Anthropic open-sources FlashProve to prove which AI model produced a given reply

What Anthropic released

Anthropic published FlashProve on 3 November 2026 as research on what it calls provable inference: a way for a model provider to show, with a cryptographic proof, that a particular response was produced by a particular model. The repository contains the GPU prover, two verifiers, formal proofs written in the Lean 4 proof assistant, a protocol specification and a paper. It is released under the Apache 2.0 licence and labelled a research artifact that is not maintained and does not accept contributions. Coverage by TechCrunch and Help Net Security says the work came from Anthropic's Frontier Red Team together with EPFL, MIT and StarkWare.

The scheme has three steps. The provider publishes a commitment ID that binds it to one set of weights, while the weights themselves stay hidden behind masking. For each reply, the provider's GPU produces a proof that the output is the committed model's. Anyone can then check that proof on an ordinary CPU with a tool called cp_verify, without access to the weights. The README says the verifier builds in one to two minutes and checks the stored example proof in under two seconds.

How fast it is and what it runs

FlashProve does not run a Claude model. The project demonstrates it on Llama 4 Maverick, Meta's 400-billion-parameter mixture-of-experts model, at full size in a public 4-bit conversion, on a single NVIDIA H100 80 GB with a 1,024-token context window. In the project's timed runs the prover handled about 111 prompt tokens per second at 24 requests per batch, 76 at eight and 17 at one, which works out to roughly nine seconds of proving per request in a full batch. Help Net Security reports that proving costs about 70 to 95 times the GPU time of ordinary serving. The project had set itself a target of 100 tokens per second on one GPU, and its steady batched rate passes it.

These are the project's own measurements on one kind of machine, and they cover prefill of prompt tokens. Independent benchmarks have not been published.

Why proof of the model matters

Customers who reach a model through an API, a cloud marketplace or a reseller usually have to trust that they get the model they pay for. A provider could quietly serve a cheaper or more heavily quantised version, and a safety evaluator cannot easily confirm that the model it tested is the one deployed. Anthropic's framing is that provable inference could catch model swaps of this kind and help evaluators check they are testing what customers receive. The same property could also make it harder for an attacker who sits between a user and a provider to substitute answers.

The approach builds on established cryptographic techniques that proof systems such as those used by StarkWare rely on, applied here to the scale of a frontier-size model on one GPU. It sits alongside Anthropic's earlier security work, such as its reports on how attackers misuse Claude and on exploit chains written by its models, but addresses trust in the supply chain of model outputs rather than attacks.

Limits stated by the project

The repository lists its limits in detail. Soundness is proved in Lean for the verifier written in Lean, with a forgery chance of about 2 to the power of minus 124 per hash query; the C++ verifier and the CUDA prover follow the same protocol and are tested against it, not proved. Proofs are about an integer, fixed-point version of the model, and in one measurement its top token differed from the floating-point model's at 6.81 percent of positions. A proof also does not say whose weights were committed: the provider chooses the model, so the commitment ID must come from a party the user trusts, not from the server being checked.

Under the looser clipped-gap policy that serving uses, an accepted proof says only that the output meets the policy's limits, and the project recommends accepting only exact matches when users cannot assess those limits. The project says weight hiding is expected rather than proved for the programs, and that no test hunts for leaks. Anthropic has said it has no plans to deploy FlashProve itself.

Questions people ask

Does FlashProve work with Claude?

Not as released. The project demonstrates it on Llama 4 Maverick, and Anthropic has said it has no plans to deploy FlashProve.

What hardware does FlashProve need?

The prover needs one NVIDIA H100 80 GB with CUDA 13.2 and, at full model size, about 280 to 330 GB of RAM. Checking a proof needs only an ordinary Linux CPU.

Is FlashProve open source?

Yes. It is on GitHub under the Apache 2.0 licence, labelled a research artifact that is not maintained and does not accept contributions.

Sources

1. FlashProve (repository and README) (Anthropic, 3 Nov 2026)
2. FlashProve performance guide (Anthropic, 3 Nov 2026)
3. FlashProve known limits (Anthropic, 3 Nov 2026)
4. Anthropic is working on a system to prove AI models' identity (TechCrunch, 3 Nov 2026)
5. Anthropic open-sources FlashProve, its provable inference prototype for MoE models (Help Net Security, 4 Nov 2026)