Anthropic FlashProve: Zero-Knowledge Proofs of AI Inference

Introduction

Anthropic's Frontier Red Team has published a research post, dated November 2, 2026, on "provable inference" and an open-source prototype called FlashProve. The problem it targets is simple to state. A user querying a model cannot check that the response came from the model the developer claims, as opposed to one "secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream," in the post's words. FlashProve lets a provider commit to one set of model weights and then attach a cryptographic proof to each reply, without revealing the weights.

Three framing points matter before the details. Anthropic calls the release "intermediate progress, and not a completed research agenda." The demonstration model is Meta's Llama 4 Maverick, not Claude. And TechCrunch reports that there are no plans to deploy the system at Anthropic or any other lab, while the GitHub repository describes itself as a research prototype that is not maintained.

Feature Overview

Commit, then prove. In an offline phase the provider publishes a commitment, which the post describes as "a short fingerprint to pin down one exact choice of weights while the weights themselves remain hidden." In the online phase, for a prompt and its output tokens, the prover produces a proof of the statement "The committed model produces these output tokens when evaluated." Anyone holding the commitment, the prompt and the reply can check it without the weights.

Four guarantees. Anthropic lists completeness (an honest proof is accepted), soundness (a false statement cannot realistically be proved), zero knowledge (the verifier learns nothing about weights or intermediate values) and succinctness (the proof is small and cheap to check). The model architecture is not hidden, and the system assumes a Mixture-of-Experts design.

Efficiency choices. The prover's work is proportional to the roughly 17B parameters that actually run per token rather than all 400B. Requests are proved in batches after the fact, and the model is processed in segments so that a single 80 GB GPU with about 290 GB of host memory is enough.

Formal verification in Lean. The protocol and its three top-level security properties are stated and proved in the Lean proof assistant. The release includes a fast C++ verifier and a slower Lean verifier that is proved to accept only what the soundness theorem accepts. The post says the C++ verifier carries no formal guarantee, though it agreed with the Lean verifier on every proof in Anthropic's tests.

Five released artifacts. The blog post, a technical report, a protocol specification, executable code (a prover and two verifiers) and the Lean proofs with an interactive visualizer, all under Apache 2.0.

Reported measurements

For comparison, Anthropic cites the earlier VerInf system, which proved the same Maverick model at 14.3 hours for 1,000 tokens on a DGX Spark with a 93.6 GB proof. It also notes that Attestable reports 53 to 77 tokens per second on a dense 31B model on one H100, without an open-source library.

Usability Analysis

FlashProve is a research artifact, not a service. The README labels it "Version 0.16.0" and "not maintained, not accepting contributions," and it is written to be run by a coding agent. The lightest route, verifying a stored example proof, needs Linux, g++ 13 or newer and under 2 GB of RAM, with a 1 to 2 minute build and a check that takes under 2 seconds. The GPU routes require a single NVIDIA H100 80 GB, and the full Maverick route lists 330 GB of RAM and 245 GB of disk.

Anthropic names several settings where such proofs could matter. Independent evaluators need to know the model they test is the model being served. Clients of third-party routing services want assurance that tokens came from the model they paid for. Providers could detect a compromised or substituted model, and regulators could audit inference without seeing weights. The post also describes a "Proof-of-Failure" idea, where a provider shows that a specific model spent at least a stated number of tokens on a patch without finding bugs.

The post separates this work from Anthropic's own roadmap goal of a provable-inference prototype by September 30, 2026. It says that goal was met through a different project that signs inference traffic and recomputes inference on a trusted server, and that the zkSNARK work pursues the same objective by another method.

Pros and Cons

Strengths: the hiding commitment, CPU-side verification with no weights, Lean-stated guarantees and an Apache 2.0 release that others can audit and extend.

Limitations: Anthropic lists them directly. Proofs cover contexts of up to 1,024 tokens. The proof concerns an integer version of the weights under greedy decoding, so a floating-point implementation or sampled decoding could depart from the proved computation. Side-channel attacks such as proof timing are out of scope. The fast code, the paper and the Lean protocol are not guaranteed to match each other. Prover cost is roughly 70 to 95 times plain inference.

Outlook

Anthropic says it shared the work so that "others look at what we have done, take it, and improve it." Stated gaps point to the next steps: longer contexts, other architectures than MoE, and hiding the architecture as well as the weights, which the post says it plans to pursue in future work. Anthropic also says in a footnote that it now prefers the term "inference verification" to "provable inference," because cryptographic proofs are one of several ways to reach high assurance in a token stream.

The prior-work survey in the post shows how quickly the numbers have moved. Whether any lab turns this into a production feature is not something the release answers, and TechCrunch reports no such plans.

Conclusion

FlashProve is a well-documented research prototype that shows zero-knowledge proofs for a 400B-parameter MoE model can run on one GPU with proofs of about 19 MB that a CPU checks in seconds. It is not a shipped Anthropic product, it does not cover Claude, and its limits on context length and decoding are significant. It is most relevant to security researchers, model evaluators and AI policy teams who care how model identity could be verified. Rating: 4 out of 5 for the research contribution, with no claim about deployment.

Editor's Verdict

Anthropic FlashProve: Zero-Knowledge Proofs of AI Inference earns a solid recommendation as AI security research.

The strongest case for paying attention: the commitment pins one exact set of weights while keeping them hidden from users, evaluators and auditors. That alone raises the bar for what readers should expect in this space. Reinforcing that, checking a proof needs no GPU and no weights, and the published measurement is 17 seconds on 24 CPU threads — practical value rather than just headline appeal. The broader signal worth registering is straightforward: post-hoc proving trades latency for security, since FlashProve proves finished replies in batches after the fact rather than alongside inference. On the other side of the ledger, one constraint is real rather than a marketing footnote: the prover needs roughly 70 to 95 times the GPU time of plain vLLM inference, a large overhead for routine use. It should factor into any serious decision. Layered on top of that, the proof covers contexts of only up to 1,024 tokens, far shorter than the contexts accumulated in chat settings — which narrows the set of teams for whom this is an obvious yes.

For security researchers, model evaluators and AI policy teams following how model identity could be verified, the technical report and Lean proofs are worth a close read. It is a research reference to study and build on, not a service to deploy.