# Anthropic Releases FlashProve, a Claude-Built System That Cryptographically Proves Which Model Produced a Response

Times of AI Desk · 2026-11-04 · Research

[https://timesof.ai/2026/11/anthropic-flashprove-provable-inference-zksnark-open-source](https://timesof.ai/2026/11/anthropic-flashprove-provable-inference-zksnark-open-source)

> Anthropic published FlashProve on November 2, an open-source research prototype that produces zero-knowledge proofs that a given response came from a committed set of model weights, without revealing the weights. On Meta's 400-billion-parameter Llama 4 Maverick, it proves about 110 tokens a second on one H100, at roughly 70 to 95 times the GPU time of serving the model, and a CPU checks each 19MB proof in about 17 seconds. Anthropic says Claude produced the system's improvements.

FlashProve brings cryptographic proof of AI outputs closer to something a regulator, auditor or customer could run, though it is still about two orders of magnitude more expensive than serving the model. **Anthropic** published **FlashProve** on **November 2**, an open-source research prototype that lets a model provider prove that a response was produced by a specific, committed set of model weights, without revealing those weights.

## The problem it targets

A user querying a model today cannot check that responses came from the model a developer claims, "as opposed to one secretly substituted in by a routing service for cost reasons," or by an attacker tampering with the token stream, Anthropic wrote. FlashProve uses a **zkSNARK**, a short cryptographic proof that a computation was carried out correctly and that reveals nothing beyond that. The model's architecture is not hidden, Anthropic said.

## The numbers

On **Llama 4 Maverick**, Meta's 400-billion-parameter mixture-of-experts model, in public 4-bit weights, a single **H100** generates proofs at about **110 tokens a second**, with a proof of about **19MB** per 1,024-token request, Anthropic said. That is roughly **70 to 95 times** the GPU time of running the model on vLLM. Checking a proof takes **17 seconds** on 24 CPU threads, with no GPU needed. Anthropic said prior open-source systems were orders of magnitude slower.

Anthropic said **Claude** produced the improvements behind the system, and that because Claude's design decisions can be hard to evaluate, it supplied machine-checkable proofs of the main security properties in the Lean proof language. It released the code, Lean proofs and documentation under the **Apache 2.0** licence.

The model-substitution problem it describes is the same one behind OpenAI's new rule that [model routers and AI gateways need its approval](https://timesof.ai/2026/10/openai-usage-policies-model-routers-ai-gateways-need-approval-nov-20) from November 20.

## Limits

- Anthropic calls FlashProve a research prototype; it has not said it will deploy it on Claude.
- Proofs cover only contexts of up to 1,024 tokens, an integer version of the model, and greedy decoding, so sampled or floating-point outputs may not match exactly.
- Anthropic says it does not guarantee that the fast executable code matches its Lean specification.
- The performance figures are Anthropic's own and have not been independently reproduced.
- This was published on November 2, before our previous edition's research window; we include it now because we missed it.

## Sources

- [Anthropic: Progress on provable inference for large language models (November 2, 2026)](https://www.anthropic.com/research/provable-inference)