Anthropic released FlashProve on 2 November 2026 as an open-source research prototype for checking whether an AI model produced a claimed output. The system uses a cryptographic proof tied to a prior commitment to specific model weights. It addresses a practical trust question for clients of model-routing services: did the model they selected actually produce the tokens they received? Anthropic has demonstrated the method on one quantized model configuration; it has not announced a production service that verifies ordinary Claude API traffic.
Commit first, prove later
In an offline step, the provider publishes a compact commitment to the model weights. After inference, a prover creates a zero-knowledge proof that a checked output token follows from the committed weights and the given input. A client can verify that claim without downloading the weights or rerunning the model. The proof hides weights, not the model architecture. FlashProve generates proofs after the response and can check selected tokens; it is not a live authentication tag attached to every token. Anthropic’s technical report describes the commitment and proof phases in detail.
The benchmark has a price
Anthropic evaluated a 4-bit integer version of Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, in 1,024-token windows. In its 24-request batch, one H100 with host CPUs produced about 110 proved tokens per second. Each 18.78 MB proof checks one output token in a 1,024-token request window. Verification took 17 seconds per proof with 24 CPU threads.
Anthropic reports about 70 to 95 times the per-GPU time in its vLLM comparison for this tested setup. Its baseline used FP8 vLLM on eight H100s, while FlashProve used 4-bit integer weights, so the figure is not a general API cost estimate. Those are the research team's measurements, not an independently reproduced production benchmark.
The prototype's boundaries
The proof covers an exact integer model under greedy decoding. Outputs from floating-point serving or sampled decoding may not match the checked computation. The fast C++ implementation is not formally shown equivalent to the Lean protocol, even though the team released a Lean verifier and formal security statements. The current design targets mixture-of-experts models and contexts no longer than 1,024 tokens. A valid inference proof would establish that the committed computation produced a token, not that the token is true, safe or useful.
What an operator should take away
The released code and documentation let researchers examine the design, but the repository calls it a research prototype and says it is not maintained. A real deployment would need a trustworthy commitment distribution path, audited prover and verifier implementations, a decision about which tokens to check, and a latency and bandwidth budget for proofs. FlashProve makes model identity more testable in principle; the published evidence does not establish a ready-made verification layer for hosted AI products.
