When you query an AI model, you have almost no way to know that the answer actually came from the model you asked for. A routing service could quietly substitute a cheaper model, an evaluator could be served a different system than the one released, or an attacker could tamper with the token stream, and from the output alone you would never know. On November 2, Anthropic released FlashProve, an open-source research prototype that answers this problem with cryptography.

FlashProve uses a zero-knowledge succinct argument of knowledge, or zkSNARK, to prove that a response was produced by a specific set of model weights, without revealing those weights. “Today, we release FlashProve: an open-source performant prototype for provable inference,” the company wrote in its research announcement.

How provable inference works

The system has two phases. In an offline phase, the model provider publishes a cryptographic commitment, a short fingerprint that pins down one exact set of weights while keeping them secret. Then, for completed prompt-and-response pairs, the provider generates a proof that the output tokens came from the committed model. Anyone holding the commitment, the prompt, and the reply can check the proof without ever seeing the weights.

The design targets four properties: completeness (honest proofs are accepted), soundness (faking a proof requires breaking hard cryptographic assumptions), zero knowledge (the proof reveals nothing about the weights), and succinctness (verification is far cheaper than re-running the model). The proof also hides which mixture-of-experts subnetworks ran for each token, though the model’s architecture itself remains visible.

Quote from Anthropic's FlashProve research announcement

The numbers

For the demonstration, Anthropic proved inference for Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model in 4-bit quantization. On a single H100 GPU, the prover generated proofs at around 110 tokens per second, with each proof about 19 MB per 1,024-token request. That is roughly 70 to 95 times the GPU time of running the model itself with vLLM, an open-source serving library, an overhead Anthropic is explicit about.

Verification is cheap by design: the client downloads a roughly 6.5 MB commitment and checks proofs on an ordinary CPU, taking about 17 seconds with 24 threads and 21 seconds on a single thread. The prover’s work scales with the parameters actually active per token, around 17 billion for Maverick’s experts, rather than the full 400 billion.

Why Anthropic built it

The company frames provable inference as part of the trust infrastructure for an AI economy. Independent evaluators need to know they tested the model actually being served. Customers routing requests through third parties want assurance they got the model they paid for. And regulators may one day require providers to serve only approved models, a rule that cryptographic certificates could help enforce. Anthropic also links the work to pacing AI development: certificates could verify that hardware is serving inference rather than secretly training a new model.

The release includes five artifacts: the blog post, a technical report, a protocol specification, executable code (a prover plus a fast C++ verifier and a provably correct Lean verifier), and machine-checked Lean proofs of the top-level security claims with an interactive visualizer, all under the Apache 2.0 license.

Limits and caveats

Anthropic is candid about what FlashProve does not do. It cannot prove that the same hardware was not also training another model on the side. The Lean proofs cover the top-level mathematics but do not formally guarantee that the fast executable code matches the Lean implementation. And the security analysis treats the BLAKE2 compression function as an ideal random function, an assumption the technical report flags. The system is a research prototype, labeled by Anthropic as intermediate progress meant for others to improve.

Key FlashProve performance figures from Anthropic's evaluation

Sources