Anthropic on November 2, 2026 published research on FlashProve, an open-source prototype for provable inference. The system uses zkSNARKs so a model provider can commit to a set of weights, then attach a short proof that a given reply was produced by those weights. The proof is meant to hide the weights while letting a verifier check the claim on an ordinary CPU.
The release includes a technical report, a protocol specification, prover and verifier code, and Lean formalizations of top-level security claims. Code, Lean proofs, and documentation are under Apache 2.0. The GitHub repo labels the project a research artifact that is not maintained. TechCrunch reports there are no plans to deploy FlashProve at Anthropic or other labs.
Key Facts
| Item | Detail |
|---|---|
| Name | FlashProve |
| Published | Nov 2, 2026 (Anthropic research post) |
| Method | zkSNARK (interactive oracle proof compiled with hash functions) |
| License | Apache 2.0 |
| Demo model | Llama 4 Maverick, 400B MoE, 4-bit; ~17B active parameters per token |
| Proving throughput | About 110 tokens/s on one H100 (batch of 24 requests) |
| Proof size | About 19 MB per 1,024-token request (18.78 MB in detailed figures) |
| Overhead vs vLLM | Roughly 70–95× GPU time of plain inference (Anthropic measurement) |
| Offline commitment | About 39 minutes; usable for about 16 million requests; ~6.5 MB to download |
| Verification | About 17 s on 24 CPU threads; about 21 s on one thread |
| Repo | github.com/anthropics/FlashProve |
Background
Users of hosted models usually cannot tell whether a response came from the model they selected. Anthropic lists cases where that matters: a routing service substituting a cheaper model, an attacker altering the token stream, evaluators checking the served model, or regulators asking for evidence that approved models were used.
FlashProve splits work into an offline commitment to the weights and an online proof per request. Completeness and soundness aim to make honest proofs accept and forged proofs fail under standard cryptographic assumptions. Zero knowledge is meant to reveal nothing about the weights beyond the statement; the model architecture is not hidden. Anthropic states top-level completeness, soundness, and zero-knowledge properties in Lean for the protocol, and ships both a fast C++ verifier and a slower Lean verifier.
What We Don't Know Yet
Anthropic presents FlashProve as intermediate progress, not a finished product. Stated limits include:
- Context windows up to 1,024 tokens per proved request.
- Proofs about an integer version of the weights under greedy decoding; floating-point or sampled decoding can diverge.
- Efficiency gains assume a Mixture-of-Experts architecture; dense models and architecture hiding are out of scope for this release.
- No formal guarantee that the Lean protocol, the paper, and the fast executable code fully match.
- Side-channel leaks such as proving time are out of scope.
Whether other labs adopt the artifacts, or whether Anthropic later ships a production verifier for Claude traffic, is not answered in the sources used here.