Anthropic's FlashProve can prove which AI model answered you. Generating that proof costs up to 95 times the GPU time of running the model normally.

Anthropic published a research post on November 2 describing a system that answers a question I hadn’t thought to ask until I read it: when an AI model answers you, how do you know it’s actually the model you picked, and not a cheaper one swapped in to save money, or a compromised server lying about what’s running?

The system is called FlashProve. It’s a cryptographic proof, specifically a “zkSNARK”, that lets a model provider show a short certificate alongside an answer. Each proof covers one output token generated under greedy decoding, within a request window of up to 1,024 tokens. Anyone holding that certificate can check it, in seconds and without a GPU, against a committed, hidden set of model weights. They can’t see the weights themselves. They just get a yes or no on whether the committed model actually produced that token.

What it actually does, in plain terms

Anthropic’s post splits FlashProve into two phases. First, offline, the model provider publishes a short “commitment” to its weights, a fingerprint that pins down one exact version of the model without revealing what’s inside it. Anthropic says the client downloads that commitment, around 6.5 MB in total, once. Then, for every request, the system produces a proof file that a user, auditor or regulator can check against that commitment.

Anthropic’s writeup tested FlashProve on Llama 4 Maverick, Meta’s 400-billion-parameter mixture-of-experts model, using the publicly available 4-bit weights. On a single Nvidia H100 GPU, proving a batch of 24 requests takes about 223 seconds, which Anthropic reports as around 110 tokens per second, and each proof comes out to roughly 19 MB. Checking one proof takes about 17 to 21 seconds on an ordinary CPU, no GPU or model access required.

The catch, and Anthropic says this plainly rather than burying it, is the cost of making the proof in the first place, not checking it. Anthropic measured that proving a batch of 24 requests takes 70 to 95 times longer, per GPU, than vLLM (a widely used open-source inference engine) takes to process the same batch, a figure Cryptobriefing also reported independently. Anthropic calls this release “intermediate progress”, not a completed research agenda, and the GitHub repository says it isn’t being actively maintained. One caveat the post is less loud about: the formal zero-knowledge proof covers proving one request at a time, and the headline 110-tokens-per-second figure comes from the batched mode instead.

The part the headlines undersold

TechCrunch framed FlashProve as Anthropic “working on” a system to prove AI identity, a phrase that reads as earlier-stage than the release itself. Anthropic’s own post calls it a release: five artifacts published the same day, including working code on GitHub under an Apache 2.0 license, a technical report, a protocol description and Lean proofs for the top-level mathematical claims. That said, the formal verification has real limits of its own. Anthropic’s technical report says the fast C++ code is derived from the Lean protocol but isn’t proven to match it exactly, so the Lean work covers the protocol’s design, not a guarantee that every line of the shipped code behaves as designed.

There’s a second thing TechCrunch’s coverage didn’t get into. Anthropic’s Frontier Safety Roadmap set a public goal to ship a prototype for “provable inference” by September 30, 2026, as part of its broader Responsible Scaling Policy commitments. Anthropic’s post says it already met that goal through a separate, related project that signs its own inference traffic and recomputes it on a trusted server. FlashProve, in Anthropic’s own words, “pursues the same objective by a different method”: cryptography instead of trusted hardware.

One detail in the post amused me more than it probably should have: Anthropic credits Claude itself with producing the optimizations that make FlashProve faster than prior open-source systems, then adds that Claude “often makes decisions that are hard to evaluate, especially in large complex systems”, which is why the protocol’s top-level security claims are backed by Lean proofs rather than just a developer’s say-so. My read: that’s a company using its own model to build a trust mechanism for itself, while visibly not trusting that same model’s engineering judgment without a separate, formal check, even though that check doesn’t cover the fast code path people would actually run. That’s not a knock on Anthropic. If anything, building in that skepticism, and being specific about where it stops, is the more honest version of “we used AI to build this.”

Why anyone outside Anthropic would care

The use cases Anthropic lists are specific rather than hypothetical. Independent evaluators testing a model before and after release could use a proof to confirm they’re testing the actual deployed model, not a swapped-in version that behaves better for the test. A business paying for API access through a third-party router could confirm the tokens it’s billed for actually came from the model it paid for. Anthropic’s post goes further than that: it describes a “Proof-of-Failure” scenario where a model provider could prove it spent at least a set number of tokens on a specific model without that model finding a bug in a given piece of code, something a developer currently has no way to verify beyond trusting the provider’s word.

None of this works yet for the chat window most people use day to day. The current system only proves inference over windows up to 1,024 tokens, far short of the hundreds of thousands of tokens a real conversation can run to. My read: a 70-to-95x compute cost for the proving side, on top of the batch-versus-single-request gap noted above, is not something anyone is going to eat for routine chat traffic any time soon. Anthropic frames this release as a step for other researchers to build on, not a feature it’s shipping. TechCrunch reported that there are no plans to deploy FlashProve at Anthropic or anywhere else right now, and nothing in Anthropic’s own post contradicts that.

My read is that the AI pacing and regulation angle matters more than the consumer-trust pitch, at least near term. Anthropic’s post ties the system to letting a regulator check that a lab’s hardware is serving the inference traffic it claims to, and to proving a lab only serves approved models, while noting plainly that passing this check doesn’t rule out the same hardware also being used for training on the side. A cryptographic proof that a CPU can check in well under a minute, with no special hardware, is a much easier ask of a regulator than demanding access to a data center, even with that gap acknowledged.

What’s still unproven

Anthropic is upfront about the limits. The proof only covers an integer version of the model under greedy decoding, so a real floating-point, sampled reply could technically diverge from what’s proved at some position, even though Anthropic says that gap is small in practice outside adversarially crafted prompts. The system currently assumes a mixture-of-experts architecture, so it doesn’t yet generalize to every model shape in use. And proving doesn’t hide the model’s architecture, only its weights, so a determined observer could still learn something about what kind of model is running.

My read on the comparison: the jump from earlier systems is real, even allowing that each used different hardware, batch sizes and models. Anthropic’s post lists the throughput each prior system reached:

System (year)	Model proved	Speed
zkLLM (2024)	Llama-2 13B	~2.5 tokens/sec
VerInf (2026)	Llama 4 Maverick 400B	~0.02 tokens/sec (14.3 hrs for 1,000 tokens)
Attestable (2026, closed-source)	Gemma 4 31B	53-77 tokens/sec
FlashProve (2026)	Llama 4 Maverick 400B	~110 tokens/sec

A commercial competitor, Attestable, claims similar throughput on a smaller model but hasn’t published open-source code to check that claim against.

Related reading

This connects to a similar trust problem: the self-regulation accord six AI CEOs signed at the White House also turns on how anyone outside a lab verifies what it says about its own models, without taking the lab’s word for it.

Note on sources: the speed, proof-size and limitation figures above come from Anthropic’s own research post and its linked technical report. I haven’t run the FlashProve code or audited the Lean proofs myself, so the claims about what the formal verification does and doesn’t cover rest on Anthropic’s own account of its scope, not independent testing.

Sources

1. Progress on provable inference for large language models (Anthropic)
2. FlashProve technical report (Anthropic)
3. FlashProve code and Lean proofs (GitHub, anthropics/FlashProve)
4. Anthropic is working on a system to prove AI models’ identity (TechCrunch)
5. Anthropic’s FlashProve uses zero-knowledge proofs to verify large AI model outputs (Cryptobriefing)