Analysis
Anthropic releases FlashProve, an open source research prototype that proves a reply came from a committed model, within limits of greedy decoding, 1,024 tokens and an open model
Anthropic published FlashProve, a prototype that checks a reply came from a committed model. Greedy decoding, 1,024 tokens, open model, unmaintained.
- New AI technologies
- #Anthropic
- #FlashProve
- #provable inference
- #zero-knowledge proofs
- #open source
- #AI safety
On November 2, 2026, Anthropic's Frontier Red Team published a post and open source code for FlashProve, a research prototype of provable inference: checking cryptographically that a reply came from a committed model, not a substitute. It is research, not a product. We read the sources only through automatic summaries and ran nothing. This is neither legal nor security advice.
The essentials
- What it is: per Anthropic, a zkSNARK-based prototype letting a user check a reply came from a committed model without its weights. Apache 2.0 code; no weights included.
- Where it stands: the repository is marked unmaintained; TechCrunch reports no deployment planned.
- The limits: greedy decoding, 1,024 tokens, an open model (Llama 4 Maverick, not Claude), and roughly 70 to 95 times the GPU time of a vLLM service.
- Not established: how a fingerprint is tied to a commercial model's advertised identity, and adoption.
What does Anthropic publish?
Anthropic's post and the repository (anthropics/FlashProve, v0.16.0) cover the code, the Lean proofs and the documentation. TechCrunch reports that Anthropic calls the post an interim progress report. Anthropic says its roadmap goal of a provable inference prototype was met by a separate project, renamed "inference verification"; FlashProve is the purely cryptographic route, without trusted hardware (via The Decoder and CellCog). Anthropic adds that Claude improved the zkSNARK work and drafted the protocol specification, with Lean used to state guarantees humans can audit.
How it works, in three steps
According to Anthropic and GitHub:
- Commitment: the provider publishes a short fingerprint that fixes a set of weights without revealing them.
- Proof: for each request, its GPU proves that the committed model generates these output tokens for this prompt.
- Verification: anyone checks the proof on an ordinary CPU, without the weights.
On one H100 GPU, the sources give about 110 tokens per second of proof generation, a proof of about 19 MB for 1,024 tokens, about 17 seconds to verify on 24 CPU threads. The prover needs a dedicated 80 GB H100 and about 330 GB of RAM (GitHub).
Source: Anthropic, GitHub.
What the proof establishes, and what it does not
CellCog reports that a provider serving another model cannot produce a valid proof for the committed one; GitHub says this soundness is proven in Lean, with a bounded error probability, not zero. The test model was Meta's Llama 4 Maverick via a third party's 4-bit conversion: FlashProve proves an open model, not Claude.
The proof shows consistency with a fingerprint. In the pages we read, neither Anthropic nor GitHub details how a fingerprint is tied to a commercial model's public identity. GitHub adds that the commitment identifier must come from a party the verifier trusts, not from the server.
Anthropic suggests regulators checking that providers serve only approved models. TechCrunch adds stopping a lab from secretly swapping a cheaper model.
The declared limits
- Greedy decoding only: random sampling, typical of chatbots, is not covered (Anthropic, The Decoder).
- Integer weights: judged close to floating-point inference by tests, without covering attack prompts (Anthropic).
- 1,024 tokens, far below current windows; extension is future work (Anthropic).
- Not fully hidden: the architecture is visible, and some weight values are masked except a declared list (GitHub).
- Out of scope: side channels such as timing, and parallel training on the same hardware (Anthropic).
- Checking: the fast C++/GPU code is not formally verified, and the Lean statements need manual audit (Anthropic).
Source: Anthropic, GitHub, The Decoder.
What is not established?
How a fingerprint is tied to a service's advertised model; sampled decoding and long contexts; closed models such as Claude; independent performance checks; adoption by providers or regulators; whether the code runs as described.
Comparison table
| Point | What the sources say | Status |
|---|---|---|
| Test model | Llama 4 Maverick, open, 4-bit | Declared by Anthropic |
| Overhead | About 70 to 95 times a vLLM service's GPU time | Declared by Anthropic |
| Earlier system | VerInf: 14.3 hours, 93.6 GB for 1,000 tokens | Reported by CellCog |
| Deployment | None planned | Reported by TechCrunch |
| Fingerprint to advertised model | Not detailed | Not established |
Frequently asked questions
Does FlashProve prove that Claude is really Claude?
No. It was tested on an open model. Use with closed models such as Claude is not established.
Can it be used today?
The code is open source, but unmaintained, the prover needs an 80 GB H100, and no deployment is planned. We did not run it.
Why 1,024 tokens and greedy decoding?
Anthropic lists both as limits; longer contexts are future work. The pages we read give no further reason.
Method and limits
We read Anthropic's post and the GitHub repository through automatic summaries on November 4, 2026, plus TechCrunch, The Decoder and CellCog (second-hand). We did not read Anthropic's technical report or use MarkTechPost or RuntimeWire. We judge nothing about the cryptography.
Sources
- Anthropic, Progress on provable inference for large language models, automatic summary
- GitHub, anthropics/FlashProve, automatic summary
- TechCrunch, Russell Brandom, automatic summary
- The Decoder, automatic summary
- CellCog, second-hand, automatic summary
Spotted an error in this article? Report it · Our corrections policy
