Anthropic on Nov. 3 released FlashProve1, an open-source prototype that the company said can cryptographically prove which model produced a response.
The work matters because it targets a practical gap in AI deployment: users, auditors and intermediaries often cannot verify that a response actually came from the model a provider claims to be serving. Anthropic's write-up argues that such proofs could help with tamper detection, model-routing integrity and some compliance checks, but the announcement includes no independent test results.
What Anthropic says FlashProve does
In its research post, Anthropic described provable inference as a way for a model provider to commit to a model and then send a short proof with each response so a user can verify that the output came from that committed model without learning the model's weights Anthropic research post1. The company said FlashProve is a software-only system based on zkSNARKs, a kind of zero-knowledge proof it called well suited to this use because the proofs can hide weights while remaining relatively quick to verify Anthropic research post1.
Anthropic said it released five artifacts: the research post itself, a technical report, a protocol specification, executable code with a prover and two verifiers, and Lean proofs for top-level mathematical statements Anthropic research post1. The company said those materials are under the Apache 2.0 license Anthropic research post1.
The accompanying repository is labeled "a research prototype" and "not maintained"2 on GitHub. That repository says FlashProve lets a provider publish a commitment ID for a set of weights, produce a proof for each reply on a GPU, and let others check the proof on a CPU in seconds with its verifier, without access to the weights GitHub repository2.
Anthropic's X account separately summarized the release as "progress on provable inference for large language models" and said the code was being open-sourced, but that post is only a pointer to the longer research write-up @AnthropicAI on X3.
The published numbers and their limits
The main performance figure in Anthropic's post is for Llama 4 Maverick, a 400B-parameter mixture-of-experts model1. Anthropic said that, with 4-bit quantized weights and integer arithmetic in prefill, a single H100 GPU generated proofs at around 110 tokens per second, with a proof size of about 19 MB per 1,024-token request Anthropic research post1.
Anthropic also provided the baseline it used: the proof generation cost was about 70-95 times the GPU time of running the model itself on vLLM for prompts of the same length Anthropic research post1. That framing is important. The result does not show that proof-carrying inference is cheap in absolute terms; it shows Anthropic's claimed overhead relative to standard inference on one named software stack under the company's stated conditions.
The GitHub repository repeats the same broad setup and says FlashProve runs Llama 4 Maverick "at full size" with a 1,024-token context window on a single NVIDIA H100, reaching about 110 tokens per second of prefill at 24 requests per batch GitHub repository2. It also lists demanding system requirements for the full-size routes, including one H100 80 GB GPU, CUDA 13.2 Update 2, and hundreds of gigabytes of RAM and disk for some workflows GitHub repository2.
Those details matter for interpretation. Anthropic is presenting a research prototype under a specified configuration, not a benchmark across multiple serving environments or models. The company's post says prior open-source systems are orders of magnitude slower and points readers to section 6 for that comparison, but the figures in the announcement are vendor-supplied and not independently reproduced in the material here Anthropic research post1.
Anthropic also framed the release as incomplete. Its post says the work shares "intermediate progress, and not a completed research agenda" Anthropic research post1. TechCrunch, citing the blog post, reported that there are no plans to deploy the system at Anthropic or another lab, but that statement appears in secondary coverage rather than in the primary research post TechCrunch4.
Security and compliance uses are proposed, not demonstrated deployments
Anthropic's post spends much of its length on possible uses. It says provable inference could help independent evaluators verify that the model they test is the same model customers receive, help clients using routing services confirm which model handled a request, and make it harder for an attacker to alter output streams while pretending to be an authorized model Anthropic research post1.
The company also connects the work to policy and governance proposals. In one example, Anthropic says a regulator could request certificates covering inference requests to check whether hardware was being used to serve the claimed model Anthropic research post1. The same section adds an important limit: such proofs would verify that hardware served inference, but would not establish that the hardware was not also being used for training on the side Anthropic research post1.
On security, Anthropic says proofs could be required on every response so that a compromised server or substituted model would need to produce valid proofs for the expected weights to avoid detection Anthropic research post1. That is a security argument about the protocol's intended properties, not a report of attacks tested in production.
The GitHub repository adds a formal claim for the protocol's soundness, saying it is proved in Lean 4 and giving a bound for a provider attempting to pass off output that is not from the committed model GitHub repository2. Anthropic's research post likewise says it included auditable statements in Lean because optimization choices made by Claude could be hard to evaluate in large systems Anthropic research post1.
What the available material does not establish is external replication, peer review status or production adoption. Anthropic's post is the original issuer document for this work, and the repository is publisher-side code. Together they show what Anthropic released, the configuration it used for its headline numbers, and the limits Anthropic itself states, including that hiding the model architecture is not a goal of the system Anthropic research post1.