Anthropic FlashProve proves which model actually ran

What happened?

Anthropic's Frontier Red Team introduced FlashProve, an open-source system that produces cryptographic proof that a response was actually generated by a specific model (Anthropic). It uses zkSNARKs, zero-knowledge proofs: the model weights stay hidden, while the architecture does not.

How fast is it?

• The test ran on the 400B-parameter, 4-bit Llama 4 Maverick mixture-of-experts model.
• A single H100 reaches about 110 tokens per second, with a proof of about 18.78 MB per 1,024-token request.
• GPU time is about 70 to 95 times that of plain vLLM inference.
• Verification takes 17 seconds on 24 CPU threads. A one-time offline phase takes 39 minutes and stays valid for about 16 million requests.
• For comparison, the earlier VerInf managed about 0.02 tokens per second on the same model.

What it is for

Anthropic lists use cases such as regulatory oversight and tracking development pace, tamper detection, provenance and proving that an approved model is the one running. Completeness, soundness and zero-knowledge are proven in Lean, and Claude helped build the system. The code is available under Apache 2.0 on GitHub.

The limits

For now the system supports only greedy, integer models and mixture-of-experts architectures, with a 1,024-token context. The Lean verifier is slow, while the fast C++ verifier is not formally verified. Side channel attacks also remain open questions.

Why it matters

When a provider says it runs an audited model, today you just have to trust it. FlashProve shows that provable inference is no longer theoretical: it is orders of magnitude faster than earlier methods. With a 70 to 95x overhead, it suits spot checks rather than every request for now.