A standard CPU can verify in 17–21 seconds which AI model produced a response, using FlashProve

A standard CPU can verify in 17–21 seconds which AI model produced a response, using FlashProve

In early November 2026, Anthropic published the research post "Progress on provable inference for large language models" and released the code for FlashProve under the Apache 2.0 license: a research prototype that lets a recipient cryptographically verify that a given response was actually generated by a specific language model. The cost is currently high — roughly 70–95 times the compute time of a normal run — and Anthropic stresses that this is research, not a product.

What happened

Anthropic announced the FlashProve system in a research post published on a Tuesday in early November 2026, according to TechCrunch's reporting. The sources disagree somewhat on the exact date: Shattered.io dates the release to November 2, with an update on November 3, while Mint gives Tuesday, November 3. The safe span is therefore November 2–3.

The system provides what researchers call "provable inference" — a cryptographic proof, in practice a mathematical guarantee, that a given response came from a specific model. Alongside the announcement, a detailed technical specification and working code were released on GitHub under the Apache 2.0 license, according to Benzinga.

The work was done together with researchers affiliated with MIT, EPFL and StarkWare. One source (MSN-syndicated reporting) also lists Succinct as a collaborator, while Shattered.io does not mention the company; the complete author list has not been confirmed in the available source material.

How the scheme works

The mechanism has two parts: a fingerprint and a zero-knowledge proof.

First, the system requires the AI lab to publish a cryptographic "fingerprint" for each model it releases. The fingerprint can later be matched against concrete responses and verified cryptographically. Crucially, the fingerprints do not reveal the model's weights — the internal numbers that define how the model behaves, and which labs such as Anthropic and OpenAI keep secret. This means that providers of closed models can also take part without exposing proprietary parameters.

Second, the proof itself is built on a zkSNARK — a zero-knowledge proof technique that lets the proof show that the computation was performed by the specified model, without revealing anything else about it. According to the TechCrunch reporting, the scheme, like cryptographic email signatures, is robust against fraud attempts that try to pass off one model as another — even when the fraudster is the lab that built and operates the model.

The repository contains, according to Shattered.io citing Help Net Security, three executable programs: the prover (which generates the proof), a fast verifier written in C++, and a second verifier written in Lean — the proof assistant the team used to formulate and prove the protocol's completeness, soundness and zero-knowledge properties. Verification is also designed to run on the user's own machine, according to Mint.

Why it matters

The scheme targets a problem that is hard to detect from the outside: a provider could in principle swap an expensive frontier model for a cheaper, weaker one, while the user sees the same answer in the interface. With FlashProve, the user can confirm that the response actually came from the model that was promised, not a cheaper substitute, according to NEWS.am TECH citing TechCrunch.

The Anthropic researchers themselves point to use cases beyond their own usage. "A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that their business plan was approved by an appropriate model," the researchers write, according to TechCrunch's reporting of the announcement.

The numbers and the limitations

The team benchmarked FlashProve on Llama 4 Maverick, a Mixture-of-Experts model with 400 billion parameters, against vLLM running the same model in FP8 on eight NVIDIA H100 GPUs. The numbers, which are known via secondary sources citing Anthropic's own benchmark, are:

• Compute cost: roughly 72 times per GPU across runs, and roughly 94 times at the highest tested load, according to Shattered.io. Other sources report the same result as "72 to 95 times" (MSN) or "around 70 to 95 times" (Bankless); the variation appears to come down to rounding, but the precise interval should be verified against Anthropic's own post.
• Speed: proof generation runs at roughly 110 tokens per second on one H100, according to both MSN and Bankless.
• Proof size: around 19 MB per request of 1,024 tokens.
• Verification: a standard CPU, such as in an ordinary home PC, can check a proof in roughly 17 to 21 seconds, according to Bankless; MSN gives around 17 seconds on a standard home machine.

The limitations are significant. Anthropic describes FlashProve as an early research prototype limited to conversations of 1,024 tokens. Bankless additionally reports that a single request waits roughly five minutes for its batch — a detail found only in this source and not cross-checkable against the other sources.

Status: research with no rollout plans

Anthropic deliberately frames the entire release as research and an intermediate step, not as a product. According to TechCrunch's reporting of the researchers' announcement, the research is continuing, and there are no plans to deploy the system at Anthropic or at any other lab.

That means there is currently no practical way to obtain cryptographic proof of responses from Claude or other commercial models via FlashProve — the prototype has been demonstrated on Llama 4 Maverick. One further practical detail: Bankless reports that Anthropic says it does not maintain the repository, likewise an item found only in that source.

The open questions before this becomes practically usable are therefore concrete: cost reduction from today's 70–95 times, handling contexts longer than 1,024 tokens, and — if the latency in the Bankless reporting is accurate — the latency issues around batching. In addition, the scheme requires labs to actually publish fingerprints per model and generate proofs per response, something no lab has committed to today. What it would take for that to happen is not something the source material answers; Anthropic itself presents the release as an invitation to external developers to test and improve the technology.