On Nov. 2, 2026, Anthropic's Frontier Red Team open-sourced FlashProve, a research prototype for “provable inference”: cryptographic proofs that a reply came from a specific committed model without revealing the weights. The GitHub repo lists version 0.16.0 as a research artifact—not maintained, not accepting contributions—under Apache 2.0.
Key facts
| Item | Detail |
|---|---|
| Released | Nov. 2, 2026 |
| By | Anthropic Frontier Red Team and collaborators |
| Type | open-source research prototype, Apache 2.0 |
| Test model | Llama 4 Maverick, 400B MoE, 4-bit |
| Prover | single H100, ~110 tokens/s |
| Proof size | ~19 MB per 1,024-token request |
| Verification | ~17 s on a 24-thread CPU, no GPU |
| Overhead | ~70-95x vLLM GPU time |
What Anthropic released
The Nov. 2 research post “Progress on provable inference for large language models” ships alongside a technical report, protocol spec, code (prover plus fast C++ and Lean verifiers), and Lean proofs with a visualizer—all Apache 2.0. Weights are not bundled (Meta's Llama 4 license). Anthropic frames the drop as intermediate progress for others to extend.
The problem it targets
“A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream.” Polished output does not prove which weights ran. Anthropic ties that gap to evaluators, routing clients, pacing rules, and server tampering.
How FlashProve works
FlashProve uses a zkSNARK. The README: “FlashProve lets an AI provider prove which model answered a request, without revealing the model's weights.” Proofs verify with cp_verify on a normal CPU.
Offline, the provider publishes a commitment—a short fingerprint to the weights. Online, each reply carries a proof that “The committed model produces these output tokens when evaluated.” Checkers need commitment, prompt, reply, and proof, not the weights. Proofs hide weights; “The model architecture (excluding the weights) is not hidden.”
The numbers
Tests use Llama 4 Maverick (400B-parameter MoE, ~17B active per token) with public 4-bit weights on one H100 and 24 CPU cores: proofs at around 110 tokens/second, ~19 MB (18.78 MB) per 1,024-token request. Offline commitment ~39 minutes, good for about 16 million requests; 24 requests batch in ~223 seconds. Overhead is ~70-95x vLLM GPU time. Prior VerInf on the same model needed 14.3 hours for 1,000 tokens with a 93.6 GB proof.
Verifiers use no GPU, fetch ~6.5 MB commitment data, and check a proof in 17 seconds on 24 threads (21 seconds single-thread). Anthropic: “Claude has produced improvements on zkSNARKs for inference, building a system that is substantially faster than prior open-source systems.”
How it is checked with Lean
Anthropic adds Lean proofs of completeness, soundness, and zero knowledge, plus a provably correct Lean verifier and a faster C++ verifier that “carries no formal guarantee.” There is also no formal guarantee that Lean, the paper, and the fast code all align.
Limits Anthropic lists
“This release is a research prototype”: up to 1,024-token contexts, integer model under greedy decoding, MoE assumption, side channels out of scope—not a shipping Anthropic API feature, and tested only on Llama 4 Maverick.
Anthropic's Frontier Safety Roadmap targeted a Sept. 30, 2026 provable-inference prototype; Anthropic says it met that via a separate signed-traffic project while FlashProve “pursues the same objective by a different method.” Use cases named include pacing/regulation, tamper detection, text provenance, and model approval. See also Anthropic Launches Message Threads for Faster Claude Agents and OpenAI Expands Agent Monitoring After Hugging Face Incident.
What it means
Analysis (ours). FlashProve replaces trust in routing with checkable certificates, at the price of ~70-95x prover GPU time and ~19 MB proofs per 1k tokens— viable for auditors and regulators before everyday chat. Lean gives reviewers machine-checked top-level claims while production would likely lean on the fast C++ path.
What to watch
Independent reproduction of the Llama 4 benchmarks, falling proof overhead, and any pilot that attaches zkSNARK certificates to live routed inference.