Anthropic Open-Sources FlashProve, Using Zero-Knowledge Proofs to Verify Model Inference Provenance

On November 2, Anthropic released FlashProve, a research prototype for verifiable inference that turns the question “Did the API actually run the specified model?” into a checkable cryptographic claim. A provider first publishes a commitment bound to specific weights, then generates a zero-knowledge proof for the inference result. Given the commitment, prompt, and output, users can check the result without obtaining the weights. The proof also hides intermediate values and expert selections, but not the model architecture. Official research overview

The system uses post-hoc batch proofs, rechecking completed text with a parallel process similar to prefill. For MoE models, the proof workload grows with the number of experts actually activated, avoiding the need to process all parameters for every token. Weights are streamed in chunks from host memory to the GPU. In tests with four-bit-quantized Llama 4 Maverick on a single H100 and batches of 24 requests, Anthropic reported proof throughput of about 110 tokens per second. This measures proof computation and should not be interpreted as chat generation speed. Tests and architecture

For engineering teams using model gateways or external inference providers, this offers a technical direction for checking which weights were actually run. Verification still requires a trusted starting point, however: the repository explicitly says the model commitment identifier should come from a source the user trusts, rather than simply accepting the value supplied with the proof by the server being checked. Otherwise, the user could still end up verifying a different set of weights. Repository and verification guide

The current proof covers integer model operations in contexts of up to 1,024 tokens and checks whether each token was selected by greedy decoding. It cannot be directly extended to arbitrary floating-point operations or sampling configurations. Anthropic’s comparison also shows that proof generation requires roughly 70 to 95 times as much GPU time as vLLM inference, and the two sides use different quantization settings. The Lean formalization covers protocol security; it does not guarantee that the fast implementation exactly matches the formal version. The repository describes the project as an unmaintained research artifact. Follow-up areas include independent replication, support for longer contexts, and verification that the implementation matches the protocol. Limitations, project status