Anthropic Opens FlashProve to Prove Replies Match Model Weights
TL;DR
- FlashProve is Apache 2.0 and runs on one 80GB H100 plus 290GB host memory, putting verification access within reach of mid-sized enterprises.
- At roughly 110 tokens per second and 72-94x compute overhead, FlashProve enters the market as an audit layer, not a production inference path.
- The 1,024-token ceiling and absence of an independent security audit mark it as a research prototype rather than a deployable compliance instrument.
"When you talk to a friend in person, you have many ways to know it is really them: you can see them, hear them, shake their hand. When you talk to an AI model, you have almost none." That is the opening of Anthropic's release of FlashProve, a zero-knowledge proof system built with researchers at EPFL, MIT, StarkWare and Succinct that lets an inference provider cryptographically prove a response came from the specific weights it committed to, without revealing those weights.
On a 400B-parameter mixture-of-experts model (Llama 4 Maverick at 4-bit quantization), "a single H100 GPU generates proofs at over 100 tokens/second, with proof size of ~19 MB per 1,024-token request," the post says. Verification runs on CPU: about 17 seconds on 24 threads, after a one-time commitment download of around 6.5 MB. The prover is 72 to 94 times slower than a vLLM baseline on equivalent hardware, which keeps this a research artifact rather than a production path for most workloads.
The threat model is specific. A user, the post argues, "cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream." FlashProve closes that gap under three guarantees, completeness, soundness and zero-knowledge, each formally verified in the Lean proof assistant, with the prover, a C++ verifier and the Lean specs released under Apache 2.0. It's the third Anthropic alert we've logged today alone.
The limits are stated flatly. "The system currently proves inference over contexts of up to 1,024 tokens," the post concedes, a fraction of modern frontier context windows. Proofs cover integer models under greedy decoding only; architecture is not hidden; side-channel attacks are not mitigated. Anthropic ties the release to its Frontier Safety Roadmap goal to "develop a prototype by September 30, 2026 of provable inference," which it says it met "through a separate but related project."
What others are reporting
-
TechCrunch Read →
Leads with the anti-impersonation angle: the proof holds even when the impostor is the lab running the model, framing FlashProve as a check on inference vendors.
FlashProve would be robust against impostors attempting to disguise one model as another, even when the impostor is the lab that built and runs the model.
-
Help Net Security Read →
Security practitioner lens: 110 tokens/sec throughput, 18.78 MB proof size, and 72x overhead give practitioners concrete numbers for deployment scoping.
FlashProve gives a checker a way to find out whether a specific model generated a specific reply.
-
Unite.AI Read →
Details hardware requirements (one 80GB GPU plus 290GB host memory) and flags the missing independent security audit as a gap before enterprise adoption.
The system produces a proof that the output tokens are the committed model's output without revealing the weights.
-
Blockchain.News Read →
Takes a cautious read: no independent benchmarking, architecture hiding unaddressed, and frames this as a progress update rather than a shipping product.
FlashProve can generate proofs for Llama 4 Maverick at around 110 tokens per second on a single H100 GPU.
Shared on Bluesky by 1 AI expert
Originally reported by anthropic.com
Read the original article →Original headline: Anthropic Opens FlashProve With EPFL and MIT, Cryptographically Verifying AI Replies Came From Promised Weights