FlashProve: Anthropic Can Prove Which Model Answered

When you pay for a frontier model, you have no way to check that a frontier model actually answered. A provider could quietly route requests to a cheaper model, a reseller could swap one in, or an attacker could tamper with the token stream, and a good-looking reply would not reveal any of it. Anthropic’s Frontier Red Team addresses that gap in a research post dated 2 November, presenting FlashProve, an open-source prototype for what cryptographers call provable inference. “Judging from the model’s output alone is unreliable, even if it produces high-quality responses,” the authors write. TechCrunch compared the idea to the DKIM signatures that let an email recipient check who really sent a message.

The scheme has two phases. Offline, the provider publishes a short commitment to its model weights, a fingerprint about 6.5 MB in size. Online, for each request, it produces a zero-knowledge proof (a zkSNARK) that the committed model produces exactly those output tokens for that prompt. Anyone holding the commitment, the prompt and the reply can check the proof without ever seeing the weights. The proof reveals nothing about the weights, the intermediate values or which experts in a mixture-of-experts model fired, although the architecture itself is not hidden. The construction compiles an interactive oracle proof into a cryptographic one using hash functions, which the team says also gives it post-quantum security.

The headline result is speed. Tested on Meta’s Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with about 17 billion parameters active per token, running from public 4-bit weights, a single H100 proved a batch of 24 requests in about 223 seconds, or roughly 110 tokens per second. Each proof is about 19 MB and takes around 17 seconds to verify on a 24-thread CPU. Committing to the model takes about 39 minutes once, and a commitment lasts for about 16 million requests. Compared with ordinary serving on vLLM, that is about 72 times the GPU cost at a batch of 24 and about 94 times at the highest load tested, “2 orders of magnitude” in the authors’ words. Earlier open-source systems were far slower: the post cites VerInf needing 14.3 hours and a 93.6 GB proof for 1,000 tokens of the same model. Two design choices drive the gain. Prover work scales with the active parameters rather than all 400 billion, and requests are proved in batches after the fact, with weights streamed from host memory so one 80 GB GPU with about 290 GB of system RAM is enough.

Anthropic released the code on GitHub under Apache 2.0, together with a technical report, a protocol specification the post says Claude wrote, and machine-checked proofs in Lean of the protocol’s completeness, soundness and zero-knowledge properties. The fast C++ verifier carries no formal guarantee, though it agrees with a slower verifier built from the Lean code on every test. The Llama weights are not included and must be downloaded from Hugging Face under Meta’s license. The authors include researchers from EPFL, MIT and StarkWare alongside Anthropic staff and fellows.

The limitations are spelled out plainly. Proofs cover an exact integer version of the model under greedy decoding, so floating-point or sampled outputs can diverge, and adversarially designed prompts are not covered. Each proof spans at most 1,024 tokens, far short of real chat or agent contexts. Timing side channels are out of scope, and proving that a chip is serving inference does not prove it is not also training on the side. The post calls itself “intermediate progress, and not a completed research agenda,” and TechCrunch reports there are no plans to deploy it at Anthropic or anywhere else. The company met its own roadmap goal of an inference-verification prototype by 30 September through a separate, simpler project that signs inference traffic and recomputes it on a trusted server.

The applications the team lists are mostly about trust between parties who cannot see each other’s systems: regulators confirming that only approved models are served, customers detecting a substituted model, and anyone checking a claim that a frontier model reviewed a codebase or signed off on a plan. That last case extends the provenance work Anthropic started when it began watermarking Claude’s text, but with a mathematical guarantee rather than a statistical one. At 70 to 95 times the serving cost the method is far too expensive to run on every request. The 1,024-token ceiling probably matters more, since provers can be sped up but a proof has to cover a whole conversation to be useful.