Anthropic Releases FlashProve, a Claude-Built System That Cryptographically Proves Which Model Produced a Response
Anthropic published FlashProve on November 2, an open-source research prototype that produces zero-knowledge proofs that a given response came from a committed set of model weights, without revealing the weights. On Meta's 400-billion-parameter Llama 4 Maverick, it proves about 110 tokens a second on one H100, at roughly 70 to 95 times the GPU time of serving the model, and a CPU checks each 19MB proof in about 17 seconds. Anthropic says Claude produced the system's improvements.
FlashProve brings cryptographic proof of AI outputs closer to something a regulator, auditor or customer could run, though it is still about two orders of magnitude more expensive than serving the model. Anthropic published FlashProve on November 2, an open-source research prototype that lets a model provider prove that a response was produced by a specific, committed set of model weights, without revealing those weights.
The problem it targets#
A user querying a model today cannot check that responses came from the model a developer claims, "as opposed to one secretly substituted in by a routing service for cost reasons," or by an attacker tampering with the token stream, Anthropic wrote. FlashProve uses a zkSNARK, a short cryptographic proof that a computation was carried out correctly and that reveals nothing beyond that. The model's architecture is not hidden, Anthropic said.
The numbers#
On Llama 4 Maverick, Meta's 400-billion-parameter mixture-of-experts model, in public 4-bit weights, a single H100 generates proofs at about 110 tokens a second, with a proof of about 19MB per 1,024-token request, Anthropic said. That is roughly 70 to 95 times the GPU time of running the model on vLLM. Checking a proof takes 17 seconds on 24 CPU threads, with no GPU needed. Anthropic said prior open-source systems were orders of magnitude slower.
Anthropic said Claude produced the improvements behind the system, and that because Claude's design decisions can be hard to evaluate, it supplied machine-checkable proofs of the main security properties in the Lean proof language. It released the code, Lean proofs and documentation under the Apache 2.0 licence.
The model-substitution problem it describes is the same one behind OpenAI's new rule that model routers and AI gateways need its approval from November 20.
Limits#
- Anthropic calls FlashProve a research prototype; it has not said it will deploy it on Claude.
- Proofs cover only contexts of up to 1,024 tokens, an integer version of the model, and greedy decoding, so sampled or floating-point outputs may not match exactly.
- Anthropic says it does not guarantee that the fast executable code matches its Lean specification.
- The performance figures are Anthropic's own and have not been independently reproduced.
- This was published on November 2, before our previous edition's research window; we include it now because we missed it.