# FlashProve

> Zero-knowledge proofs that a reply came from the model a provider committed to

- Category: Evaluation & Production Ops / Governance & Compliance
- Language: Lean
- Licence: Apache-2.0
- Repository: https://github.com/anthropics/FlashProve
- Website: https://www.anthropic.com/research/provable-inference
- Canonical page: https://ai-tldr.dev/tools/flashprove/
- Updated: 2026-11-02

## In short

FlashProve is a research prototype from Anthropic's Frontier Red Team, written with co-authors from EPFL, MIT, StarkWare and Succinct, for proving which model produced an AI reply. A provider publishes a commitment ID that binds it to one set of weights. It sits in the Governance & Compliance category of the Evaluation & Production Ops tools and is open-source, written in Lean and licensed Apache-2.0.

## Overview

FlashProve is a research prototype from Anthropic's Frontier Red Team, written with co-authors from EPFL, MIT, StarkWare and Succinct, for proving which model produced an AI reply. A provider publishes a commitment ID that binds it to one set of weights. For each reply, its GPU then produces a proof that the reply is the committed model's output, and anyone can check that proof on a CPU without ever seeing the weights. The problem it targets is simple to state: today a user cannot tell whether a router or provider quietly served a cheaper model, or whether the token stream was changed on the way.

Under the hood FlashProve is a zkSNARK built from an interactive oracle proof and compiled into a hash-based proof. Its completeness, soundness and zero-knowledge properties are proved in Lean 4, and the repository ships two verifiers: a fast C++ `cp_verify` with no formal guarantee, and a slower Lean verifier formally linked to the soundness theorem. The published run proves full-size Llama 4 Maverick, a 400B-parameter mixture-of-experts model, at about 110 tokens per second of prefill on a single NVIDIA H100, with proofs of about 19 MB per 1,024-token request.

The project is explicit about its limits. Proving costs roughly 70 to 95 times the GPU time of ordinary vLLM inference; proofs cover an integer version of the model under greedy decoding; context stops at 1,024 tokens; the architecture is not hidden; and commitment IDs must come from a trusted party rather than the server being checked. The README marks the repository as not maintained and not accepting contributions — it is shared as intermediate progress that others can build on.

## What it does

- Commit once, prove every reply: a commitment ID binds a provider to one set of weights, and each reply gets its own proof
- CPU verification without the weights — `cp_verify` checks a proof in seconds and builds with only g++ 13 and bash
- Hash-based zkSNARK that Anthropic describes as post-quantum secure
- Soundness, completeness and zero-knowledge machine-checked in Lean 4, with a Lean verifier tied to the theorem
- Full-size Llama 4 Maverick proven on one H100 80 GB, plus synthetic-model and toy routes for smaller machines
- Stored accepted and rejected example proofs, a protocol and format spec, and the paper in the repository

## Getting started

FlashProve's README offers four routes of rising cost. Routes 1 and 2 need only Linux, bash and g++ 13 or newer (plus make and python3 for route 2) and under 2 GB of RAM; the GPU routes need one H100 80 GB with CUDA 13.2. Run everything from the repository root as a non-root user.

1. Install the build tools (Ubuntu 24.04)

   On a minimal Ubuntu 24.04 machine, routes 1 and 2 need these packages, installed as root.

```bash
apt-get update && apt-get install -y --no-install-recommends g++ make python3 unzip
```

2. Build the verifier

   The build is silent for one to two minutes and ends with a "THE VERIFIER IS BUILT:" line.

```bash
git clone https://github.com/anthropics/FlashProve
cd FlashProve
verifier/build.sh
```

3. Check the stored example proof

   The last line of output should be YES. The stored examples use synthetic weights, so they show the verifier works but say nothing about a served model.

```bash
bin/cp_verify examples/accepted-proof/config examples/accepted-proof/ivk examples/accepted-proof/example.req examples/accepted-proof/example.y examples/accepted-proof/example.proof -id "$(cat examples/accepted-proof/ID.txt)"
```

4. Run toy proofs on the CPU

   Route 2 is a CPU self-test of the proof library in a scratch directory.

```bash
W=$(mktemp -d) && LOOK="$W/look" && echo "LOOK=$LOOK"
blocks/first_look.sh "${LOOK:?first run the line with mktemp}"
```

5. Prove on a GPU

   Route 3 builds the GPU prover and runs a 64-token quickstart on a synthetic model; it can be silent for 15 minutes or more. Proving Llama 4 Maverick itself (route 4) downloads a 232 GB 4-bit conversion and needs about 330 GB of RAM.

```bash
examples/quickstart-gpu.sh
```

## When to use it

- Reach for it when you research how a user or auditor could check that a provider served the exact model it promised
- Reach for it to study a working, formally verified zkSNARK for transformer inference at 400B-parameter scale
- Reach for it as a starting point for compliance tooling that needs evidence of which model produced an output
- Reach for it to measure what provable inference costs today before designing a system that depends on it

## Version history

- 2026-11-02: Anthropic open-sourced FlashProve as a research prototype, proving Llama 4 Maverick replies on one H100 at 110 tokens per second with proofs checked on a CPU in about 17 seconds.