# FlashProve — Anthropic's open-source proof of which model wrote a reply

> A zero-knowledge proof that the model you asked for is the model that answered, checked on a normal CPU.

- Org: Anthropic
- Date: 2026-11-02
- Category: paper, algorithm, repo, security
- Source: https://www.anthropic.com/research/provable-inference
- Canonical page: https://ai-tldr.dev/releases/anthropic-flashprove-provable-inference/

## In short

FlashProve is an Anthropic research prototype that proves a reply came from a committed model without revealing its weights. It ran Llama 4 Maverick on one H100 at 110 tokens per second, and a CPU checks each proof in about 17 seconds.

## What it is

Anthropic released FlashProve on 2 November: open-source code that lets an AI provider prove a reply came from one committed set of model weights, while keeping those weights hidden. A provider publishes a commitment once; for every reply it then produces a proof that anyone can check. Anthropic calls the release intermediate progress, and the GitHub repository is labelled not maintained.

## How it works

FlashProve is a zkSNARK built from an interactive oracle proof and compiled into a hash-based proof, which the post says gives post-quantum security. Its completeness, soundness and zero-knowledge properties are machine-checked in Lean 4. The one-time commitment phase took about 39 minutes for Llama 4 Maverick and covers about 16 million requests; after that a single H100 proves replies at 110 tokens per second, and the `cp_verify` tool checks a proof in about 17 seconds on 24 CPU threads.

## Why it matters

Users today cannot tell whether a router or provider quietly swapped in a cheaper model, or whether an attacker changed the token stream. A checkable proof per reply closes that gap, and Anthropic says such proofs could also help verify compliance with AI rules. The cost is still high: proving takes about 70 to 95 times the GPU time of normal inference, covers only greedy decoding of an integer model, and stops at 1,024 tokens of context.

## Who it's for

AI security researchers, model providers and auditors

## Try it

git clone https://github.com/anthropics/FlashProve && cd FlashProve && verifier/build.sh

## Quick facts

- Maker: Anthropic Frontier Red Team, with EPFL, MIT, StarkWare and Succinct co-authors
- License: Apache-2.0
- Model tested: Llama 4 Maverick (400B MoE, 4-bit weights)
- Proof size: About 19 MB per 1,024-token request
- Overhead: About 70–95x the GPU time of vLLM inference
- Context limit: 1,024 tokens
- Status: Research prototype, not maintained

## FAQ

### Can FlashProve be used with Claude today?

No. Anthropic's FlashProve demonstration uses Llama 4 Maverick with public 4-bit weights, not a Claude model. The system assumes a mixture-of-experts architecture, which it does not hide, and Anthropic presents the release as a research prototype that shares intermediate progress rather than a product that Claude or any API now uses.

### What hardware do you need to run FlashProve?

Checking a stored FlashProve proof needs only Linux, g++ 13 or newer and under 2 GB of RAM. Producing proofs needs one NVIDIA H100 80 GB with CUDA 13.2; the full Llama 4 Maverick route needs about 330 GB of RAM, 245 GB of disk and several hours, according to the repository README.

### What are FlashProve's main limits?

FlashProve proofs cover an integer version of the model under greedy decoding, so sampled or floating-point outputs can differ. Context is capped at 1,024 tokens, side channels such as proof timing are out of scope, and the fast C++ verifier has no formal guarantee. Only the slower Lean verifier is formally linked to the soundness proof.

### Does FlashProve keep the model weights secret?

Mostly. FlashProve hides the committed weights from the verifier, except for a declared list of published values described in the repository's what-is-not-hidden document. The model architecture is not hidden. The README also warns that commitment IDs must come from a trusted party, never from the server whose replies are being checked.

## Links

- [Anthropic Post](https://www.anthropic.com/research/provable-inference)
- [GitHub Repo](https://github.com/anthropics/FlashProve)
- [Paper (PDF)](https://github.com/anthropics/FlashProve/blob/main/paper/paper.pdf)
- [Known Limits](https://github.com/anthropics/FlashProve/blob/main/docs/limits.md)