AnswersPublished31 sources
Anthropic FlashProve: How AI Inference Proofs Work—and Their Limits
FlashProve is an open source research prototype that uses zkSNARKs to prove checked tokens meet a rule under committed model weights, without disclosing the weights. It can help check model identity and make some forms of chat hijacking harder, but it does not prove that a model is safe or that sampled tokens follow...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- FlashProve is an open source research prototype that uses zkSNARKs to prove checked tokens meet a rule under committed model weights, without disclosing the weights.
- It can help check model identity and make some forms of chat hijacking harder, but it does not prove that a model is safe or that sampled tokens followed a particular random distribution.
- Anthropic’s code is released under Apache 2.0, but the repository describes FlashProve as an unmaintained research artifact that is not accepting contributions.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is Anthropic’s FlashProve, the open-source cryptographic research prototype reported on November 4, 2026, and how does it address model. Article summary: FlashProve is Anthropic’s open-source research prototype for “provable inference”: a provider attaches a zkSNARK cryptographic proof tying a reply to previously committed model weights, without disclosing those weights. . Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
FlashProve is Anthropic’s open-source prototype for provable inference: a provider commits to a set of model weights, then creates a cryptographic proof that specified response tokens satisfy an agreed rule under those weights. A client can check the proof without seeing the weights. The key qualification is that FlashProve proves a defined token-level claim—not that a model is safe, that every serving detail was honest, or that every style of sampled output was generated as claimed. 10
29
What FlashProve can—and cannot—show
A verified response can be tied to a particular weight commitment rather than relying only on a service’s model-name label. That could help expose model substitution and make some chat-hijacking attempts harder: a reply that does not verify against the expected commitment can be rejected. Anthropic also points to a safety-evaluation use case: checking that the model tested is the same model later served to customers. 10
40
Those uses depend on clients knowing which commitment they should trust. A proof checks against the commitment and public files supplied for verification; it does not, by itself, establish that a commitment genuinely belongs to a provider’s advertised model. And proving model identity is not a safety certification: an authentic model can still produce harmful or incorrect answers. 30
32
The two phases: commit once, prove responses
1. Offline commitment. The provider runs FlashProve’s committer on the model weights and publishes commitment material. The commitment includes a 32-byte fingerprint, called the commitment ID, that binds the proof to a specific set of weights. The weights themselves remain undisclosed. 30
39
2. Online proof. For a response, the provider generates a proof that the checked tokens meet an acceptance policy under those committed weights. FlashProve’s default exact-match policy requires each checked token to be the model’s greedy choice. Its documented clipped-gap alternative checks whether token scores meet an accepted score-gap rule; that is a different claim from proving that tokens were sampled honestly from a specified random distribution. 20
32
3. Client verification. The client checks the proof against the expected commitment ID and associated public commitment files, along with the request, token claim and policy. The verifier runs on a CPU and does not need access to the private weights or a GPU. 29
30
34
This separation is why the design could be relevant to providers of closed models: they can offer a way to check an inference claim without handing clients the model parameters. That is a possible application, not evidence that a commercial service has deployed FlashProve. 16
29
What the Llama 4 Maverick demonstration showed
FlashProve was demonstrated on Meta’s Llama 4 Maverick, a roughly 400-billion-parameter mixture-of-experts model. The reported performance figures need context: the throughput came from a batch of requests, not from a single user’s chat stream. 3
7
- Proving throughput: About 110 tokens per second on one Nvidia H100 across a batch of 24 requests, each using a 1,024-token window. The batch took about 223 seconds.
1
- Proof size: About 18.78 MB—often rounded to 19 MB—for each 1,024-token request.
- Verification: About 17 seconds on a 24-thread CPU in the reported benchmark; a one-thread run took about 21 seconds.
19
- Commitment setup: The reported one-time commitment phase took about 39 minutes; published commitment material was roughly 6.5 MB.
13
The repository also includes a Lean verifier and machine-checked soundness results, but the scope matters. The documented soundness claim concerns the Lean verifier and exact-match claims under stated assumptions; the clipped-gap policy supports a narrower claim. This should not be mistaken for a proof that every implementation, deployment or decoding mode is covered by the same guarantee. 32
33
The trade-offs and limits
Proof generation is expensive. The reported proving workload uses roughly 70–95 times the GPU time of ordinary vLLM inference. That is a major overhead for a system intended to attach evidence to responses. 1
8
The demonstrated window is short. The repository describes a 1,024-token context window for the full-size demonstration, so the result does not establish support for longer contexts. 23
Batch throughput can hide waiting time. The headline rate is aggregate throughput for a batch of 24, which took about 223 seconds to process. In a service, time spent waiting to assemble a batch could add to the user’s latency. 1
The decoding guarantee is specific. Exact-match checks greedy choices. The clipped-gap option is not a proof that output tokens were drawn honestly from a particular random sampling distribution. Neither policy proves that the model’s answer is safe, truthful or useful. 20
32
Who built it, and what is its release status?
Anthropic’s Frontier Red Team developed FlashProve with collaborators from EPFL, MIT and StarkWare. The listed authors include Anthropic researchers Roy Rinberg and Alex Allain, and cryptographer Alessandro Chiesa, alongside other collaborators. 10
31
The code is released under the Apache 2.0 license. However, the repository labels FlashProve a research artifact that is not maintained and not accepting contributions; open-source licensing should not be confused with an invitation to submit changes to the project. 21
31
35
Reporting says Anthropic has no plans to deploy FlashProve at Anthropic or elsewhere. Taken together with the repository’s maintenance notice, that frames it as a research prototype for exploring verifiable inference—not a finished product or a supported production service. 15
35
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Anthropic FlashProve: How AI Inference Proofs Work—and Their Limits"?
FlashProve is an open source research prototype that uses zkSNARKs to prove checked tokens meet a rule under committed model weights, without disclosing the weights.
What are the key points to validate first?
FlashProve is an open source research prototype that uses zkSNARKs to prove checked tokens meet a rule under committed model weights, without disclosing the weights. It can help check model identity and make some forms of chat hijacking harder, but it does not prove that a model is safe or that sampled tokens followed a particular random distribution.
What should I do next in practice?
Anthropic’s code is released under Apache 2.0, but the repository describes FlashProve as an unmaintained research artifact that is not accepting contributions.