TL;DR
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
Anthropic has released FlashProve, an open-source prototype that uses zero-knowledge cryptographic proofs to let users check whether a response came from a specified model without revealing its weights. The company reports proof generation at about 110 tokens per second on one H100 GPU for a 400-billion-parameter model, while saying that this still takes roughly 70–95 times the GPU time of ordinary inference in vLLM. The work is described as intermediate research, not a finished product or a completed research agenda.
Anthropic and outside collaborators have released FlashProve, an open-source prototype that uses cryptographic proofs to let a user verify that a response was generated by a specified large language model, without exposing the model’s weights. The team reports that one H100 GPU can generate proofs for Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, at about 110 tokens per second under specified settings; proof generation still uses roughly 70–95 times the GPU time of running the model through vLLM.
FlashProve is based on zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs). In the proposed setup, a provider commits to a model and supplies a proof alongside a response. A verifier can check whether the response matches inference from that committed model without receiving its weights. Anthropic says the method is designed to hide model weights, but not the model’s architecture.
The performance figures in the report apply to 4-bit quantized weights and integer arithmetic during prefill. Anthropic reports proof files of about 19 megabytes for a 1,024-token request, with proof generation on a single H100 GPU at roughly 110 tokens per second. The report compares the GPU time with model execution using vLLM and puts proof generation at about 70–95 times that amount. These are the team’s reported prototype results, not a general guarantee for other models, hardware, or workloads.
The release includes a technical report, a protocol specification, executable prover code, and two verifiers: a fast C++ implementation and a Lean implementation described as provably correct. The researchers also published Lean proofs for top-level mathematical statements and an interactive visualizer. The code, proofs, and documentation are released under Apache 2.0. The authors present the materials as an invitation for outside review and improvement.
Verifying Which Model Served a Response
Today, a user generally cannot establish from a model’s answer alone that the provider actually used the model it advertised. A service could route a request to a different model, or a token stream could be altered, without the response itself offering a reliable way to detect the change. Provable inference is intended to add a checkable link between a response and a model identity.
That link could matter to customers using third-party routing services, independent evaluators comparing a model before and after release, and organizations that need evidence about which system handled a request. Anthropic also points to potential use in demonstrating compliance with commitments or legal obligations related to AI development. Those are possible applications, however, rather than capabilities the release says have already been deployed in production.
The reported performance also shows the gap between cryptographic verification as a concept and its practical cost. A proof a user can check may be useful even when producing it is expensive, but a workload requiring tens of times the ordinary inference GPU time could affect provider costs and adoption. Proof size, generation speed, and the ability to audit the implementation will all shape whether the approach can move beyond a prototype.
Popular right now
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
Samsung 65 The Frame QLED 4K TV (2026) QN65LS03HEFXZA Bundle
As an affiliate, we earn on qualifying purchases.
The Limits of Output-Based Checks
Model outputs do not reliably identify the system that produced them: different models can give similar answers, and a convincing response is not evidence of a particular model’s provenance. Re-running inference to check a result would require the model weights and substantial computing resources, which many users and evaluators do not have. Provable inference aims to offer verification without requiring either.
Anthropic’s report frames FlashProve as intermediate progress, not a completed research agenda. It says the system applies established design principles for cryptographic proof systems and draws on existing cryptography and security research. The work involves researchers from Anthropic, EPFL, StarkWare, MIT, RESI, Succinct, and the Anthropic STEM Fellows and Fellows programs. The release is intended to let others inspect the design and build on it.
“The goal of provable inference is to enable a user with limited computational resources and without any information about the weights to verify that a response came from the requested model.”
— Anthropic and the report’s co-authors
Open Questions on Cost and Deployment
The report’s performance figures are tied to one model configuration, quantization method, arithmetic approach, and hardware setup. It does not establish how proof generation will perform across other architectures, model sizes, serving arrangements, or request patterns. Nor does the supplied material show that FlashProve is being used by a commercial service or that users can obtain proofs for ordinary production responses.
The comparison with vLLM is a measure of reported GPU time under the stated setup; it does not by itself establish the full operational cost, including verification, storage, networking, or changes to serving infrastructure. The report describes a fast C++ verifier and a Lean verifier with formal correctness properties, but the source does not specify broad independent audits or external production testing. How the system behaves under real-world use remains unconfirmed.
FlashProve is designed to hide weights, not architecture. The material also does not establish whether the proofs can verify broader service properties, such as the complete routing path or all aspects of a provider’s handling of a request. The intended guarantee is narrower: checking that a response was produced by the model to which the provider committed.
External Review and Prototype Improvements
Anthropic has published the code, technical documentation, and formal proofs so researchers and developers can inspect the system. The report explicitly invites others to review the work and improve it. That review can help test the stated security properties, reproduce the performance results, and identify how the design behaves across different models and computing environments.
The next meaningful developments would include independently reproduced benchmarks, further reductions in proof-generation overhead, and evidence about verifier performance and integration into serving systems. The release does not announce a deployment timetable or promise when a production-ready service will be available. For now, FlashProve is an open research prototype whose practical value will depend on outside scrutiny and progress in reducing its costs.
Key Questions
What is FlashProve?
FlashProve is an open-source prototype for generating cryptographic proofs that a response came from a model specified by its provider. It uses zkSNARK techniques and is intended to let a user verify the claim without seeing the model’s weights.
What performance did the researchers report?
For Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, Anthropic reports proof generation at about 110 tokens per second on one H100 GPU, using 4-bit quantized weights and integer arithmetic in prefill. The reported proof size is about 19 MB per 1,024-token request.
How much more computing does proof generation require?
Anthropic says proof generation used about 70–95 times the GPU time of running the model through vLLM under the reported setup. This is a comparison from the team’s prototype measurements, not a figure established for all models or workloads.
Does the proof reveal the model’s weights or architecture?
The report says the proof is designed to hide the model’s weights. It expressly says that hiding the model’s architecture is not a goal, so the system should not be read as concealing every detail about the model.
Is FlashProve ready for production?
The release describes FlashProve as intermediate research and a prototype. The supplied report does not announce production deployment, independent reproduction of its benchmarks, or a timetable for a commercial service.
Source: anthropic.com
