Anthropic open-sources FlashProve for provable AI inference

Overview

Updated 1 hour ago

When you call an AI model through an API, nothing in the reply proves which model produced it. A routing service could swap in a cheaper model, or an attacker could edit the token stream, and the output would look the same. On November 3, Anthropic published FlashProve, an open-source system that attaches a cryptographic proof to each reply.

The proof is checked against a short fingerprint of the model's weights, published once by the provider. A verifier on an ordinary CPU can confirm the reply came from those exact weights in about 17 seconds, without ever seeing them. Anthropic measured 110 tokens per second on a single H100 for Llama 4 Maverick, a 400-billion-parameter model.

Why it matters

If labs adopt it, you could check which model actually answered your API call instead of trusting the provider's word.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

110

Proofs generated per second

Tokens per second proved on a single H100 for Llama 4 Maverick in 4-bit weights.

19 MB

Proof size per 1,024-token request

Each proof file is about 18.78 MB, small enough to download and check on a laptop.

17 sec

Verification time on 24 CPU threads

Checking a proof needs no GPU; a single thread takes about 21 seconds.

72-94x

Proving slowdown versus plain inference

Per GPU, proving took 72 to 94 times longer than vLLM running the same model.

1,024

Maximum context length proved

Far shorter than the context windows frontier chat models use.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Anthropic

AI research company

Published FlashProve and its technical report under the Apache 2.0 license

AI lab that built and open-sourced the FlashProve proof system for model inference.

Timeline

1 event Latest: Yesterday

November 2026
Anthropic publishes FlashProve
Latest Release

Anthropic open-sources a zkSNARK system that proves a reply came from committed model weights, benchmarked on Llama 4 Maverick.
Yesterday

Scenarios

A major AI lab ships proofs in its production API

Possible Resolves by Nov 3, 2027

Discussed by: Anthropic's research post and TechCrunch coverage

A provider publishes a weight commitment and returns a proof with each response, letting clients check the model without seeing the weights. The trigger is a lab deciding the overhead is worth it for enterprise or evaluator customers. Anthropic has not announced deployment plans.

FlashProve stays a research prototype

Likely Resolves by Nov 3, 2027

Discussed by: Anthropic's own framing of the release as intermediate progress

The 1,024-token context limit, the integer-model and greedy-decoding assumptions, and the 72-94x proving slowdown keep the system out of commercial use. Researchers cite and extend the code, but no provider offers proofs to customers.

Regulators or evaluators require proofs for approved models

Unlikely Resolves by Q2 2028

Discussed by: Anthropic's research post, which names compliance with AI pacing requirements as a use case

Governments or independent evaluators adopt proof requirements so they can confirm the model they test is the model being served. This depends on the context limit and the floating-point gap being resolved, and on a regulator writing the requirement into rules.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2013

Certificate Transparency (2013)

After the 2011 DigiNotar breach, in which a compromised certificate authority issued fraudulent certificates, Google proposed public append-only logs of every TLS certificate. Browsers could then check that a certificate they received had been publicly recorded.

Then

Browsers began requiring Certificate Transparency for extended-validation certificates, and certificate authorities had to submit to logs.

Now

Logging became a standard part of web PKI, making mis-issued certificates detectable after the fact.

Why this matters now

FlashProve applies the same idea to model outputs: publish a commitment, then prove each reply matches it, so substitution becomes detectable.

2021

Sigstore (2021)

Google and partners launched Sigstore, an open-source service for signing and verifying software artifacts. Signatures tied to a developer's identity let users check that a binary came from the expected source.

Then

Major open-source projects and package registries began signing releases.

Now

Signed artifacts became a practical supply-chain security layer, adopted by npm, PyPI and container registries.

Why this matters now

Both systems turn a trust-me claim into a checkable proof. FlashProve does it for model inference rather than software builds.

2015

Intel SGX remote attestation (2015)

Intel's Software Guard Extensions let a remote party verify which code was running inside a hardware enclave, without seeing the code's data. Cloud providers used it to attest to workloads.

Then

Attestation enabled confidential-computing products for sensitive workloads.

Now

Side-channel attacks weakened confidence in SGX, and the technology remained niche.

Why this matters now

It shows both the promise and the limits of attestation: proving what ran is useful, but side channels and overhead can keep it out of wide use.