Takeaway: On Nov 2, 2026, Anthropic’s Frontier Red Team published FlashProve — an open-source research prototype for provable inference. A provider publishes a hiding commitment (fingerprint) to model weights, then attaches a zkSNARK proof that those committed weights produced a given reply. Anyone can verify the proof on an ordinary CPU without seeing the weights. On Llama 4 Maverick (400B MoE, ~17B active, 4-bit), a single H100 generates proofs at about 110 tokens/sec (~19 MB proof per 1,024-token request; verifier ~17s on 24 threads). TechCrunch notes Anthropic has not announced plans to deploy FlashProve in production Claude serving — treat it as intermediate research, not a live product feature.
Primary sources: Anthropic research post — Progress on provable inference (Nov 2, 2026); anthropics/FlashProve on GitHub (Apache 2.0); TechCrunch coverage (Nov 3). This is a different topic from our earlier Anthropic Messages API message-threads beta (API latency for agents) and from today’s Google K-12 Gemini/Search defaults and ChatGPT ~20% of Google search-like volume posts.
What problem FlashProve tries to solve
When you chat with a friend in person, you have many ways to know it is really them. When you query an AI API, you usually have almost none. Output quality alone cannot prove which weights produced the tokens. Anthropic frames several concrete trust failures:
- Silent model swap: a router or provider substitutes a cheaper (or stronger) model while claiming another.
- Tamper / compromise: an attacker or rogue agent alters the token stream while pretending to be the authorized model.
- Evaluator integrity: third-party evals need assurance the served model matches the claimed checkpoint.
- Provenance claims: “model X reviewed this code / plan” is hard to audit from chat logs alone.
- Pacing / approval rules: regulators or auditors may want cryptographic evidence that approved models (not unapproved ones) are what hardware actually served.
Provable inference (PI) aims to let a verifier with limited compute — and no access to private weights — check that a reply came from a specific committed model. FlashProve is Anthropic’s open software/crypto approach using zkSNARKs; it complements (does not replace) hardware TEE attestation.
How commit → prove → verify works
FlashProve splits work into an offline commitment phase and an online prove/verify phase:
- Offline: the provider publishes a short hiding commitment to exact weights (fingerprint). Weights stay secret; later proofs bind to that commitment. Anthropic reports ~39 minutes offline on their demo setup and a ~6.5 MB commitment download for verifiers. A commitment is good for roughly 16 million requests before recommit (per their evaluation notes).
- Online (prove): for a prompt + reply, the prover produces a proof file asserting: the committed model produces these output tokens when evaluated.
- Verify: anyone holding the commitment, prompt, and reply checks the proof on CPU. Completeness (honest proofs accept), soundness (forged false proofs are infeasible under standard crypto assumptions), zero-knowledge (proof hides weights / intermediates / which MoE experts ran), and succinctness (proof is small vs re-running a 400B model).
Important nuance Anthropic states clearly: architecture is not hidden — only weights. Hiding architecture is left for future work. The system also proves a post-hoc batch of finished requests (prefill-style), not ultra-fast in-line proving beside every streamed token.
Demo numbers (Llama 4 Maverick)
Anthropic evaluated FlashProve on Meta’s Llama 4 Maverick — a 400B-parameter mixture-of-experts model with ~17B parameters active per token — using a public 4-bit conversion. Each verifier request is a 1,024-token window; each proof checks one token. Prover: single H100 + 24 CPU cores. Verifier: CPU only.
| Metric | Reported figure | Notes |
|---|---|---|
| Model | Llama 4 Maverick 400B MoE (~17B active), 4-bit | Public HF conversion; weights not shipped in the repo |
| Prover throughput | ~110 tokens/sec | Single H100; batch of 24 requests ~223 seconds |
| Proof size | ~19 MB (18.78 MB) per 1,024-token request | Succinct vs re-running ~232 GB quantized weights |
| Verifier time | ~17s (24 threads) / ~21s (1 thread) | Includes offline-phase checks; no GPU required |
| Offline commitment | ~39 min; ~6.5 MB download | ~16M requests before recommit |
| Overhead vs vLLM | ~70–95× GPU time for same batch | Compared with FP8 vLLM on eight H100s, per-GPU |
Anthropic contrasts this with prior open zkML systems that were often orders of magnitude slower on much smaller models — and with VerInf’s earlier Maverick numbers (hours per 1,000 tokens and multi-tens-of-GB proofs). FlashProve’s claim is that zkSNARK inference proofs can land in a ~2-order-of-magnitude GPU overhead band rather than “impractical forever.” Attestable (commercial, closed library at write-up time) independently reported 53–77 tok/s on a dense 31B model, which Anthropic cites as parallel progress.
Open-source release: code + Lean formalization
The Nov 2 release package includes the research post, a technical report, a Claude-written protocol specification, executable prover/verifier code, and Lean proofs for top-level completeness, soundness, and zero-knowledge (random-oracle model), plus an interactive Lean theorem visualizer. License: Apache 2.0. Artifacts live under github.com/anthropics/FlashProve.
- Fast C++ verifier for day-to-day checking (no formal guarantee; tested against Lean).
- Slow Lean verifier that Lean proves accepts only what the soundness theorem’s verifier accepts.
- Trust gaps Anthropic names: humans still must audit that formal statements match intent, and that fast executables match the Lean protocol — especially for the prover (zero-knowledge depends on prover correctness).
Use cases for publishers, evals, and regulators
FlashProve is not a WordPress plugin and not Claude production serving. Still, the trust pattern matters for the same audiences who track AI search, citations, and agent tooling:
- Publishers / SEO / GEO: as answer surfaces multiply (ChatGPT search-like volume claims; getting cited in AI retrieval), provenance of “which model said this” becomes a brand and compliance issue — especially for sponsored or “reviewed by AI” claims.
- Eval vendors: cryptographic binding reduces “we swapped the checkpoint between the press demo and the API” risk.
- Enterprise routing: clients paying for a named frontier model through a third-party gateway get a checkable certificate, not just a header string.
- Safety / pacing / approval: Anthropic maps zk proofs to regulator asks for inference certificates, model-approval enforcement, and tamper detection — complementary to their separate RSP “inference verification” prototype that signs traffic and recomputes on a trusted server.
- Builders: open Apache 2.0 code invites zkML researchers to beat the 110 tok/s / 19 MB baseline — similar open-research dynamics to agent coding stacks we cover (e.g. DeepSeek Super Agent, OpenAI Pando monorepo Git backend).
Crawl/access policy still matters separately: cryptographic identity of a model does not replace deciding which AI crawlers you allow in robots.txt.
Limitations (read these before hype)
- Research prototype only. Anthropic calls it intermediate progress; TechCrunch reports no announced plans to deploy at Anthropic or other labs.
- Not production Claude serving. Demo is Llama 4 Maverick, not Claude weights.
- Integer / greedy computation. Proofs cover an exact integer greedy version of the published weights — not floating-point sampling. Sampled or FP replies can diverge.
- Architecture not hidden. MoE structure is assumed/used for efficiency; architecture IP is out of the zero-knowledge claim.
- Context currently 1,024 tokens. Far short of frontier chat windows.
- Post-hoc, not in-line. Proving after the fact adds delay/recomputation; non-determinism issues remain.
- Side channels out of scope. Timing of proof generation could leak information; not covered.
- Fast code ≠ Lean proof. No formal guarantee that C++/paper/Lean all match.
FAQ
What is Anthropic FlashProve?
FlashProve is Anthropic’s open-source research prototype for provable inference: a provider commits to model weights, then produces a zkSNARK proof that those committed weights generated specific output tokens. Verifiers check proofs on CPU without seeing the weights.
Does FlashProve mean Claude replies now come with cryptographic proofs?
No. Anthropic positions the Nov 2, 2026 release as intermediate research. TechCrunch reports there are no announced plans to deploy FlashProve at Anthropic or other labs. Production Claude serving is separate from this Llama 4 Maverick demo.
How fast is proof generation in the published demo?
On Llama 4 Maverick (400B MoE, ~17B active, 4-bit), Anthropic reports about 110 tokens per second of proof generation on a single H100, with ~19 MB proofs per 1,024-token request and roughly 70–95× the GPU time of comparable vLLM batches.
Can a verifier learn the model weights from a FlashProve proof?
Under the stated zero-knowledge property, the proof should reveal nothing about the weights beyond what the response itself implies. Anthropic notes the model architecture is not hidden, and side-channel attacks (e.g., timing) are out of scope for this release.
How is this different from Anthropic’s message-threads API work?
Message threads (public beta on the Messages API) optimize long agent sessions by creating a thread once and continuing with deltas — a latency/product API story we covered separately. FlashProve is about cryptographic identity of weights for a reply, not about reducing time-to-first-token for Claude Code sessions.
Why should SEO and publisher teams care?
As AI answers and “model reviewed this” claims spread across search and chat surfaces, verifiable provenance becomes a trust and compliance layer next to crawl access and citation SEO. FlashProve itself is not a ranking factor — but the trust problem it targets will shape how brands, evals, and regulators talk about AI-generated content.
Sources: Anthropic — Progress on provable inference (Nov 2, 2026); GitHub — anthropics/FlashProve; TechCrunch — Anthropic system to prove AI models’ identity (Nov 3, 2026). Related on Web Observer: Anthropic message threads API, ChatGPT ~20% of Google search-like volume, Google K-12 Gemini/Search defaults, OpenAI Pando, DeepSeek Super Agent, get cited in AI search, robots.txt for AI crawlers.