FlashProve is an open-source research prototype from Anthropic that uses zero-knowledge cryptography to prove which AI model generated a given response, without exposing the model's weights. Published on November 2, Anthropic demonstrated FlashProve on a 4-bit version of Llama 4 Maverick over 1,024-token windows. It is not active on the Claude API, and the codebase is explicitly declared unmaintained.
This analysis draws on Anthropic's research post, co-authored by Anthropic researchers alongside academics from EPFL and MIT, and the README of the public GitHub repository. Performance figures cited below are as declared by Anthropic and have not been independently verified by third parties.
New Anthropic research: progress on provable inference for large language models.
— Anthropic (@AnthropicAI) November 3, 2026
Here, we introduce FlashProve. Building on established cryptographic techniques, FlashProve allows developers to verify whether a given response came from a given AI model. It's substantially more…
The Problem: Who Actually Responded?
According to Anthropic, users currently have no way to verify that responses come from the model a developer claims to be running. The research post identifies two concrete risks. First, routing services could silently swap a promised model for a cheaper one. Second, attacks could alter the token stream between model and user. For businesses buying AI through intermediary platforms, the gap is real: they pay for a specific model and have no mechanism to confirm which one is actually doing the work.
The challenge grows as distribution channels multiply. Cloud providers resell third-party models, as seen with OpenAI's entry into Google Cloud, while open-weight models like MiniMax's Flash version are offered by multiple providers at different price points. The same model name can mask very different implementations underneath.
How It Works: Commit, Prove, Verify
The system operates in three steps. First, the provider publishes a short fingerprint that binds them to a precise set of weights without revealing those weights. According to Anthropic, this commitment phase takes roughly 39 minutes, run once per model. Then, for each response, the provider's GPU generates a proof that the token sequence is the output of the committed model. Finally, anyone can verify that proof on a standard CPU, without weights and without a GPU, needing only the fingerprint, the prompt, and the response.
The technique is a zkSNARK, a zero-knowledge proof: it demonstrates that a computation was performed correctly without revealing the underlying data. This is the same cryptographic family the crypto industry uses for privacy and scalability. In financial services, the approach is gaining regulatory attention as well: Coinbase has formally asked for zkSNARK recognition in U.S. anti-money-laundering rules. Notably, the model's weights, intermediate values, and expert routing choices remain hidden. The model architecture, Anthropic clarifies, is not concealed.
The Prototype Numbers
Llama 4 Maverick is a 400-billion-parameter model with a mixture-of-experts architecture, of which roughly 17 billion parameters are active per token. The prototype operates on a publicly available 4-bit conversion of the model. As reported by Anthropic, on a single H100 GPU with 24 CPU cores, the proof phase runs at approximately 110 tokens per second, producing proofs of around 19 megabytes per 1,024-token request. Verifying a proof takes 17 seconds on 24 threads, and the client must download roughly 6.5 megabytes of commitment data.
The cost overhead is the number that matters most. Per Anthropic's own figures, generating proofs requires between 70 and 95 times the GPU time needed to run the model with vLLM, one of the most widely used inference engines. Anthropic benchmarks FlashProve against Attestable, a competing approach that reaches 53 to 77 tokens per second on a dense 31-billion-parameter model but has not released an open-source library.
What the Proof Does Not Guarantee
A FlashProve proof tells you which model generated a response. It says nothing about whether that response is correct. Anthropic lists several further limitations. The proof covers deterministic decoding only: with sampling, which introduces randomness into outputs, the actual result could diverge at some point. The proved model is an exact integer version of the weights, and a response computed in floating-point arithmetic could drift from it. Near-equivalence also does not cover prompts crafted specifically to exploit numerical differences, and timing-based attacks fall outside the system's scope entirely.
Practical constraints add to these caveats. The 1,024-token window is, in Anthropic's own words, “quite short” for a real conversation. The fast C++ implementation carries no formal guarantees and is not certified to match exactly the proof written in Lean, the formal language where the protocol's soundness is mathematically established. The repository README is unambiguous: FlashProve is a research artifact, “not maintained” and not accepting contributions. No external security audit is indicated.
Anthropic
What This Means for Enterprise and Cloud Buyers
For enterprises and public-sector organizations procuring AI services through resellers or cloud platforms, FlashProve changes nothing today. It is not a product, and it is not integrated into any commercial service. What it does signal is a direction: a contract promising a specific model could one day be verified cryptographically, rather than taken on trust from the provider. That is exactly the transition zero-knowledge proofs have been making in financial services, where Coinbase has formally requested their recognition in U.S. anti-money-laundering regulations. The parallel is worth watching closely.
Steve Weis
The issue also touches on European technological dependency. Regulators have flagged that EU finance relies on foreign AI systems, often accessed through multiple layers of third-party vendors. Vendor-independent verification tools could become a contractual requirement if costs fall enough. Right now, with overhead running 70 to 95 times normal inference time per Anthropic's own measurements, that's not a realistic option for everyday use.
FlashProve: what we know and what we don't
Confirmed facts, open questions, and what to watch next.
- Confirmed: an open-source prototype under the Apache 2.0 license, published November 2; demonstrated on 4-bit Llama 4 Maverick with 1,024-token windows; CPU-side verification completes in 17 seconds without model weights; overhead of 70 to 95 times standard GPU inference time; codebase described by Anthropic as unmaintained.
- Not specified: external security audits; monetary costs at scale; applicability to Claude APIs or other closed models; verification times for longer context windows.
- Worth tracking: whether support extends to longer contexts and alternative architectures; potential adoption by providers or platforms; independent code audits by third parties.
The bigger picture
Our own reading, stated as such: FlashProve brings into AI a principle that originated in crypto, “don't trust, verify.” Today, users of AI services must take the provider's word on which model generated a given response, much as people once had to trust an intermediary about an account balance. Cryptographic proof separates two questions that often get conflated: where a response comes from, and whether it's any good. FlashProve answers only the first. That's already meaningful. Whether Anthropic or anyone else chooses to deploy it in live services remains to be seen, alongside other transparency efforts like METR evaluators gaining internal access at Anthropic.
Three signals are worth watching. First, whether computational overhead, currently between 70 and 95 times normal inference costs, can drop far enough that providers might feasibly include proofs with every response. Second, whether the scheme extends to longer contexts and other models, including closed-weight systems like Claude. Third, whether the codebase, abandoned by its original authors, gets picked up by independent research groups or by platforms looking to sell verifiable provenance as a product feature.
