Anthropic open-sources tool proving which model answered your prompt

The latest:

A cryptographic proof can now accompany every model response, letting anyone confirm which weights produced it without seeing those weights. Anthropic’s Frontier Red Team published FlashProve on 2 November 2026, updated 3 November, as an open-source zkSNARK prototype running on Llama 4 Maverick. The post describes it as intermediate progress rather than a completed research agenda.

Details:

• The problem: Anthropic said a user receiving a response generally cannot verify which model generated it, since the output may come from a substitute model, a routing service, or an attacker altering the token stream. The post argued quality alone is not a reliable test: “Judging from the model’s output alone is unreliable, even if it produces high-quality responses.”
• How it works: According to the post, the provider publishes a one-time commitment to the model weights offline, then generates a per-request proof that the committed model produces the given response tokens for the given prompt. Any party holding the commitment, prompt and response verifies on modest hardware, without the weights and without a GPU.
• The numbers: On Llama 4 Maverick — 400 billion parameters, mixture-of-experts, roughly 17 billion active per token, 4-bit weights at about 232GB quantized — Anthropic reported around 110 tokens per second on a single H100, with proofs of about 18.78MB, roughly 19MB per 1,024-token request.
• The cost: Proving consumed about 72 times the GPU time of vLLM on a 24-request batch, ranging 66–77 across runs and about 94 times at the highest tested load. A 24-request online batch took roughly 223 seconds; the one-time offline phase ran about 39 minutes per model.
• Verification side: Anthropic said the commitment covers roughly 16 million requests before a new one is needed. A verifier downloads about 6.5MB of commitment data plus one proof per request, with verification taking about 17 seconds on 24 threads or 21 seconds single-threaded. The prover setup used one 80GB GPU and about 290GB host memory.
• Versus prior work: The post cited zkLLM at about 2.5 tokens per second on a 13-billion-parameter model, VerInf needing 14.3 hours for 1,000 tokens at 400 billion parameters with a 93.6GB proof taking roughly a day to check, DeepProve at about 2.9 tokens per second on GPT-2, and SASH at 1.25 on Llama 3.1 8B.
• Formal verification: Anthropic said the security properties are specified and proved in Lean under the random oracle model, with a Lean verifier running alongside a faster C++ verifier that agreed on all test proofs but carries no formal guarantee of its own. Claimed guarantees include completeness, soundness, zero-knowledge and succinctness.
• Stated limits: Anthropic listed fast executable code without formal guarantees, no guaranteed match between the Lean protocol, the paper and the code, coverage limited to greedy decoding where floating-point or sampling outputs may diverge, no coverage of adversarially designed prompts, a 1,024-token context window, and side channels such as timing left out of scope.
• What it does not prove: The proof establishes that the hardware served the committed model, not that the provider avoided training on the side. Weights stay hidden, while the mixture-of-experts architecture is assumed and exposed. The post does not state that FlashProve is available through Anthropic’s API or products.
• The release: The repository sits at github.com/anthropics/FlashProve under Apache 2.0, containing the prover, the C++ verifier, a verified Lean verifier, Lean proofs of top-level statements and an interactive visualizer, plus a technical report and protocol specification. Weights are excluded: Llama 4 Maverick must be obtained from Hugging Face under Meta’s licence.

Background:

The work sits in a line of research on verifying AI inference. Anthropic noted a separate earlier project that signs inference traffic and recomputes it on a trusted server, and said an update on 19 October 2026 renamed the goal from provable inference to inference verification.

Between the lines:

The 72x cost multiple defines who this is for today. At that overhead, per-request proofs are implausible for consumer traffic but tolerable for the audiences Anthropic names: auditors, regulators, independent evaluators and customers routed through third-party services, where confirming that the deployed model is the tested one outweighs latency. The 16-million-request commitment amortizes the 39-minute offline phase, pushing the burden onto the per-request side.

What’s next

Watch whether other labs adopt or benchmark against FlashProve, whether the 1,024-token context window and greedy-decoding limits are extended, and whether regulators cite inference verification in compliance or model-accreditation requirements.