← Back to feed

Anthropic has released FlashProve, an Apache 2.0 prototype that cryptographically proves a response came from a specific set of model weights, without revealing the weights. The catch is cost: on Llama 4 Maverick, proving a batch of requests takes about 72 times longer per GPU than serving the same batch on vLLM.

The post, dated November 2, was written with outside cryptographers from EPFL, MIT and StarkWare. Anthropic says Claude produced much of the optimisation work and the protocol specification, and that it added Lean proofs of the top-level security statements because Claude’s design decisions are “hard to evaluate” in a system this complex.

Key Numbers

• Test model: Llama 4 Maverick, 400B-parameter MoE (about 17B active per token), 4-bit weights
• Prover throughput: 110 tokens/second on one H100 with 24 CPU cores (24 requests in about 223 seconds)
• Proof size: 18.78 MB per request; client downloads a roughly 6.5 MB commitment once
• Verification: 17 seconds on 24 CPU threads, 21 seconds on one thread
• Overhead: about 72x (66 to 77x across runs) the per-GPU time of vLLM on the same 24 requests, and about 94x at vLLM’s highest tested load
• One-time commitment: about 39 minutes per model; good for about 16 million requests before re-committing

What it proves, and what it does not

The prover publishes a commitment to the weights. For each response, it then produces a proof of one statement: the committed model, run on this prompt, produces exactly these tokens. The verifier needs no GPU and no access to the weights. The proof is zero-knowledge for weights, intermediate values and which experts fired. Model architecture is not hidden.

Proving is post-hoc and batched, not in-line. That sidesteps latency and keeps the security argument clean, but it means guarantees arrive after the fact. Anthropic also flags non-determinism as an inherent complication when recomputing inference.

Prover work scales with the experts that actually ran, not total parameters, which is why a 400B MoE fits on a single 80 GB GPU with about 290 GB of host memory streaming weights in layer by layer.

Why the cost might be acceptable

Anthropic’s use cases are mostly not per-request consumer checks:

• Pacing and regulation: a regulator can ask a provider for certificates over a sample of served requests, as evidence that hardware was used for inference. The post is explicit that this does not show the hardware is not also training on the side.
• Tamper detection: proof that a compromised server, or a stronger model impersonating a weaker one, is not what is answering.
• Third-party routers: assurance that tokens came from the model a customer paid for, not a cheaper substitute.
• Proof-of-failure: a model provider could prove it spent at least X tokens on a named model without finding a bug in a patch.

Proving a sampled subset, rather than all traffic, is where the 72x multiplier becomes tolerable.

Context

Anthropic’s Frontier Safety Roadmap set a public goal of a provable-inference prototype by September 30, 2026. The company says it met that goal through a separate project that signs its inference traffic and recomputes inference on a trusted server. FlashProve is described as a different method toward the same objective, and as intermediate progress rather than a finished research agenda.

Prior zkML work reached VGG-16 scale (15M parameters, 88.3 seconds per proof in zkCNN, 2021). FlashProve claims to be orders of magnitude faster than prior open-source systems at frontier-adjacent scale.

Two caveats from the post itself: the fast C++ verifier carries no formal guarantee (the slower Lean verifier does), and the formal statements still require manual audit to confirm they match their intent. The release includes the prover, both verifiers, the Lean proofs and an interactive visualiser of the theorems.