FlashProve

// Overview

FlashProve is a research prototype from Anthropic's Frontier Red Team, written with co-authors from EPFL, MIT, StarkWare and Succinct, for proving which model produced an AI reply. A provider publishes a commitment ID that binds it to one set of weights. For each reply, its GPU then produces a proof that the reply is the committed model's output, and anyone can check that proof on a CPU without ever seeing the weights. The problem it targets is simple to state: today a user cannot tell whether a router or provider quietly served a cheaper model, or whether the token stream was changed on the way.

Under the hood FlashProve is a zkSNARK built from an interactive oracle proof and compiled into a hash-based proof. Its completeness, soundness and zero-knowledge properties are proved in Lean 4, and the repository ships two verifiers: a fast C++ `cp_verify` with no formal guarantee, and a slower Lean verifier formally linked to the soundness theorem. The published run proves full-size Llama 4 Maverick, a 400B-parameter mixture-of-experts model, at about 110 tokens per second of prefill on a single NVIDIA H100, with proofs of about 19 MB per 1,024-token request.

The project is explicit about its limits. Proving costs roughly 70 to 95 times the GPU time of ordinary vLLM inference; proofs cover an integer version of the model under greedy decoding; context stops at 1,024 tokens; the architecture is not hidden; and commitment IDs must come from a trusted party rather than the server being checked. The README marks the repository as not maintained and not accepting contributions — it is shared as intermediate progress that others can build on.

// What it does

• Commit once, prove every reply: a commitment ID binds a provider to one set of weights, and each reply gets its own proof
• CPU verification without the weights — `cp_verify` checks a proof in seconds and builds with only g++ 13 and bash
• Hash-based zkSNARK that Anthropic describes as post-quantum secure
• Soundness, completeness and zero-knowledge machine-checked in Lean 4, with a Lean verifier tied to the theorem
• Full-size Llama 4 Maverick proven on one H100 80 GB, plus synthetic-model and toy routes for smaller machines
• Stored accepted and rejected example proofs, a protocol and format spec, and the paper in the repository

// Getting started

FlashProve's README offers four routes of rising cost. Routes 1 and 2 need only Linux, bash and g++ 13 or newer (plus make and python3 for route 2) and under 2 GB of RAM; the GPU routes need one H100 80 GB with CUDA 13.2. Run everything from the repository root as a non-root user.

apt-get update && apt-get install -y --no-install-recommends g++ make python3 unzip

git clone https://github.com/anthropics/FlashProve
cd FlashProve
verifier/build.sh

bin/cp_verify examples/accepted-proof/config examples/accepted-proof/ivk examples/accepted-proof/example.req examples/accepted-proof/example.y examples/accepted-proof/example.proof -id "$(cat examples/accepted-proof/ID.txt)"

W=$(mktemp -d) && LOOK="$W/look" && echo "LOOK=$LOOK"
blocks/first_look.sh "${LOOK:?first run the line with mktemp}"

examples/quickstart-gpu.sh

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Reach for it when you research how a user or auditor could check that a provider served the exact model it promised
• Reach for it to study a working, formally verified zkSNARK for transformer inference at 400B-parameter scale
• Reach for it as a starting point for compliance tooling that needs evidence of which model produced an output
• Reach for it to measure what provable inference costs today before designing a system that depends on it

// How FlashProve compares

FlashProve alongside other open-source governance & compliance tools AI/TLDR tracks, ranked by GitHub stars.