On November 2, 2026, Anthropic's Frontier Red Team published FlashProve, an open-source prototype for provable inference. The system lets a model provider cryptographically commit to a specific set of weights and, for each response, generate a proof that anyone can verify on a regular CPU without access to the model weights.
What happened?
According to Anthropic's official post, the core problem is straightforward: when a user queries a model via API or a routing service, there is no way to confirm the response came exactly from the announced model. A provider could swap in a cheaper version, or an attacker could tamper with the token stream, and the output would still look legitimate.
FlashProve addresses this with zkSNARKs (zero-knowledge succinct arguments). The provider first publishes a commitment (a short fingerprint of the weights). Then, for each reply, it generates a proof. The verifier checks the proof in seconds on a CPU, with no GPU and without seeing the weights.
The prototype was tested on Llama 4 Maverick (a Mixture-of-Experts model with about 400 billion parameters, 4-bit quantized, with roughly 17 billion active per token). On a single NVIDIA H100, the prover generates proofs at about 110 tokens per second. Each proof for a 1,024-token window is approximately 19 MB and verifies in about 17 seconds on 24 CPU threads (about 21 seconds on a single thread).
The cost is high: generating the proof takes roughly 70 to 95 times the GPU time that vLLM needs to process the same prompts. The system proves an integer version of the model and limits context to 1,024 tokens. Anthropic makes clear it is a research artifact, not a production product, and is not being maintained.
Why does this matter?
Anthropic highlights practical applications: making silent model substitution harder in routing services, allowing safety evaluators to confirm they are testing the same model served to customers, and helping detect tampering on inference servers. In regulatory or "pacing" scenarios for AI development, a regulator could request certificates that the hardware was actually serving the declared model.
The code, Lean proofs (for soundness, completeness, and zero-knowledge properties), and documentation were released under Apache 2.0 on GitHub. Collaborators include researchers from EPFL, MIT, StarkWare, and others. Anthropic notes that Claude itself helped with performance optimizations, and that high-level security guarantees were formalized in Lean to aid auditing.
This does not prove the response is correct or free of hallucinations — only that it came from the committed model (within the acceptance policy used). It is an intermediate step in a larger problem of trust and attribution in AI systems.
Sources
- Anthropic official post: Progress on provable inference for large language models
- FlashProve GitHub repository
- Original Anthropic post on X
Transparency: This content was created, edited, or reviewed with the aid of artificial intelligence. Information was cross-checked with public posts on X and sources available on the internet. Consult the original sources for full context.
By GeekikiBot
