Anthropic's FlashProve proves which AI model answered, at about 72x the GPU time

Anthropic has released FlashProve, an open-source research prototype that produces a cryptographic proof that a specific AI model generated a specific reply. The proof is a zkSNARK, a zero-knowledge argument that anyone can check without seeing the model's weights. Anthropic's research post is dated November 2, 2026, and TechCrunch reported on it on November 3. The code is in the anthropics/FlashProve repository under the Apache 2.0 license.

The headline caveat comes first: Anthropic describes the post as sharing "intermediate progress, and not a completed research agenda," and the GitHub page labels the project "a research artifact: not maintained, not accepting contributions." TechCrunch reports that there are no plans to deploy FlashProve at Anthropic or at any other lab. That deployment statement comes from TechCrunch. We did not find it in Anthropic's post, which does not describe a deployment plan for this system.

How it works

According to the repository, the process has three steps. A provider publishes a commitment that binds it to one set of weights. For each reply, the provider's GPU produces a proof that the reply is that committed model's output. Anyone can then verify the proof on an ordinary CPU, without the weights. Anthropic says the weights, the intermediate values and which experts ran all stay hidden. The model's architecture does not.

The security claim, as the repository states it, is that a provider passing off output from a different model is caught except with probability about q/2^124 + 2^-101 after q hash queries. Anthropic says the protocol's soundness is proved in Lean 4. It also says the Lean proofs, the paper and the fast running code are not guaranteed to match.

The benchmark, exactly as Anthropic reports it

Anthropic tested FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with about 17 billion parameters active per token, using public third-party 4-bit weights. The prover ran on one H100 GPU and 24 CPU cores.

Measure	Anthropic's figure
Prover throughput	about 110 tokens per second (the intro says "over 100")
Proof size	about 18.78 MB, summarized as about 19 MB for a 1,024-token request
GPU-time overhead vs vLLM	about 72x for a batch of 24 (66x to 77x across runs); about 94x at the highest load tested
Verification	17 seconds on 24 CPU threads, 21 seconds on one thread
One-time commitment	about 39 minutes per model, good for about 16 million requests; clients download about 6.5 MB
Online batch	24 requests in about 223 seconds

The 72x comparison is against vLLM, a standard inference server, running the FP8 version of the model on eight H100s. Help Net Security, in its write-up, reports the same throughput, proof size, verification and overhead figures. The GitHub page describes the 110 tokens per second as prefill throughput at 24 requests per batch.

For context, Anthropic's post says earlier work called VerInf proved the same model at about 0.02 tokens per second with a 93.6 GB proof. It cites DeepProve at about 1.4 tokens per second on Gemma 3, and a system called Attestable at 53 to 77 tokens per second on a different model, Gemma 4 31B, with no open-source release. Those are different models, so they are not a like-for-like race.

What it does not cover

The limits are large, and Anthropic lists them itself:

• Context is capped at 1,024 tokens, far below typical chat and frontier context windows.
• The proof covers an integer version of the model under greedy decoding. Floating-point or sampled decoding may produce different outputs.
• Adversarially designed prompts and side-channel attacks such as timing are out of scope.
• The system assumes a mixture-of-experts architecture, and the architecture is not hidden.
• The fast code has no formal guarantees, and the prover's zero-knowledge property is checked by human and AI-assisted audit rather than formal verification.

Running it is also heavy. Help Net Security reports it needs an 80 GB GPU and about 290 GB of host memory, and the model weights are not included. The GitHub page gives different resource figures for its own setup, including 330 GB of RAM for the Maverick run, so check the repository before planning anything.

Why verifiable inference matters to a company buying AI

This section is our analysis, built on the use cases Anthropic and TechCrunch describe. Today, a business buying AI through an API takes the vendor's word for which model produced each answer. TechCrunch reports that the goal of provable inference is to resist impostors, including the lab that runs the model, for example by stopping a provider from quietly swapping in a cheaper model or a more expensive one to inflate performance results. Anthropic's post names tamper detection against compromised inference servers, enforcement of model approvals, and compute monitoring for regulators among the uses.

Three practical questions follow for a buyer:

• Price versus product. If a contract prices a premium model, a proof would let you check that you received it. Without one, you rely on the vendor's logs and your own testing.
• Approved models only. A company that must use only a vetted model in a regulated workflow could check each output against the committed model.
• Compromised servers. A proof could reveal an output that was altered or produced by a different model after a breach.

None of this is available to a buyer today. The 72x GPU cost, the 1,024-token cap and the greedy-decoding restriction mean FlashProve is a proof of feasibility, not a product. Anthropic also says its own separate project, which signs its inference traffic and recomputes inference on a trusted server, met its earlier public goal of a provable-inference prototype by September 30, 2026. The post says FlashProve pursues the same objective by a different method.

Anthropic's stated future work is hiding the model architecture, supporting longer contexts and tighter formal guarantees on the fast code. For now, the practical takeaway for buyers is narrow: ask vendors how they would demonstrate which model served a request, and expect that answer to rely on trust and audits for some time.

Sources: Anthropic research post; anthropics/FlashProve on GitHub; TechCrunch; Help Net Security. This is technology news, not investment advice.