A good answer is not evidence of which model wrote it
That is the problem FlashProve is built for. A routing service can quietly substitute a cheaper model. An evaluator can be served a different system from the one under test. An attacker who tampers with a token stream leaves no mark the reader can see. Judging from output quality settles none of it, because a strong answer can come from the wrong model and a weak one from the right model.
In an offline step, the provider publishes a short commitment to one exact set of weights, about 6.5 MB for the verifier to download, without revealing the weights themselves. Afterwards, the provider can generate cryptographic proofs for checked inference tokens. Each proof is tied to the committed weights and the relevant prompt context. Anyone holding the commitment, the relevant input and output, and the proof can verify the claimed computation without possessing the model weights. In Anthropic's current evaluation, each proof checks one token within a 1,024-token window; this is not yet a demonstrated end-to-end certificate for every token in an unrestricted production conversation.
The zero-knowledge property protects the model weights and intermediate computation details; it does not hide the model's architecture. Anthropic identifies architecture hiding as future work.
The numbers, with their conditions attached
The progress is real, and so is the computational overhead. The previous open-source system Anthropic cites for the same model, VerInf, managed about 0.02 tokens per second, needed 14.3 hours to prove 1,000 tokens, produced a 93.6 GB proof and took almost a day to verify it. FlashProve reports about 110 tokens per second in its batch evaluation on a single H100, with an 18.78 MB proof and CPU verification taking 17 seconds on 24 threads or 21 seconds on a single thread. These are Anthropic's measurements, not independently reproduced results. The improvement over the earlier system is substantial, but the performance still comes with significant computational overhead.
If independently reproduced, the result would represent a substantial step toward making provable inference practical for auditors working with large models. The Apache 2.0 release covers FlashProve's code, Lean proofs and documentation, not the underlying Llama 4 Maverick weights, which remain distributed separately under Meta's license.
Then read the comparison that matters for deployment. In Anthropic's comparison, FlashProve's batch prover consumed about 72 times the GPU time per GPU that vLLM needed to process the same batch of 24 requests (66–77 times across runs). At the highest vLLM load tested, the reported ratio rose to about 94 times. The comparison uses vLLM on eight H100 GPUs and normalizes GPU time per GPU; it is not a comparison of monetary cost or end-user response latency. The prover also needs about 290 GB of host memory next to its 80 GB GPU, and the 110 tokens per second is a batch rate across 24 requests, not the speed of proving one person's reply while they wait. Anthropic is candid that the design is post-hoc: proofs are produced after the fact, for checked tokens, with the delay and recomputation that implies. Nobody is attaching this to live traffic at 72 times the serving cost, and the post does not claim otherwise.
Two scope limits decide who can use this today. The proof covers an exact integer version of the weights under greedy decoding. A production reply generated in floating point, or sampled rather than greedy, can depart from the proved computation at some token, and Anthropic excludes adversarially designed prompts from its small-error expectation. And the system proves contexts of up to 1,024 tokens, in a market where working contexts run to hundreds of thousands. What has been proved is that the method scales to a 400B model. What has not been proved yet is that it scales to the way frontier models are actually served.
What a proof does not prove
A valid FlashProve proof establishes a narrow claim: the checked token was the committed model's greedy output for the specified context under the proved integer computation. It does not establish that an entire conversation has been checked, or that an answer is correct, safe or honest. Anthropic's proposed applications are integrity problems: evaluators confirming which model they tested, customers checking that a router served the model they paid for, and regulators checking that approved models are being used.
There is also a trust footnote inside the trust tool. Anthropic specifies the protocol's security properties in Lean and proves them there, and ships a Lean verifier that carries those guarantees. The fast C++ verifier people would use day to day carries no formal guarantee, and Anthropic states plainly that it does not guarantee the Lean specification, the paper and the executable code all match each other. The statements also have to be audited by hand to check they say what they are meant to say. None of that undermines the result. It does mean "cryptographically proven" currently rests partly on the same human auditing it is meant to supplement.
One more credit line is worth keeping straight. Anthropic says Claude itself produced improvements to the zkSNARK construction. That makes the formal verification component particularly relevant: the system uses Lean to specify and prove top-level security properties in a form that can be machine-checked. The approach does not eliminate the need for human auditing, but it gives reviewers a more rigorous way to examine the claims made about the cryptographic construction. And Anthropic's earlier public goal of a provable-inference prototype by September 30, 2026 was met, by its own footnote, through a separate signing-and-recomputation project. FlashProve is a second route to the same objective, published as intermediate progress, not a finished agenda.
Sources
- [1] Anthropic, "Progress on provable inference for large language models", November 2, 2026 (primary; read first-hand in full)Read source
- [2] Unite.AI, "Anthropic Releases FlashProve for Cryptographic AI Inference Proofs", November 2, 2026 (secondary; repository and verification details)Read source
- [3] Blockchain.News, "Anthropic reports progress on provable inference for large language models", November 3, 2026 (secondary; independent restatement of the headline figures)Read source