Anthropic released FlashProve on November 2, 2026, as an open-source research prototype for proving that a model identified by a cryptographic commitment to its weights produced specified output tokens for a given prompt. The proof is designed to hide the weights, but it does not establish that an answer is true or good, and Anthropic’s reported tests show a substantial compute cost for generating proofs. Anthropic’s research announcement
What FlashProve proves
FlashProve uses a zero-knowledge proof, a cryptographic method that lets someone check a claim without seeing the private information behind it. Here, the claim ties together a model’s committed weights, a prompt, and the output tokens. A verifier can check the proof without receiving the weights or the intermediate values from the computation.
That establishes a specific kind of provenance: the committed model produced the claimed tokens for that prompt under the computation being proved. It does not certify the response’s truth, safety, or quality. The proof also does not hide the model’s architecture.
What Anthropic measured, and at what cost
Anthropic tested FlashProve with Meta’s Llama 4 Maverick, a mixture-of-experts model with 400 billion parameters and about 17 billion active per token. The test used publicly available 4-bit weights. For a batch of 24 requests, one H100 GPU and 24 CPU cores generated proofs in about 223 seconds, at roughly 110 tokens per second. Each proof was 18.78 MB.
| Measure | Anthropic’s reported result | Test conditions |
| Proof generation | About 223 seconds; about 110 tokens per second | Batch of 24 requests; one H100 GPU and 24 CPU cores; Llama 4 Maverick with public 4-bit weights |
| Proof size | 18.78 MB per proof | Same reported Llama 4 Maverick test |
| Verification | 17 seconds with 24 CPU threads; 21 seconds with one thread | No GPU required |
| Model commitment | About 39 minutes; usable for about 16 million requests | One commitment phase per model |
| Proving overhead | About 72 times longer per GPU across runs, with a reported range of 66–77 times | Compared with vLLM running the model’s FP8 release on eight H100 GPUs |
| Highest-load overhead | About 94 times longer | Compared with vLLM at its highest tested load |
The headline throughput describes proof generation, not ordinary model inference. Anthropic’s comparison also separates the proof workload from the vLLM baseline: the proving result used one H100 and 24 CPU cores, while vLLM ran the FP8 model on eight H100s. The 72-times figure is a per-GPU time comparison across runs; Anthropic reported about 94 times at vLLM’s highest tested load. These figures are Anthropic’s measurements under those test conditions.
Verification itself is lighter than proof generation in the reported test: it ran on a CPU, while producing the proof required GPU resources. FlashProve also requires a commitment phase of about 39 minutes for each model, which Anthropic says can support roughly 16 million requests before another commitment is needed.
The current proof has a narrow scope
FlashProve proves an exact integer version of published model weights under greedy decoding, where the model selects the highest-scoring next token at each step. Its stated context limit is 1,024 tokens. Floating-point inference or sampled decoding can produce different outputs from the computation covered by the proof.
The proof hides weights and intermediate computation, not the model architecture. Anthropic describes hiding the architecture as possible future work. Proof generation also happens after inference, so assurance arrives later, and the system may need to recompute work to produce a proof.
What the formal checks cover
Anthropic provides a Lean formalization and proofs of top-level protocol properties, along with a Lean verifier and a faster C++ verifier. The formalization does not guarantee that the fast executable, the research paper, and the Lean protocol all match. Anthropic also identifies manual audits of the formal statements and executable code as necessary trust steps.
The zero-knowledge property applies to the proof itself. Anthropic says timing side channels during proof generation could reveal information about the weights, and that addressing those attacks is outside this release’s scope.
