Anthropic open-sources FlashProve to prove which AI model answered

Anthropic’s Frontier Red Team released FlashProve as open-source code on GitHub under Apache 2.0 terms on Nov. 2, 2026.

Anthropic‘s own announcement supplied the release date, license and evaluation figures. Secondary reports described FlashProve as a zero-knowledge-proof system for verifying large AI model outputs and rounded its proof size to roughly 19 megabytes.

The project brought in researchers from EPFL, MIT and StarkWare. Roy Rinberg and Alex Allain of Anthropic led it. Other contributors included Alessandro Chiesa, Giacomo Fenzi and Guy Weissenberg of EPFL, with Chiesa also affiliated with StarkWare; Miranda Christ came from MIT and RESI; Rahul Dalal came from Anthropic’s STEM Fellows Program and Succinct; and Ben Mayer came from Anthropic’s Fellows Program and MIT.

API users cannot currently verify which model answered their prompt, and hosted inference hides model identity from the customer. FlashProve generates a cryptographic proof tying a reply to a language model, which is the prototype’s core function. That attribution closes the gap between a response and the model that produced it in an API setting.

A provider could route a request to a cheaper model without the user knowing, a cost-driven substitution scenario. Someone with access to the inference server could alter the token stream even though the reply still reads like a competent answer, a tampering scenario that output alone cannot reveal. Anthropic described that risk as an answer that looks fine, ‘or even by an attacker who has tampered with the token stream.’

The proof does not establish that an output is true, safe or fair, and a correctly identified model remains capable of errors. Its guarantee covers only the model computation described by the protocol, so attribution is separate from correctness. Organizations still need to judge input data, surrounding software, permissions and actions taken after the model responds. Provable inference asks whether a specific output came from a stated model under defined computation, unlike watermarking.

Anthropic sees potential uses in consumer products, internal security and checking compliance with AI pacing requirements. The company also highlighted verification of provider commitments about model deployment and computing resources. Because the proofs keep commercially sensitive weights hidden from external auditors, they could support audits and regulatory oversight as governments introduce transparency and accountability requirements. Anthropic presented these as potential applications rather than guarantees.

Anthropic tested FlashProve on Meta’s Llama 4 Maverick, described as a 400-billion-parameter mixture-of-experts model. The 400-billion figure describes total parameters, while prover work scales with active experts rather than all parameters. The public testing used four-bit quantized weights and a 1,024-token context window, which is a context-length limitation of the demonstrated configuration.

Anthropic measured each proof for a 1,024-token request at about 18.78 megabytes, while secondary reports rounded the figure to roughly 19 megabytes. Creating the weight commitment offline takes about 39 minutes once per model. The 6.5-megabyte commitment remains valid for roughly 16 million requests, so generate it once and reuse it. The client downloads the commitment and one proof for every request.

Proof generation requires one 80 GB GPU alongside roughly 290 GB of host memory, the hardware needed to run the prover. A single NVIDIA H100 generates proofs at about 110 tokens per second, measuring prover throughput on one GPU. The prover touches roughly 17 billion active parameters per token and streams weights through in layer-sized segments, scaling with active experts rather than all parameters.

Proving costs about 70 to 95 times the GPU time of standard vLLM inference, which Anthropic frames as the central efficiency drawback. In tests on eight H100s using FP8, proving added roughly 72 times the per-GPU time across test runs, and overhead reached about 94 times at the heaviest load tested. Those per-GPU measurements came from Anthropic’s evaluation section.

The prover proves requests in batches after inference rather than inline, a post-hoc approach. Proving 24 requests takes roughly 223 seconds of prover time. A standard CPU verifies one proof in roughly 17 to 21 seconds depending on thread count, reflecting verifier latency on client hardware without GPU access.

The release contains a prover, a C++ verifier meant for daily use and a Lean verifier that serves as a slow reference implementation. On every test proof the Lean verifier agreed with the C++ verifier, and Lean machine-checked the formal security properties. Anthropic does not promise that the paper, the Lean protocol and the running code all say the same thing. Reviewing the Lean statements still takes a person aided by an interactive visualizer, while the prover itself has no formal tooling and auditors review it the old way.

The model weights are not included in the release; users download them from Hugging Face under Meta’s license. Users must supply the weights separately, so the public package covers proving software rather than the model itself. Proof generation also requires specialized GPU infrastructure, and the repository describes the artifact as unmaintained research.

FlashProve uses a hash-based zkSNARK, a cryptographic proof that verifies a computation without revealing the underlying data. The verifier learns nothing about the weights, intermediate computation values or which experts ran, so no proprietary information leaks to the verifier. The proof also hides the expert chosen at every layer, while the model architecture itself is not hidden. The system relies on math rather than a secure chip.

Anthropic stresses that FlashProve is a research prototype and not ready for production deployment, calling the release intermediate research rather than a completed system; the GitHub repository describes it as an unmaintained research artifact open to community improvement. The work met a Frontier Safety Roadmap goal to produce a provable inference prototype by Sept. 30, 2026. Anthropic reached that deadline through a separate project that signs inference traffic and recomputes it on a trusted server, while FlashProve pursues the same goal by a different method. TronWeekly summarized the status as “The release remains a research prototype rather than a production-ready service.”

An 18.78-megabyte proof for each 1,024-token request is a large download, on top of the 6.5-megabyte commitment. The client must fetch both items for every request before verification can occur. This client-side data burden, combined with prover hardware requirements, is part of the prototype’s current limits.