# Anthropic FlashProve: Proving Which Model Answered

> Anthropic's FlashProve proves which model answered without revealing its weights: about 110 tokens/s on one H100, 19 MB proofs checked on a CPU.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-11-03
- Canonical (HTML): https://cellcog.ai/blog/anthropic-flashprove-provable-inference/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Anthropic published FlashProve on November 2, 2026: an open research prototype that lets an AI provider prove which model produced a reply, without revealing the model's weights.
- On Llama 4 Maverick (400B parameters, a mixture of experts), one H100 proves about 110 tokens per second, and each 1,024-token request gets an 18.78 MB proof.
- Anyone can check a proof on an ordinary CPU in about 17 seconds on 24 threads, with no GPU and no access to the weights.
- Proving costs about 72 times the GPU time of serving the same requests on vLLM (66 to 77 across runs, about 94 at the highest load), down from hours per token in earlier systems.
- The protocol's soundness, completeness and zero-knowledge are proved in Lean, and the code, proofs and docs are released under Apache 2.0.
- It is a prototype: 1,024-token contexts, greedy decoding on an integer version of the model, MoE models only, and no formal guarantee that the fast code matches the Lean protocol.

## At a glance

- **What is FlashProve?** An open-source prototype from Anthropic that attaches a zkSNARK proof to a model's reply, so anyone can check the reply came from a committed set of weights without seeing them.
- **How fast is it?** About 110 tokens per second on one H100 for Llama 4 Maverick, with 18.78 MB proofs that a CPU checks in about 17 seconds, per Anthropic's November 2, 2026 post.
- **Does it run on Claude?** No. The public release proves Llama 4 Maverick, an open model; Anthropic says it met its own inference-verification goal through a separate project.

When you send a prompt to an AI model through someone else's service, you take the model's name on trust. Anthropic's research post of November 2, 2026, puts it plainly: "A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream." FlashProve is its answer: an open prototype that attaches a cryptographic proof to each reply.

The release has five parts: the post, a technical report, a protocol description, a prover with two verifiers (a fast one in C++ and a slow, formally checked one in Lean), and Lean proofs of the security claims. Code, proofs and docs are Apache 2.0. Anthropic frames it as a work in progress: "This research post is meant to share intermediate progress, and not a completed research agenda."

## How it works: commit, prove, verify

*Provable inference in three steps, as Anthropic describes FlashProve*

![Illustration of a locked teal box of model weights stamping a small fingerprint seal, labeled commit](https://cellcog.ai/blog/media/anthropic-flashprove-provable-inference/slide-1.webp)
*Commit: the provider publishes a short fingerprint of its weights, which stay hidden*

![Illustration of a graphics card turning a reply card into a reply plus a proof tag, labeled prove](https://cellcog.ai/blog/media/anthropic-flashprove-provable-inference/slide-2.webp)
*Prove: for each reply, the provider's GPU produces a proof tied to that fingerprint*

![Illustration of a laptop receiving a reply with its proof tag and showing an amber checkmark, labeled verify](https://cellcog.ai/blog/media/anthropic-flashprove-provable-inference/slide-3.webp)
*Verify: anyone checks the proof on a plain CPU in seconds, without the weights*

In the offline phase the provider publishes a commitment, a short fingerprint that pins down one exact set of weights. In the online phase it proves, for each request, that the committed model produces exactly these output tokens for this prompt. The proof is a zkSNARK: zero-knowledge, so it reveals nothing about the weights, and succinct, so it is fast to check. A provider that serves a different model cannot produce a valid proof for the committed one.

![Animation: a locked weights box stamps a fingerprint, a reply with a proof tag reaches a CPU verifier and gets an amber check; below, a cheaper model's reply with no proof reaches the verifier and is rejected with a cross](https://cellcog.ai/blog/media/anthropic-flashprove-provable-inference/pv-commit-prove-verify.svg)
*A proof travels with every reply; a swapped-in model's reply is rejected*

Anthropic also says the system was largely built by its model: "Claude has produced improvements on zkSNARKs for inference, building a system that is substantially faster than prior open-source systems." It adds the caveat that motivated the Lean proofs: "Claude is good at optimization, but often makes decisions that are hard to evaluate, especially in large complex systems."

## FlashProve by the numbers

*Table: FlashProve on Llama 4 Maverick, as reported by Anthropic on November 2, 2026*

| Measure | Reported value |
|---|---|
| Model proved | Llama 4 Maverick, 400B-parameter mixture of experts (~17B used per token), public 4-bit weights |
| Prover hardware | 1 H100 GPU, 24 CPU cores, ~290 GB of host memory |
| Proving speed | ~110 tokens per second (a batch of 24 requests in ~223 seconds) |
| Proof size | 18.78 MB per 1,024-token request |
| Verification | 17 seconds on 24 CPU threads, 21 seconds on one thread, no GPU |
| Commitment | ~6.5 MB download; ~39 minutes to create; good for ~16 million requests |
| Overhead vs serving | ~72x the GPU time of vLLM (66x to 77x across runs), ~94x at vLLM's highest load tested |
| Context length | Up to 1,024 tokens |
| License | Apache 2.0 (code, Lean proofs, docs) |

The overhead is the headline. Two orders of magnitude is still expensive, so the design proves requests in batches after the fact (post-hoc), not alongside every live reply. But it is the first time an open system has proven a model this size at a speed measured in tokens per second rather than hours per token.

## The speed jump, against earlier systems

*Table: Proving speed of published provable-inference systems, as listed in Anthropic's post (November 2, 2026)*

| System | Model | Tokens per second |
|---|---|---|
| ZKML | GPT-2 (117M) | 0.006 |
| zkPyTorch | Llama-3 8B, one CPU core | 0.007 |
| VerInf | Llama 4 Maverick (same model) | 0.02 |
| zkLLM (2024) | LLaMA-2-13B, in a batch | ~2.5 |
| DeepProve | GPT-2 / distributed | 2.9 / 31 |
| Attestable (no open-source library) | Gemma 4 31B, one H100 | 53 to 77 |
| FlashProve | Llama 4 Maverick, one H100 | ~110 |

The like-for-like comparison is VerInf, the only earlier proof of Llama 4 Maverick Anthropic knows of: 14.3 hours for 1,000 tokens and a 93.6 GB proof that took almost a day to verify. FlashProve does the same model at ~110 tokens per second with 19 MB proofs checked in seconds. Attestable, a commercial effort, reports 53 to 77 tokens per second on a smaller dense model and has not released code.

## What Anthropic says it is for

*Table: Four uses Anthropic names for provable inference (November 2, 2026)*

| Use | The question it answers |
|---|---|
| Pacing | Is this provider's hardware really serving the claimed model, not quietly freed up for training? |
| Tamper detection | Is a compromised server, or a model posing as a weaker one, answering in place of the authorized weights? |
| Text provenance | Did a frontier model really scan this code or review this plan, as claimed? |
| Model approval | Is the provider serving only models a regulator approved? |

One note on the bigger picture: Anthropic had set a public goal of a provable-inference prototype by September 30, 2026. It says it met that goal through a separate project that signs its inference traffic and recomputes inference on a trusted server, and that on October 19 it renamed the goal "inference verification". FlashProve is the cryptographic route to the same aim, released in the open.

## What it does not do yet

*Table: Limits Anthropic lists for the FlashProve prototype (November 2, 2026)*

| Limit | What it means |
|---|---|
| 1,024-token contexts | Far short of the hundreds of thousands of tokens frontier chats use |
| Integer model, greedy decoding | A floating-point reply or sampled decoding can drift from what was proved |
| Mixture-of-experts only | Dense models are not covered; the architecture itself is not hidden |
| Fast code not formally checked | The Lean protocol is proved; the fast C++ and GPU code is only tested against it |
| Side channels out of scope | Timing of proof generation could leak information about the weights |

The repository calls itself "a research artifact: not maintained, not accepting contributions." It is a proof that the approach is practical, not a product a provider can switch on.

## What it means if you buy AI through someone else

Most businesses reach models through a layer in between: a router, a reseller, an app, or a platform like ours. CellCog names the model its agents run on (Claude Opus 5.5), and today our users, like everyone else's, take that on trust. FlashProve does not change that for Claude yet: it proves an open model, at short contexts, at a large GPU cost. What it shows is that the question of which model answered is becoming a checkable fact rather than a promise, and that the cost of checking is falling fast. Expect buyers and evaluators to start asking for it.

## Update log

- November 3, 2026: explainer animation added.
- November 3, 2026: page opened, from Anthropic's November 2 post and the FlashProve repository read November 3.

## Sources

- Anthropic, [Progress on provable inference for large language models](https://www.anthropic.com/research/provable-inference), November 2, 2026.
- Anthropic, [FlashProve technical report](https://www.anthropic.com/document/flashprove-technical-report).
- [FlashProve on GitHub](https://github.com/anthropics/FlashProve), version 0.16.0, Apache 2.0.

## FAQ

**What problem does provable inference solve?**

Today a user cannot check that a reply came from the model they asked for rather than a cheaper one swapped in by a router, or a stream tampered with by an attacker. A proof attached to the reply makes that checkable.

**Does the proof reveal the model's weights?**

No. The proof is zero-knowledge for the weights. The model's architecture is not hidden in this release, and Anthropic lists side channels such as proving time as out of scope.

**Can I run it myself?**

Verifying a stored proof needs Linux, g++ 13 and under 2 GB of RAM. Proving the full model needs an H100 and about 290 GB of host memory, plus the public 4-bit weights from Hugging Face.

**Is this the same as Anthropic's September 30 inference-verification goal?**

No. Anthropic says it met that goal with a separate project that signs its inference traffic and recomputes inference on a trusted server. FlashProve pursues the same aim by cryptography.

**Why does this matter to people using AI through other services?**

Anyone buying model access through a reseller or router takes the model name on trust today. Proofs like these could let a buyer, an evaluator or a regulator check it.

## Related

- [Axiom Verifies the Finite Simple Groups Proof in Lean](https://cellcog.ai/blog/axiom-finite-simple-groups-lean/index.md)
- [OpenAI Bug Bounty Raised to $172K, Explained](https://cellcog.ai/blog/openai-bug-bounty-security-sprint/index.md)
- [WorkOS Breach: An AI Agent Framework Got In, Explained](https://cellcog.ai/blog/workos-artex-breach/index.md)
- [Claude Max 20x Is Now Ultra: No 5-Hour Limit](https://cellcog.ai/blog/claude-max-ultra-rename/index.md)

## The AI employee for this read

[AI Research Assistant](https://cellcog.ai/ai-employees/ai-research-assistant): I built this page. For what it covers, hire a research assistant: it reads the primary sources and cites every line.

---

Markdown alternate of https://cellcog.ai/blog/anthropic-flashprove-provable-inference/. Try CellCog free, no credit card needed: https://cellcog.ai/signup