Anthropic releases FlashProve, an open-source prototype for proving which model produced a response

Anthropic published research on provable inference: a cryptographic proof (a zkSNARK) that a response came from a specific committed set of model weights, checkable by a user who does not have the weights. The post says it could help detect a model silently swapped by a routing service or tampered with by an attacker, and could give evaluators and regulators a way to check what is being served.

• Measured result (Anthropic's figures): on Llama 4 Maverick (400B-parameter mixture of experts, 4-bit weights), a single H100 generates proofs at about 110 tokens per second, with about 19 MB per 1,024-token request. Anthropic says this is roughly 70–95 times the GPU time of running the model on vLLM, and that prior open-source systems are orders of magnitude slower.
• Verifying: the client downloads a commitment of about 6.5 MB, and checking a proof takes about 17 seconds on a 24-core CPU, with no GPU. The proof does not reveal the weights, but does not hide the architecture.
• Limits: proofs are made after the fact, in batches, rather than during inference. Anthropic calls this intermediate progress, not a finished research agenda.
• Released under Apache 2.0: the blog post, a technical report, a protocol description, a prover with a fast C++ verifier and a Lean verifier, and Lean proofs of the top-level security statements. Anthropic says Claude produced much of the optimization work and that the Lean statements are there so people can audit its claims.
• Context: Anthropic says its Frontier Safety Roadmap goal of a provable-inference prototype by September 30, 2026 was met through a separate project that signs its inference traffic and recomputes inference on a trusted server; this work pursues the same goal by a different method.