Anthropic launches FlashProve: cryptographic proof of which model answered, without revealing the weights

Anthropic launches FlashProve: cryptographic proof of which model answered, without revealing the weights

Anthropic's Frontier Red Team released FlashProve on November 2, 2026, a research prototype that produces cryptographic proof that a specific language-model reply was actually generated by one specific set of weights — without the weights being made public. The code is open under the Apache 2.0 license, with a prover, a C++ verifier, a Lean reference verifier, formal proofs and a specification on GitHub. The prototype was built together with researchers at EPFL, MIT and StarkWare, and the system rests on a zkSNARK — a "zero-knowledge succinct argument of knowledge" in the same hash-based proof family that powers Ethereum L2s such as Starknet. This is the first open, measurable attempt at cryptographic "provable inference" at the scale of frontier models: the team proved output from Llama 4 Maverick, a MoE model with 400 billion parameters, on a single H100 GPU.

But it is important to read the numbers with the right lens: this is a research prototype, not a product. The overhead is large, the scope of what can be proven is narrow, and Anthropic has not announced plans to deploy the system in its own or anyone else's services.

How the scheme works

FlashProve splits the work into two phases.

In the offline phase, the prover commits to the model's weights once, in a step that takes around 39 minutes per model. The result is a "weight commitment" — a digital fingerprint of roughly 6.24 MB according to XenoSpectrum, while Help Net Security gives a downloadable file of 6.5 MB; the exact size is thus uncertain in the secondary sources. The point is that the fingerprint can be published without the weights being reconstructable from it. This is the mechanism that could, in principle, bring closed-model makers like Anthropic and OpenAI on board: the weights are among their most valuable commercial assets and are normally not published, but a fingerprint that does not reveal them still makes it possible to bind replies to a specific model version. One commitment is supposed to cover around 16 million requests.

In the online phase, the provider generates a proof of roughly 18.78 MB for a request with 1,024 tokens, tied to both the prompt and the reply tokens. The verifier checks the proof against the commitment and confirms that the computation was performed correctly. The check runs on ordinary CPUs: around 17 seconds on 24 threads, or around 21 seconds on a single thread.

Because the proofs are so-called succinct arguments, the check is far cheaper than repeating the entire computation — that is the whole point of the scheme.

The numbers — and their status

The team tested FlashProve on Llama 4 Maverick and measured it against vLLM running the same model in FP8 on eight H100 GPUs. The overhead came out at around 72x per GPU across runs, and around 94x at the heaviest tested load. The prover managed around 110 tokens per second on one H100 with 24 CPU cores.

An alarm comes with a caveat: these are Anthropic's own measurements, relayed through secondary sources such as Shattered, Help Net Security and Yahoo/Bankless. No independent party has repeated them, and there is no primary source in this record that can confirm the figures directly. Yahoo/Bankless, for its part, gives the overhead as "around 70 to 95 times," which is consistent with the more specific numbers but stems from the same underlying benchmark — that is correlation, not independent confirmation.

What FlashProve actually proves — and what it does not

The narrowness of scope is central to judging the prototype fairly. FlashProve verifies an integer-based model built on publicly available 4-bit quantized weights, and it proves a deterministic computation based on greedy decoding, where the most likely token is chosen at each step. It cannot directly verify the floating-point arithmetic and probabilistic sampling that typical AI services actually run. Replies produced with temperature, sampling, or at full precision therefore fall outside what the prototype can prove today.

This means a FlashProve proof in practice says: "this reply is correct output from this 4-bit quantized model under greedy decoding" — not "this reply came from Claude as you know it." The transition from a quantized reference model to a service's actual inference stack is an open question the evidence does not answer.

A system in three versions — with the producer's own warning

Anthropic itself has an unusually honest caveat, relayed by Help Net Security: there are three versions of the system — the paper, the Lean protocol, and the code that runs — and the team does not promise that all three say the same thing. The prover also lacks formal verification; it is the verifier that has a Lean reference.

XenoSpectrum further points out that this is not a peer-reviewed paper, but a research prototype containing AI-generated text and code, and that detailed verification has not been carried out. For a system whose entire value hypothetically lies in cryptographic soundness, that is not a footnote — it is the core of the uncertainty. Formal Lean proofs for the protocol are a stronger foundation than most research projects have, but the distance between protocol and running code is where the team itself points.

Why it matters — and the open questions

The basic idea behind provable inference has long been known: if a provider can cryptographically prove that a reply comes from a specific model, users and auditors can check claims about model version, migrations of the underlying model, and "model laundering" without trusting the provider's word. What has been missing is a demonstration at relevant scale. FlashProve is the first open attempt with a frontier-class MoE model, and all the building blocks — prover, C++ verifier, Lean verifier, formal proofs and specification — are openly available.

The open questions are many:

• Performance: An overhead of around 72–94x is unsustainable in production. A roadmap to lower overhead is not in the evidence.
• Scope: The bridge from integer models with greedy decoding to floating-point and sampling-based services is unbuilt.
• Soundness: The alignment between paper, Lean protocol and code is unresolved by the producer's own assessment.
• Date: Several sources date the release to November 2, 2026, while one source refers to an announcement "Tuesday, November 3"; Shattered notes a November 2 date with a November 3 update. The exact announcement day should be checked against Anthropic's own post.
• Adoption: No rollout plans have been announced, either in Anthropic's own products or elsewhere.

Judged on this, FlashProve is best understood as a benchmark, not a breakthrough of practical relevance: it shows how far cryptographic inference verification has come — 400 billion parameters proven on one GPU — and how far remains, in numbers that can be discussed.