FlashProve: Anthropic cryptographically proves which model answered

When a request goes through routing services or API resellers, whoever receives the text has no mathematical way of knowing whether the answer really came from the system they asked for, or from a cheaper or tampered substitute. To tackle this, Anthropic's Frontier Red Team built FlashProve together with researchers from MIT, EPFL and StarkWare. It is a zkSNARK-based research prototype that produces a cryptographic proof of inference. With that proof, a verifier can check that the output tokens came from the committed weights without seeing the weights, the intermediate values or which experts were activated. The model's architecture, however, remains visible.

The experiment was run on Llama 4 Maverick, a mixture-of-experts model with 400 billion total parameters and about 17 billion active per token. The model was quantized to 4 bits, with a context window capped at 1,024 tokens. On a server with a single 80 GB H100 GPU, the offline phase runs once per model: it takes about 39 minutes and produces a commitment valid for roughly 16 million requests. In the online phase, proving a batch of 24 requests takes about 223 seconds and the proof weighs 18.78 megabytes. The compute cost is 70 to 95 times ordinary GPU time with vLLM. Final verification runs on CPU and takes 17 seconds on 24 threads.

As TechCrunch reports, there are no plans to bring FlashProve into production services, neither at Anthropic nor at other labs. The prototype only works with quantized models, greedy decoding and 1,024-token windows, and it does not address side-channel attacks. There are also no formal guarantees for the fast code that actually runs. The code, the verifiers written in C++ and Lean, and the protocol specification drafted by Claude have been published on GitHub under the Apache 2.0 license.

As a point of comparison, Anthropic cites earlier work, VerInf, which needed 14.3 hours for 1,000 tokens. FlashProve claims about 110 tokens per second, but that figure covers a single model. Whether the result holds for other architectures is, for now, the company's hypothesis, and the measurements have not been replicated by third parties. There is a certain elegance to the idea that a model should show a cryptographic passport before we trust its answers, even if today the price of computational honesty is 70 to 95 times the GPU time of the plain answer. — Olya