Anthropic Releases FlashProve, a Cryptographic Proof That a Reply Came From the Claimed Model

Anthropic on November 2, 2026 released FlashProve, an open source prototype that lets a model provider prove a reply came from one specific set of model weights without revealing those weights. On Meta's 400 billion parameter Llama 4 Maverick, a single Nvidia H100 GPU produced proofs at about 110 tokens per second, Anthropic says.

The problem it targets: a user cannot check that the model they picked is the one that answered, rather than a cheaper model swapped in by a routing service or output altered by an attacker. Anthropic's Frontier Red Team wrote the work up as intermediate research progress, with coauthors from institutions including EPFL and MIT, and says Claude produced the improvements behind the speedup.

How does FlashProve work?

FlashProve uses a zkSNARK, a short cryptographic certificate that a computation ran correctly and that reveals nothing else, Anthropic explains in its announcement. The provider first publishes a commitment, a compact fingerprint that pins down one exact set of weights, and later proves that those committed weights produce the claimed output for a given prompt.

Anyone holding the commitment, the prompt and the reply can run the check without the weights or a GPU. The construction relies on the BLAKE2 hash function and, according to the technical report, offers plausible security against future quantum attackers.

The security properties are stated and proved in Lean, a language for machine checked mathematical proofs. The report says the fast C++ prover and verifier were generated by AI agents from the Lean description and are not proved equivalent to it, and that a longer AI generated protocol document was not reviewed in detail.

How fast is it, and how does it compare?

Anthropic reports that one H100 with 24 CPU cores proves Llama 4 Maverick at about 110 tokens per second, with an 18.78 MB proof per 1,024 token request that a 24 thread CPU verifies in 17 seconds. That costs roughly 70 to 95 times the GPU time the vLLM inference engine needs to process the same requests.

The technical report adds a qualifier: each proof checks a single token, while the 110 figure counts all 1,024 tokens the prover processes; checking every token of a reply comes to 39.1 tokens per second. Proofs are made after the reply is served, and a request in a batch of 24 waits about five minutes for its proof.

On the same Maverick model, Anthropic's figures work out to a proving rate about 5,500 times VerInf's and proofs about 5,000 times smaller. The closest rival is commercial: Attestable reports 53 to 77 tokens per second on a smaller dense model.

Who would use provable inference?

Anthropic names four uses: showing regulators that hardware serves inference rather than training, detecting tampered servers, proving a named model produced a text, and enforcing rules that only approved models be served. The post adds that independent evaluators, a role the UK AI Security Institute played when it tested Claude Mythos 5, need to know the model they test is the one being served.

The tamper case includes the AI itself: Anthropic writes that a more capable model could run in place of an authorized one and pose as the weaker model to avoid the monitoring that would apply to it. A required proof on every response would expose that swap, because a proof only verifies against the committed weights. TechCrunch noted it would also catch a lab swapping in a cheaper model to cut costs.

Is Anthropic using FlashProve on Claude?

No. TechCrunch reports there are no plans to deploy FlashProve at Anthropic or any other lab, and Anthropic calls it intermediate progress for others to improve.

Anthropic had set itself a public goal in its Frontier Safety Roadmap: a provable inference prototype by September 30, 2026. In an October 19, 2026 roadmap update, it said it met that goal with a different system, one that runs on production inference, signs all internal token traffic and has already caught one rare, benign integrity glitch, and it renamed the goal "inference verification". Read together, the two documents show that the system Anthropic runs in production is the signing prototype, while FlashProve is a cryptographic route that, by Anthropic's account, holds even against an attacker who controls the serving hardware.

What are FlashProve's limits?

Anthropic lists five technical limits in the post, starting with the fact that the fast executable code carries no formal guarantee. The proof covers an exact integer version of the published weights under greedy decoding, in which the model always picks its most likely next token, so a reply from ordinary floating point serving or sampled decoding can drift from what was proved.

The system only works for mixture of experts models, which activate a small subset of "expert" subnetworks per token, and it does not hide the architecture. Side channel attacks such as timing are out of scope, and contexts are capped at 1,024 tokens. The technical report adds that zero knowledge is formally proved only for requests proved one at a time, and that proving after the fact detects tampering but cannot stop a tampered reply from reaching a user first.

What we don't know yet

• Whether any provider, Anthropic included, will publish weight commitments and attach proofs to a commercial model.
• How far the overhead falls with the optimizations Anthropic says it left out to release early.
• Whether the approach extends to dense models, hidden architectures and full length contexts, and at what cost.
• When the carefully reviewed paper the technical report promises will appear, and what outside audits of the Lean statements find.