Anthropic’s FlashProve proves which AI model wrote a reply, at 72x the cost

Anthropic has open-sourced FlashProve, a research prototype that lets anyone check that a given AI response came from a specific model. In its announcement on X, the company says it is substantially more efficient than earlier open-source methods.

Proofs for a 400B model on one GPU

According to Anthropic’s write-up, FlashProve is a zero-knowledge succinct argument (zkSNARK) built around Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model in a 4-bit quantized form. The provider publishes a short commitment to the model weights once, and the weights stay hidden. For each request, the provider generates a proof file. Anyone holding the commitment, the prompt and the reply can then check that the committed model produces those output tokens.

Anthropic gives these figures for a single H100 GPU with 24 CPU cores:

• The one-time commitment takes about 39 minutes and covers roughly 16 million requests.
• A batch of 24 requests is proven in about 223 seconds, or about 110 tokens per second.
• Each proof for a 1,024-token request is about 19 MB.
• Verification takes about 17 seconds on 24 threads, or 21 seconds on one.
• The prover needs an 80 GB GPU plus around 290 GB of host memory.

Proving work scales with the roughly 17 billion parameters active per token, not all 400 billion. Proofs are generated after inference, in batches, rather than alongside it. Anthropic says this avoids the security tradeoffs of in-line proving, at the price of slower guarantees and extra recomputation.

The code is released under Apache 2.0 in the FlashProve repository, together with a prover, a fast C++ verifier, and Lean proofs of the protocol. Model weights are not included. Users download the 4-bit Llama 4 Maverick conversion from Hugging Face under Meta’s license. Anthropic names collaborators from EPFL, MIT and its own fellowship programs, among them Alessandro Chiesa, Giacomo Fenzi and Miranda Christ.

What the proofs are meant to protect against

Anthropic’s post on X says the proofs can “make it harder for attackers to hijack a chat”. It adds that they can let safety evaluators confirm the model under test is the one served to customers. The write-up lists further uses: spotting a compromised server or a swapped model, letting regulators check that only approved models are deployed, and confirming that a particular model reviewed a piece of work.

One use case concerns compute oversight. Regulators could check that hardware is serving inference. Anthropic notes this would not rule out training on the side. It also describes the approach as complementary to trusted-execution-environment methods, not a replacement.

A 72x overhead against slower predecessors

The efficiency claim has to be read against the cost. Anthropic puts FlashProve’s overhead at about 72x per GPU compared with serving through vLLM, within a range of 66x to 77x. At the highest load it tested, the figure rises to about 94x. In practice, proving every answer a busy chatbot gives is not realistic today. Sampling audits, high-stakes queries or evaluation runs are the more plausible fits.

The comparison with earlier work is where the gain shows. By Anthropic’s account, the zkLLM system reached about 2.5 tokens per second on LLaMA-2-13B in batch mode on an A100. DeepProve managed about 2.9 tokens per second on GPT-2. For the same Llama 4 Maverick model, a system called VerInf reportedly took 14.3 hours for 1,000 tokens on a DGX Spark, and produced a 93.6 GB proof that took nearly a day to verify. FlashProve’s roughly 110 tokens per second and 19 MB proofs are orders of magnitude smaller. Anthropic also cites a commercial system, Attestable, at 53 to 77 tokens per second for a dense 31B model, but says it has no open-source code. These comparisons come from Anthropic and have not been independently checked.

The tool also carries clear limits, which Anthropic lists itself:

• It covers a context of only 1,024 tokens, far below frontier models.
• The proof applies to an exact integer version of the weights under greedy decoding. Floating-point or sampled outputs may diverge.
• The mixture-of-experts architecture is not hidden.
• Timing side channels are out of scope.
• The C++ verifier has no formal guarantee. It matches the Lean verifier in tests.

The README adds that the project is a research artifact that is not maintained and does not accept contributions. Its only supported prover platform is an H100 80 GB with CUDA 13.2. Commitment IDs must come from a party the user trusts, not from the server being checked.

A trust problem regulators already face

Knowing which model sits behind an API matters for oversight. We reported earlier on how governments test frontier models before release. Those checks assume the tested model is the one later deployed, and a cryptographic proof is one way to back that assumption. FlashProve does not yet cover this at scale. It targets an open-weight model rather than Anthropic’s own Claude models, and the post does not say when or whether it will be applied to them.

Anthropic frames the work as progress, saying further advances in provable inference will likely be an important part of building trust in AI deployment. The company has not said whether it plans to maintain the code. The README says it is unmaintained, so any follow-up would come from the research community or from future Anthropic work.