Anthropic's FlashProve lets anyone check which AI model wrote a reply, without seeing its weights

A 19 MB proof that checks in seconds without a GPU could catch a router quietly swapping in a cheaper model.

By Think Facility · November 4, 2026 · Anthropic AI safety

On November 2, 2026, Anthropic's Frontier Red Team published FlashProve, open-source code that attaches a cryptographic proof to an AI model's reply showing which model wrote it. The code had gone up on GitHub a few days earlier, on October 30, under the Apache 2.0 license.

When you send a prompt to a model today, you've got no way to check that the model you picked is the one that answered. A routing service could quietly swap in a cheaper one to save money. So could an attacker who tampers with the tokens on the way back, and the text alone won't show it.

What FlashProve does

It's built on a zkSNARK, the kind of proof already used by blockchain networks such as Starknet. The provider first publishes a commitment to its weights, a short fingerprint that pins down one exact model while keeping the weights hidden. Each reply then comes with a proof file that anyone holding the commitment, the prompt and the reply can check, with no GPU.

Model tested: Llama 4 Maverick, a 400B-parameter mixture of experts
Proving speed: about 110 tokens per second on a single H100
Proof size: about 19 MB per 1,024-token request
Checking a proof: 17 seconds on 24 threads
Cost: about 70 to 95 times the GPU time of running the model

Anthropic ran it on Meta's Llama 4 Maverick, using a public 4-bit conversion of the weights (they aren't in the release, so readers download them from Hugging Face). The proof hides the weights and which experts ran at each layer. It doesn't hide the model's architecture.

Anthropic gives Claude the credit for the speed.

Claude has produced improvements on zkSNARKs for inference, building a system that is substantially faster than prior open-source systems.

From Progress on provable inference for large language models \ Anthropic

Claude's choices in a big system can be hard to judge, so the team wrote the security guarantees as statements in Lean, a formal verification language. It shipped two verifiers (one slow, one fast). Lean proves the slow one accepts only what the soundness theorem allows. The fast C++ one, which Anthropic says to use day to day, carries no formal guarantee, though it agreed with the Lean verifier on every proof in Anthropic's tests.

How much faster is it?

A lot, if the numbers in the post hold up. The only earlier proof of Llama 4 Maverick that Anthropic knew of, a system called VerInf, took 14.3 hours for 1,000 tokens and made a 93.6 GB proof that took almost a day to verify. In 2024, zkLLM proved a 13B model at about 2.5 tokens a second. Granted, these are Anthropic's own measurements, and I haven't seen anyone outside the company rerun them yet.

A company called Attestable reports 53 to 77 tokens a second on a dense 31B model, but it hasn't released open-source code. I'd read the comparison with that in mind: Maverick is far bigger on paper, but only about 17B of its parameters run for each token, and the prover's work scales with those.

What it could change outside the labs

If you pay a third-party router for one model, a proof would show you actually got it. Anthropic adds one for software buyers: a developer who says a frontier security model scanned their library for bugs could attach proof that it did, where chat logs could be faked with a cheaper model.

I think the bigger stakes are for governments. Anthropic sketches a rule that providers may serve only models approved as safe, which a regulator could enforce by checking proofs instead of rerunning requests. It also ties the work to pacing, the slowdown Dario Amodei asked for in We Must Pace the Frontier: a regulator could ask for proofs that a provider's chips were serving the claimed model. The post is upfront that this has a gap.

although this verifies that the hardware is serving inference, it does not establish that the hardware is not, e.g., training on the side.

Progress on provable inference for large language models \ Anthropic

None of these rules exists yet, and the sources don't say when FlashProve could reach a product. Anthropic calls it a research prototype, and the GitHub page marks it as not maintained. Proofs cover contexts of up to 1,024 tokens, and only greedy decoding of an integer version of the weights.

The September 30 goal

Anthropic had promised this. Its Frontier Safety Roadmap set a public goal of a provable inference prototype by September 30, 2026. The post says Anthropic met that goal through a separate project that signs its inference traffic and recomputes inference on a trusted server, and FlashProve chases the same goal by a different method.

In an update on October 19, 2026, Anthropic renamed the goal "inference verification", saying the old name suggested a narrower approach than it believes is necessary. For the next version, the team says it plans to hide architecture details too.