is practically impossible to produce, the weights and intermediate values stay hidden, and the proof itself is small and cheap to check.

How fast is FlashProve?

This is where it gets interesting. The team demonstrated it on the full Llama 4 Maverick, a MoE (mixture-of-experts) model with 400B parameters, about 17B of them active per token, with 4-bit weights. According to the post:

1. The prover needs one H100 and 24 CPU cores, and streams the weights from about 290 GB of host memory.
2. The setup phase takes about 39 minutes and runs once per model.
3. A batch of 24 requests takes about 223 seconds, or about 110 tokens per second, and a single proof weighs 18.78 MB.
4. Verifying a proof takes 17 seconds on 24 threads (21 seconds on one), with no GPU.

The overhead is still large: proving takes about 72 times longer than vLLM takes to process the same 24 requests (66-77x depending on the run). For comparison, the authors cite earlier open work that reached fractions of a token per second or ran on GPT-2-scale models.

Where does Claude fit in?

In the research itself. According to the authors, Claude developed the zkSNARK improvements for inference and wrote the protocol specification. The team notes, however, that Claude “often makes decisions that are hard to evaluate”, so the security properties were written down and proved in Lean. The repository includes, among other things, the prover, a fast C++ verifier and a second, formally verified verifier in Lean, and according to the authors the two agree on every proof tested. I wrote about how Claude handles formal proofs in the post on formal verification of 123 open-source libraries.

The authors include researchers from Anthropic, EPFL, MIT, StarkWare and Succinct.

What should you keep in mind?

First, this is a research prototype. The post says nothing about using FlashProve for Claude models or in Anthropic’s production, and the repository is marked as unmaintained and does not accept contributions.

Second, the limitations the authors list themselves. The proof covers an integer version of the weights and greedy decoding, so sampled responses may differ. Context is limited to 1024 tokens, the model architecture is not hidden, and the design assumes a MoE model. There are also no formal guarantees for the fast executable code.

Third, latency. FlashProve proves after inference, in batches, so you do not get the proof together with the response.

What could it be used for?

The authors list, among others, detecting compromised servers or swapped models, confirming which model wrote a given text, and making sure only approved models are served. One intriguing idea is “Proof-of-Failure”: a proof that a provider spent at least a certain number of tokens of a specific model and did not reach a result, for example that the model found no bugs in a patch after at least 1M tokens.

It is a different approach from the Claude watermark, which marks text statistically and needs a secret key for detection. FlashProve gives a mathematical proof that anyone can check. Next, the team plans to hide architecture details and extend the 1024-token limit to the full context window.

FAQ

What is FlashProve?

It is Anthropic’s open prototype for provable inference: a cryptographic proof system (zkSNARK) that lets you check that a response was generated by a specific, committed model, without revealing its weights.

Does FlashProve work with Claude?

Anthropic’s post does not mention it. The team tested it on the open Llama 4 Maverick, and the project itself is a research prototype.

Can I verify a FlashProve proof myself?

Yes. According to the README, you can run verification of a sample proof on Linux with g++ 13, in under 2 GB of RAM, with no GPU. Generating proofs for the full model requires an 80 GB H100 and several hundred GB of RAM.

What license is FlashProve under?

Apache 2.0. The model weights are not included; you need to download them from Hugging Face under the Llama 4 license.