Anthropic announced FlashProve on November 2, 2026, as an open-source research prototype for checking whether selected output tokens match a model fixed by a commitment to its weights. The proof concerns a specified computation, not whether an answer is true or useful. Anthropic’s description of FlashProve sets out both the claim and the prototype’s limits.

What the proof checks

A zkSNARK is a cryptographic proof designed to let someone check a claim without seeing the private information behind it. In FlashProve, Anthropic describes a two-part process: first, a provider commits to a particular set of model weights; later, it generates a proof that selected output tokens match that committed model’s computation for a prompt.

The commitment acts like a cryptographic fingerprint for the chosen weights. A verifier can check the commitment, prompt, reply and proof without receiving the weights themselves. The proof can hide weights and certain intermediate computation values, but it does not hide the model’s architecture.

That is a claim about model-output provenance, not answer quality. A valid proof does not establish that a response is factually correct or that the model is safe.

What Anthropic measured

Anthropic evaluated FlashProve with Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, using a public third-party 4-bit conversion of its weights. The proof concerns an integer version of the model and uses greedy decoding, which selects the highest-scoring next token rather than sampling among alternatives.

With one H100 GPU and 24 CPU cores, Anthropic reports proving a batch of 24 requests in about 223 seconds, at a throughput of roughly 110 tokens per second. Each proof was 18.78 MB and checked one token. The evaluation used a 1,024-token request window, which is also the prototype’s stated maximum context length.

Verification ran on a CPU in Anthropic’s evaluation: it took 17 seconds with 24 threads or 21 seconds with one thread. The client-side model commitment was about 6.5 MB. Preparing that commitment took about 39 minutes per model, and Anthropic says it can be used for about 16 million requests before renewal.

Those figures come with a steep proving cost. In a comparison with vLLM processing the same batch, Anthropic used the FP8 release of the same model on eight H100s. It reports that FlashProve required about 72 times as much GPU time per GPU, with results ranging from 66 to 77 times across runs; at the highest vLLM load tested, the reported difference was about 94 times.

Where the proof’s scope stops

FlashProve works after inference: it proves completed text in batches rather than attaching a proof to every token as the model generates it. Anthropic describes proofs for a subset of tokens, with each proof checking one token in its evaluation. That means the assurance arrives later and does not automatically cover every token in a response.

The stated proof covers an integer model under greedy decoding. It does not establish that a response produced with sampled decoding or floating-point arithmetic matches that computation. Nor does the published claim amount to a general attestation of settings such as temperature or search effort. Those are distinct from checking output against committed weights.

There is also a gap between the formal specification and the fast executable implementation. Anthropic used Lean, a proof assistant for writing and checking mathematical proofs, to formalize top-level security statements. But the company says the paper, Lean protocol and executable code are not formally guaranteed to match. The C++ verifier agreed with the Lean verifier on every proof in Anthropic’s tests, while the fast verifier itself has no formal guarantee of equivalence.

What Anthropic released

The open-source release includes a prover, C++ and Lean verifiers, a protocol specification, Lean proofs and an interactive theorem visualizer. Anthropic says the code, Lean proofs and documentation use the Apache 2.0 license. The Llama model weights are not included; the evaluation used a third-party conversion.

FlashProve is an intermediate research prototype. Its central trade-off is clear in Anthropic’s results: checking selected tokens against committed weights is possible without revealing those weights, but generating the proof took substantially more GPU time than the stated ordinary-inference comparison.