FlashProve: Anthropic proves which model answered a request
Anthropic released FlashProve, a research prototype that proves a model's reply came from the weights its provider committed to.
· Anthropic · Research by Roy Rinberg, Alex Allain, Alessandro Chiesa (EPFL, StarkWare), Miranda Christ (MIT, RESI), Rahul Dalal (Anthropic STEM Fellows Program, Succinct), Anthropic Frontier Red Team
FlashProve is an open-source prototype from Anthropic that uses zero-knowledge proofs to show a reply came from a committed set of model weights, without revealing them. Anthropic measures proving at about 72 times the cost of vLLM.
01What happened
Anthropic's Frontier Red Team published FlashProve on November 2, 2026, with a technical report, a protocol paper and Lean 4 proofs of its top-level security statements. Roy Rinberg, Alex Allain and six co-authors from EPFL, MIT, StarkWare and Succinct built the prototype. Anthropic calls it a research artifact and states in the repository that it is not maintained.
02How it works
Zero-knowledge succinct proofs, or zkSNARKs, carry the guarantee. A provider first publishes a commitment id that binds it to one set of weights, then returns a proof with each reply showing that the reply is the committed model's output. Anyone can check that proof on a CPU with the cp_verify tool, without holding the weights. Anthropic states a cheating provider is caught except with probability about q/2^124 plus 2^-101 after q hash queries.
03Who is affected
One configuration is supported: Llama 4 Maverick at 4-bit weights, contexts up to 1,024 tokens, proved on a single NVIDIA H100 with CUDA 13.2 on x86-64 Linux. Verifying needs only a Linux CPU and under 2 GB of RAM. The threats Anthropic names are a provider or third-party router that serves a cheaper model than the one it advertises, and a compromised server that alters the token stream.
04What to do
Treat a proof as an identity check only when the commitment id comes from a party other than the server being tested, which Anthropic states is required. Read the repository's limits and what-is-not-hidden documents first: the proof assumes greedy decoding over an integer copy of the weights, the model architecture stays visible, and side channels such as timing are out of scope.
Questions people ask
- Can FlashProve verify Claude or GPT responses today?
- FlashProve proves inference for Llama 4 Maverick only, at 4-bit weights and contexts up to 1,024 tokens, and Anthropic ships it as an unmaintained research prototype rather than a service. No Anthropic production model is covered. A provider would have to publish a weight commitment and run the prover itself before any customer could check a reply this way.
- What does FlashProve cost compared with normal serving?
- Anthropic measures proving at roughly 72 times the GPU time vLLM needs for the same batch of 24 requests, rising to about 94 times at the highest vLLM load tested. Each proof runs 18.78 MB per 1,024-token request, and an offline commitment phase takes about 39 minutes. Verification stays cheap, at 17 seconds on 24 CPU threads.
- Does FlashProve stop a compromised inference server from tampering with replies?
- Anthropic argues an attacker who altered the token stream could not produce a valid proof for the committed weights, so tampering becomes detectable rather than silent. Detection depends on obtaining the commitment id from a party other than the server under test. Side channels such as timing measurements are out of scope, and the fast C++ prover code carries no formal guarantee.
Sources 3 links, all fetched
- 1anthropic.comAnthropic Research Post
- 2github.comFlashProve Repo
- 3anthropic.comTechnical Report