Anthropic · 2026-11-02 · major
FlashProve — Anthropic's open-source proof of which model wrote a reply
FlashProve is an Anthropic research prototype that proves a reply came from a committed model without revealing its weights. It ran Llama 4 Maverick on one H100 at 110 tokens per second, and a CPU checks each proof in about 17 seconds.
A zero-knowledge proof that the model you asked for is the model that answered, checked on a normal CPU.
Key specs
| Proving speed | 110 tok/s on 1 H100 |
|---|---|
| Verify time | ~17 s on a CPU |
Quick facts
| Maker | Anthropic Frontier Red Team, with EPFL, MIT, StarkWare and Succinct co-authors |
|---|---|
| License | Apache-2.0 |
| Model tested | Llama 4 Maverick (400B MoE, 4-bit weights) |
| Proof size | About 19 MB per 1,024-token request |
| Overhead | About 70–95x the GPU time of vLLM inference |
| Context limit | 1,024 tokens |
| Status | Research prototype, not maintained |
What is it?
Anthropic released FlashProve on 2 November: open-source code that lets an AI provider prove a reply came from one committed set of model weights, while keeping those weights hidden. A provider publishes a commitment once; for every reply it then produces a proof that anyone can check. Anthropic calls the release intermediate progress, and the GitHub repository is labelled not maintained.
How does it work?
FlashProve is a zkSNARK built from an interactive oracle proof and compiled into a hash-based proof, which the post says gives post-quantum security. Its completeness, soundness and zero-knowledge properties are machine-checked in Lean 4. The one-time commitment phase took about 39 minutes for Llama 4 Maverick and covers about 16 million requests; after that a single H100 proves replies at 110 tokens per second, and the `cp_verify` tool checks a proof in about 17 seconds on 24 CPU threads.
Why does it matter?
Users today cannot tell whether a router or provider quietly swapped in a cheaper model, or whether an attacker changed the token stream. A checkable proof per reply closes that gap, and Anthropic says such proofs could also help verify compliance with AI rules. The cost is still high: proving takes about 70 to 95 times the GPU time of normal inference, covers only greedy decoding of an integer model, and stops at 1,024 tokens of context.
Who is it for?
AI security researchers, model providers and auditors
Frequently asked questions
- Can FlashProve be used with Claude today?
- No. Anthropic's FlashProve demonstration uses Llama 4 Maverick with public 4-bit weights, not a Claude model. The system assumes a mixture-of-experts architecture, which it does not hide, and Anthropic presents the release as a research prototype that shares intermediate progress rather than a product that Claude or any API now uses.
- What hardware do you need to run FlashProve?
- Checking a stored FlashProve proof needs only Linux, g++ 13 or newer and under 2 GB of RAM. Producing proofs needs one NVIDIA H100 80 GB with CUDA 13.2; the full Llama 4 Maverick route needs about 330 GB of RAM, 245 GB of disk and several hours, according to the repository README.
- What are FlashProve's main limits?
- FlashProve proofs cover an integer version of the model under greedy decoding, so sampled or floating-point outputs can differ. Context is capped at 1,024 tokens, side channels such as proof timing are out of scope, and the fast C++ verifier has no formal guarantee. Only the slower Lean verifier is formally linked to the soundness proof.
- Does FlashProve keep the model weights secret?
- Mostly. FlashProve hides the committed weights from the verifier, except for a declared list of published values described in the repository's what-is-not-hidden document. The model architecture is not hidden. The README also warns that commitment IDs must come from a trusted party, never from the server whose replies are being checked.
Try it
git clone https://github.com/anthropics/FlashProve && cd FlashProve && verifier/build.sh