Anthropic’s FlashProve Puts Cryptographic Proofs Behind AI Replies
Customers using AI usually have to trust a provider’s word about which model answered their prompt. Anthropic’s open-source research prototype, FlashProve, explores another option: a provider can prove that a response came from a computation using model weights it committed to in advance, without revealing those weights.
- Tested on: Llama 4 Maverick, not Claude, using one H100 GPU.
- Reported throughput: 111.23 tokens per second for a batch of 24.
- Main trade-off: Proving takes far more computing power than ordinary inference, and the prototype supports only a limited range of models and settings.
FlashProve tackles a real provenance problem: when a company controls the servers behind an AI API, customers generally cannot independently confirm which model produced their replies. A provider could, for example, route a request to a cheaper model. The answer alone won’t reliably tell you what ran.
FlashProve makes a specific claim. It covers a defined input and output produced using computation the system supports, which in this prototype means greedy decoding. It does not guarantee every response from a provider, or show that an answer is correct, safe, or unbiased. Cryptography can help verify that a specified computation used committed weights. It cannot certify the quality of the result.
How FlashProve works
First, a provider publishes a cryptographic commitment to a particular set of model weights. Think of it as a fingerprint that binds the provider to those exact weights without revealing them. Anthropic says preparing the commitment takes about 39 minutes and can cover roughly 16 million requests.
The provider then generates proofs for responses from the committed model. FlashProve batches requests and produces proofs after inference, rather than necessarily attaching one to each response as it is delivered. A verifier can check a proof on a CPU, without a GPU.
FlashProve is a zkSNARK system, a type of cryptographic proof that lets someone verify a computation without seeing all its underlying data. Anthropic says it turns an interactive proof protocol into a cryptographic proof using hash functions. The project also describes the design as post-quantum, meaning it is intended to withstand attacks by quantum computers. That describes the system’s design. It does not guarantee that every implementation or deployment will be secure against every future threat.
A commitment alone does not prove that the weights belong to the model a provider advertises. An independent auditor, regulator, or trusted registry could check that link, but FlashProve does not establish it. The proof narrows the trust problem. It does not remove the need to establish who stands behind the commitment.
Promising benchmark, costly proof
Anthropic tested FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts (MoE) model. An MoE model activates only some of its parameters for each token. Maverick reportedly uses about 17 billion active parameters per token. Since FlashProve’s proving work depends on active parameters, that distinction matters when weighing the model’s headline size.
The reported proving setup used one 80 GB H100 GPU, 24 CPU cores, and about 290 GB of host RAM. Anthropic measured 17.41 tokens per second for a batch of one, 76.34 for a batch of eight, and 111.23 for a batch of 24. The 24-request batches took about 221 to 226 seconds. A batch of 64 reached 123.31 tokens per second, but Anthropic flagged that result as unreliable on an 80 GB card.
Anthropic’s comparison with other zkML systems points to faster proving on these particular benchmarks, but it is not a like-for-like contest. The systems used different models and hardware. The listed results include 2.9 tokens per second for DeepProve on GPT-2, 0.02 for VerInf on a 400B MoE model, and 53 to 77 for Attestable on a 31B dense model. The comparison uses Attestable’s 77-token figure at batch four. Anthropic says Attestable has not released code.
Proving still comes with a steep cost compared with ordinary inference. Anthropic reports about 72 times the GPU time per batch compared with vLLM running FP8 Maverick on eight H100s. At vLLM’s highest tested load, the gap reaches about 94 times. FP8 is an eight-bit floating-point format. These figures are a reported GPU-time comparison, not a universal per-token cost. The systems use different hardware configurations, so the numbers are not a standardized measure for every workload.
For users, the takeaway is not that “cryptographic proof is now free.” Proving a large model’s output may be feasible at useful throughput, but it takes substantially more computing power than generating the output alone. That cost could matter greatly for high-volume services.
Proofs have practical limits
A proof is 18.78 MB, and a client downloads about 6.5 MB once for each commitment. Anthropic says its fast C++ verifier takes 17 seconds on 24 threads or 21 seconds on one thread. The project’s explainer puts the time for a slower verifier written in Lean at about 24 minutes.
Anthropic says it formalized the protocol in Lean and proved completeness, soundness, and zero knowledge. In plain language, an honest provider should be able to produce an accepted proof; a dishonest provider should have only a very small chance of passing off a false claim; and the proof should not reveal the hidden weights. The README gives the probability of a cheating provider escaping detection as about q/2124 + 2-101.
Those formal statements do not mean the two verifiers offer the same assurance. The Lean verifier is described as proven to accept only what the soundness theorem permits. Anthropic says the faster C++ verifier has no formal guarantee. Choosing it for speed means relying on an implementation without the same formal assurance.
The prototype can prove requests of up to 1, 024 tokens. That is a limit on what FlashProve can prove, not a claim about Llama 4 Maverick’s full context window. It currently supports integer-based models and greedy decoding, which selects the highest-scoring next token rather than sampling among alternatives. It is also limited to MoE models with publicly known architecture. Proofs are generated in batches after inference, and side channels, or information leaked through system behavior outside the proof, are beyond its scope. The project warns that proof timing, for instance, could reveal information about weights.
What FlashProve could and cannot change
Possible uses include helping regulators check whether approved hardware served a model, helping labs detect tampered inference servers, giving users evidence about text provenance, and enforcing requirements to use approved models. These are proposed uses, not evidence that FlashProve is running in production.
The FlashProve project repository describes the software as an Apache 2.0 research artifact. It says the project is not maintained and is not accepting contributions. That status can change, so check the repository for the latest information. Anthropic team members also noted that Claude helped optimize the system. It’s an interesting example of AI contributing to research infrastructure, but it does not independently validate FlashProve’s cryptographic claims.
FlashProve reports a speed improvement on a specific large-model benchmark and lays out the costs and constraints that remain. Broader model support, independent scrutiny, side-channel protections, and a practical way to link commitments to advertised models will all matter if provable inference is to move beyond research. The benchmark is promising, but FlashProve is not yet a production-ready trust button.
Key questions about FlashProve
-
What does FlashProve prove?
It aims to show that a specified response was generated using weights matching a provider’s prior commitment, under the computation the system supports. It does not prove that the response is true or safe.
-
Does verification reveal the model weights?
No. The zero-knowledge design is intended to let a verifier check the claim without learning the weights.
-
How fast was the reported benchmark?
Anthropic reported 111.23 tokens per second for a batch of 24 on Llama 4 Maverick using one H100 GPU. It flagged the larger batch-of-64 result as unreliable on an 80 GB card.
-
Is proving as cheap as ordinary inference?
No. Anthropic reported roughly 72 times the GPU time per batch compared with vLLM on eight H100s, rising to about 94 times at vLLM’s highest tested load.
-
Is FlashProve ready for production use?
The project is a research prototype, not a production deployment. Its computing costs, proof size, verification time, limited support, and stated maintenance status remain practical obstacles.
