Anyone who sends a prompt to a hosted AI model today has to take the provider's word that the model they asked for is the one that answered. Anthropic is trying to change that. On November 2, 2026 the company published FlashProve, an open-source research prototype that produces a cryptographic proof that a given response was generated by a specific, previously committed set of model weights, without revealing those weights.
The work is credited to Anthropic researchers Roy Rinberg and Alex Allain together with collaborators from EPFL, MIT, StarkWare and Succinct, among them Alessandro Chiesa of EPFL and StarkWare. Anthropic credits Claude with producing the zkSNARK improvements behind the system, finding new ways to combine existing techniques from the cryptography literature. Because that kind of machine-driven optimization is hard to review, the team specified the protocol and its security properties in Lean, a formal proof language, so that the central guarantees can be checked by machine rather than taken on trust.
FlashProve is built on a zkSNARK, a zero-knowledge succinct argument. In an offline step that takes about 39 minutes, the provider publishes a commitment, a short fingerprint that pins down one exact set of weights. For each later request, it generates a proof that the committed model, run on that prompt, yields exactly those output tokens. The proof is zero-knowledge, so it reveals nothing about the weights or which experts fired inside the network, and it is succinct, so a user with modest hardware can check it quickly. The model's architecture is not hidden.
The headline numbers come from Llama 4 Maverick, Meta's 400-billion-parameter mixture-of-experts model, using a public 4-bit version. On a server with one H100 GPU and 24 CPU cores, the prover handled a batch of 24 requests of 1,024 tokens in about 223 seconds, or roughly 110 tokens per second, with each proof weighing about 18.8 MB. Verification needs no GPU: checking a proof took 17 seconds on 24 CPU threads. Compared with serving the same requests through vLLM, proving costs about 70 to 95 times the GPU time, according to Anthropic.
That overhead is still large, but the comparison with earlier systems shows how quickly the field has moved. Anthropic's survey of prior work cites VerInf, which proved the same Maverick model at about 0.02 tokens per second and needed 14.3 hours for 1,000 tokens, producing a 93.6 GB proof. The company also notes that the startup Attestable reports 53 to 77 tokens per second for a dense 31-billion-parameter Gemma model, though it has not released open-source code.
Anthropic frames the tool around trust problems that grow as AI spreads. A customer using a routing service could confirm it received the model it paid for. An operator could detect a compromised inference server, or a model quietly substituting itself for another to dodge monitoring. Regulators could, in principle, check that a provider serves only approved models, or that hardware committed to inference is not being used to train something else. The release includes the code, a C++ verifier and a slower verifier written in Lean, the formal proofs and a technical report, all under the Apache 2.0 license.
The limitations are spelled out. Proofs cover an integer version of the model under greedy decoding, so sampled or floating-point outputs may not match exactly. Context is capped at 1,024 tokens, far below production chat sessions, and proving happens after the fact for batches rather than in real time. The fast C++ code carries no formal guarantee that it matches the Lean specification, side-channel leaks such as timing are out of scope, and a commitment must be renewed after about 16 million requests. Anthropic describes the release as intermediate progress, and the performance figures have not yet been reproduced independently.