Anthropic Opens FlashProve to Prove Replies Match Model Weights

"When you talk to a friend in person, you have many ways to know it is really them: you can see them, hear them, shake their hand. When you talk to an AI model, you have almost none." That is the opening of Anthropic's release of FlashProve, a zero-knowledge proof system built with researchers at EPFL, MIT, StarkWare and Succinct that lets an inference provider cryptographically prove a response came from the specific weights it committed to, without revealing those weights.

On a 400B-parameter mixture-of-experts model (Llama 4 Maverick at 4-bit quantization), "a single H100 GPU generates proofs at over 100 tokens/second, with proof size of ~19 MB per 1,024-token request," the post says. Verification runs on CPU: about 17 seconds on 24 threads, after a one-time commitment download of around 6.5 MB. The prover is 72 to 94 times slower than a vLLM baseline on equivalent hardware, which keeps this a research artifact rather than a production path for most workloads.

The threat model is specific. A user, the post argues, "cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream." FlashProve closes that gap under three guarantees, completeness, soundness and zero-knowledge, each formally verified in the Lean proof assistant, with the prover, a C++ verifier and the Lean specs released under Apache 2.0. It's the third Anthropic alert we've logged today alone.

The limits are stated flatly. "The system currently proves inference over contexts of up to 1,024 tokens," the post concedes, a fraction of modern frontier context windows. Proofs cover integer models under greedy decoding only; architecture is not hidden; side-channel attacks are not mitigated. Anthropic ties the release to its Frontier Safety Roadmap goal to "develop a prototype by September 30, 2026 of provable inference," which it says it met "through a separate but related project."