Anthropic’s FlashProve Uses Zero-Knowledge Proofs to Verify Which AI Model Answered

Anthropic has published FlashProve, an open-source research prototype that lets anyone verify whether an AI response genuinely came from the model a provider claims to have used — without revealing the model’s proprietary weights. The release, dated November 2, 2026, includes the code, a technical report, a protocol specification and machine-checked formal proofs, all under the Apache 2.0 licence. The company frames the work as “provable inference,” a cryptographic answer to a trust gap that has quietly widened as AI services route requests through layers users cannot see.

• Core mechanism: Providers publish a fingerprint of their model weights, and each response carries a zkSNARK proof that those weights generated it.
• Measured performance: On Meta’s Llama 4 Maverick, a single Nvidia H100 produces proofs at roughly 110 tokens per second, with about 19 MB per 1,024-token request and verification in around 17 seconds on a standard CPU.
• Serious limits: The prototype handles only 1,024-token contexts, works solely with mixture-of-experts models, hides weights but not architecture, and has no announced deployment plans.

The trust problem FlashProve targets

Today, a customer paying for a frontier model through an API or reseller has no way to confirm that a cheaper or distilled model was not silently substituted. Output quality is a weak signal, and misconfigured routers or attackers tampering with token streams can leave no obvious trace. FlashProve proposes a commitment scheme: the provider publishes a short mathematical fingerprint of its weights, and each reply ships with a proof that a verifier can check against that fingerprint without ever touching the weights themselves.

The system relies on a zkSNARK, a zero-knowledge succinct argument that demonstrates a statement is true without disclosing the underlying data. Anthropic tested it on an integer-arithmetic version of Meta’s Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model using 4-bit weights. Because Claude helped write the code — and AI-generated code is difficult for humans to audit — the team expressed the top-level security guarantees as machine-checked proofs in Lean, a formal verification language. Those guarantees apply to the Lean-specified protocol; the fast C++ verifier still requires separate audit discipline.

“This research post is meant to share intermediate progress, and not a completed research agenda.”

Benchmarks and the cost of proof

The published numbers show how far the field has moved. Generating proofs demands roughly 70 to 95 times the GPU time of running the model normally through vLLM, a widely used inference engine. A single H100 sustains about 110 tokens per second of proving, and each 1,024-token request yields a proof of approximately 19 MB. Verification, by contrast, is cheap: about 17 seconds on a 24-thread CPU, with no GPU and no access to weights.

The comparison with prior work is stark. The only earlier system capable of proving Llama 4 Maverick’s outputs, VerInf, produced proofs of 93.6 GB that took nearly a day to verify. FlashProve shrinks that to megabytes and seconds — several orders of magnitude in both size and verification time. Researchers also tested checking every reply token rather than a single token per request and reported no measurable speed difference.

Who benefits, and what remains unsolved

Anthropic outlines several institutional uses. Independent evaluators could confirm they tested the model actually being served. Customers of third-party routing services could verify they received what they paid for. Regulators could check that a provider’s chips were running approved models, tying the work to broader calls for pacing the AI frontier. Provenance for high-stakes “model-approved” assertions, such as security scan claims, is another candidate.

The limitations are equally explicit. Proofs target an integer, greedy-decoding formulation, and floating-point serving or sampled decoding can diverge: none of 192 stored replies generated by conventional floating-point inference matched the integer model’s top token at every position. Coverage applies only to the token positions selected for checking, so verifying part of a reply does not authenticate the rest. Customers would also need the model’s commitment ID from a trusted party, not merely from the service being checked. Timing attacks remain outside scope, and the GitHub repository labels the project an unmaintained research artifact that is not accepting contributions.

Anthropic says it met its own goal for verifying model outputs through a separate project that signs traffic and rechecks it on a trusted server. No integration into commercial Claude services has been announced, and no deployment is planned at Anthropic or elsewhere. For enterprise buyers, the practical takeaway is procedural: name model versions in contracts, log routing metadata and request IDs, and ask vendors about attestation roadmaps. FlashProve matters less as a product than as a proof of concept — evidence that model identity can become a property services substantiate rather than a label users simply trust. The 70-to-95-times overhead and the 1,024-token ceiling place it firmly in research territory, but the direction is now concrete, inspectable and open for others to improve.