Anthropic has released FlashProve, a research prototype that can prove which AI model produced a response without revealing the model's weights. Anthropic described it in a research post dated November 2, 2026, alongside a technical report and code published on GitHub.

"This release is a research prototype," Anthropic writes, and the post "is meant to share intermediate progress, and not a completed research agenda." TechCrunch, reporting on November 3, 2026, said: "Research in the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab."

#What problem does FlashProve address?

Anthropic frames the problem this way: "A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream."

Its answer: "Cryptographic proofs of inference solve this problem: they let a model provider commit to a model and then prove that each response was produced by that model." FlashProve uses a type of proof known as a "zkSNARK", Anthropic says.

Anthropic gives two examples of who might need this:

  • Evaluators. "For example, independent evaluators who test AI models before and after release need to know that the model they are evaluating is the model being served."
  • Routing customers. "Clients who use a model through a third-party routing service want assurance that the tokens came from the model they paid for."

TechCrunch reported that "the researchers note that the system could be used to prevent an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive model to inflate its performance results."

#How does it work?

The README summarizes it: "FlashProve lets an AI provider prove which model answered a request, without revealing the model's weights."

Anthropic describes three parts:

  1. Commit. The provider commits to the model weights once. Anthropic says this offline step "runs once per model and takes about 39 minutes."
  2. Prove. "The prover runs on a server with a single H100 and 24 CPU cores."
  3. Verify. "The verifier runs on the client's CPU. It needs no GPU and only has access to a commitment to the weights."

On privacy, Anthropic says: "The commitment to the model, and subsequent inference proofs, hide the weights of the model; hiding the architecture of the model is not a goal of this system."

Anthropic also says it provides "top-level auditable statements in Lean (a formal verification language) for the claimed security guarantees." It adds that "Claude has produced improvements on zkSNARKs for inference".

#How fast is it?

All of these figures are Anthropic's own measurements. No independent test appears in the sources.

  • Proving speed. For Llama 4 Maverick, Meta's 400B-parameter mixture of experts model, Anthropic says "a single H100 GPU generates proofs at around 110 tokens/second". Anthropic's evaluation reports that a batch of 24 requests "takes the prover about 223 seconds, which is 110 tokens per second, and each proof is 18.78 MB."
  • Proof size. About 19 MB per 1,024-token request, according to Anthropic.
  • Overhead. Anthropic says proving is "~70-95x the GPU time of running the model itself on vLLM".
  • Verification. "Checking a proof takes 17 seconds on 24 threads (and 21 seconds on a single thread), including the offline phase's checks," Anthropic says.

Anthropic compares this with VerInf, which it calls "The only earlier proof of Llama 4 Maverick that we know of". It says VerInf "reports 14.3 hours for 1,000 tokens on a DGX Spark, with a 93.6 GB proof which took almost a day to verify."

#What are the limits?

Anthropic lists several:

  • Decoding. "The proof is about an integer model under greedy decoding."
  • Context. "The system currently proves inference over contexts of up to 1,024 tokens."
  • Side channels. Anthropic says side channel attacks, such as measuring the time it takes to produce a proof, could potentially reveal information, adding: "We consider this out of scope for this release."
  • Weights. "The weights are not in this release: readers download them from Hugging Face themselves, under Meta’s Llama 4 license."

The repository describes its status as "A research artifact: not maintained, not accepting contributions." Anthropic says: "We release our code, Lean proofs, and documentation under the Apache 2.0 license."

The work ties to a goal in Anthropic's Frontier Safety Roadmap: "We will develop a prototype by September 30, 2026 of provable inference, a technique for reliably, provably ‘signing’ AI model outputs in a way that makes them attributable to a specific set of model weights." Anthropic notes that since an October 19, 2026 update, the roadmap uses the term "inference verification" rather than "provable inference".

#How does it compare?

FlashProve attributes outputs to a model through cryptography. Anthropic's separate text watermark, covered in our story on Anthropic adding Claude's text watermark to four older models, marks the text itself. For more Anthropic security research, see our report on Anthropic saying an unreleased Claude built exploits for Chrome and Windows.

The research credits eight authors from Anthropic, its fellows programs, EPFL, MIT, StarkWare, RESI and Succinct, including Roy Rinberg and Alex Allain of Anthropic.

Our analysis: FlashProve targets a real trust gap: users of AI through routers or evaluators testing a served model have no way to confirm the model behind a response. Anthropic's figures show proof generation that is practical on one GPU, but at a large cost over plain inference, a 1,024-token context limit and greedy decoding only. Those limits, plus TechCrunch's report of no deployment plans, make this a research milestone rather than a product. All performance numbers are Anthropic's and have not been independently tested in the sources we reviewed.

#What is unclear?

  • Deployment. No source gives a timeline. TechCrunch reported no plans to deploy it.
  • Independent checks. No source independently verifies Anthropic's speed figures.
  • Longer contexts. Anthropic does not say when the 1,024-token limit might rise.