# FlashProve: Anthropic proves which model answered a request

> Anthropic released FlashProve, a research prototype that proves a model's reply came from the weights its provider committed to.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Tool, Research
- **Published by:** Anthropic
- **Disclosed:** 2026-11-02
- **Affects:** LLM inference providers, LLM routers, Llama 4 Maverick
- **Research by:** Roy Rinberg, Alex Allain, Alessandro Chiesa (EPFL, StarkWare), Miranda Christ (MIT, RESI), Rahul Dalal (Anthropic STEM Fellows Program, Succinct), Anthropic Frontier Red Team
- **Primary source:** https://www.anthropic.com/research/provable-inference
- **Page:** https://theinjection.dev/items/anthropic-flashprove/

FlashProve is an open-source prototype from Anthropic that uses zero-knowledge proofs to show a reply came from a committed set of model weights, without revealing them. Anthropic measures proving at about 72 times the cost of vLLM.

## What happened

Anthropic's Frontier Red Team published FlashProve on November 2, 2026, with a technical report, a protocol paper and Lean 4 proofs of its top-level security statements. Roy Rinberg, Alex Allain and six co-authors from EPFL, MIT, StarkWare and Succinct built the prototype. Anthropic calls it a research artifact and states in the repository that it is not maintained.

## How it works

Zero-knowledge succinct proofs, or zkSNARKs, carry the guarantee. A provider first publishes a commitment id that binds it to one set of weights, then returns a proof with each reply showing that the reply is the committed model's output. Anyone can check that proof on a CPU with the cp_verify tool, without holding the weights. Anthropic states a cheating provider is caught except with probability about q/2^124 plus 2^-101 after q hash queries.

## Who is affected

One configuration is supported: Llama 4 Maverick at 4-bit weights, contexts up to 1,024 tokens, proved on a single NVIDIA H100 with CUDA 13.2 on x86-64 Linux. Verifying needs only a Linux CPU and under 2 GB of RAM. The threats Anthropic names are a provider or third-party router that serves a cheaper model than the one it advertises, and a compromised server that alters the token stream.

## What to do

Treat a proof as an identity check only when the commitment id comes from a party other than the server being tested, which Anthropic states is required. Read the repository's limits and what-is-not-hidden documents first: the proof assumes greedy decoding over an integer copy of the weights, the model architecture stays visible, and side channels such as timing are out of scope.

## Quick facts

- **Released:** November 2, 2026, as an unmaintained research prototype
- **Model proved:** Llama 4 Maverick, 400B mixture of experts, 4-bit weights
- **Throughput:** About 110 tokens per second on one NVIDIA H100
- **Proof size:** 18.78 MB per 1,024-token request
- **Proving overhead:** About 72 times a vLLM batch of 24 requests, up to 94 times at the highest vLLM load tested
- **Verification:** 17 seconds on 24 CPU threads
- **License:** Apache 2.0

## Questions

### Can FlashProve verify Claude or GPT responses today?

FlashProve proves inference for Llama 4 Maverick only, at 4-bit weights and contexts up to 1,024 tokens, and Anthropic ships it as an unmaintained research prototype rather than a service. No Anthropic production model is covered. A provider would have to publish a weight commitment and run the prover itself before any customer could check a reply this way.

### What does FlashProve cost compared with normal serving?

Anthropic measures proving at roughly 72 times the GPU time vLLM needs for the same batch of 24 requests, rising to about 94 times at the highest vLLM load tested. Each proof runs 18.78 MB per 1,024-token request, and an offline commitment phase takes about 39 minutes. Verification stays cheap, at 17 seconds on 24 CPU threads.

### Does FlashProve stop a compromised inference server from tampering with replies?

Anthropic argues an attacker who altered the token stream could not produce a valid proof for the committed weights, so tampering becomes detectable rather than silent. Detection depends on obtaining the commitment id from a party other than the server under test. Side channels such as timing measurements are out of scope, and the fast C++ prover code carries no formal guarantee.

## Sources

1. [Anthropic Research Post](https://www.anthropic.com/research/provable-inference)
2. [FlashProve Repo](https://github.com/anthropics/FlashProve)
3. [Technical Report](https://www.anthropic.com/document/flashprove-technical-report)