Anthropic Open-Sources FlashProve to Cryptographically Verify AI Model Identity

Anthropic released FlashProve on November 2, a research system and open-source codebase for provable inference that generates cryptographic proofs alongside AI model outputs, allowing an independent verifier to confirm that a given response came from a specific, pre-committed model — without ever accessing that model's weights. The system addresses a quietly significant vulnerability in commercial AI: nothing currently prevents a provider from silently substituting a cheaper or weaker model while claiming to serve a frontier system, and no customer can detect the swap through API calls alone.

FlashProve's proofs work similarly to cryptographic email signatures — a verifier can confirm authenticity without needing the sender's private key. The analogy extends further: a provider publishes a cryptographic commitment (a compact fingerprint of a specific model) in advance, then generates an accompanying proof for each request. Any party holding the commitment file can verify that the response was produced by that exact model, using only a CPU and no access to the original weights.

How Zero-Knowledge Proofs Scale to a 400-Billion-Parameter Model

The core challenge in applying zero-knowledge proofs to modern AI is computational scale. Standard dense transformers activate every parameter for every token; proving a 400-billion-parameter forward pass cryptographically would require impractical compute. FlashProve sidesteps this by targeting Llama 4 Maverick, a mixture-of-experts (MoE) model where only roughly 17 billion of 400 billion parameters activate per token through learned routing. The proof system only needs to verify the computations along the active expert path, making the problem roughly 20× smaller than the total parameter count suggests, according to Anthropic's published research.

The underlying construction is an Interactive Oracle Proof (IOP) — an information-theoretic object — compiled into a zkSNARK using collision-resistant hash functions rather than the elliptic-curve assumptions used in most blockchain zero-knowledge systems. That choice provides post-quantum security: the cryptographic guarantees remain valid even against future quantum computers, a property hardware-based attestation approaches such as Intel SGX do not share. Anthropic additionally machine-checked the system's top-level security properties — completeness, soundness, and zero-knowledge — using the Lean formal proof assistant.

Deployment involves two phases. The offline commitment phase — run once — takes approximately 39 minutes and produces an approximately 6.2 MB commitment file per model deployment, valid for roughly 16 million subsequent requests. The online proof phase runs post-hoc: after inference completes, FlashProve regenerates the computation and produces an 18.78 MB proof per 1,024-token batch at 110 tokens per second on a single Nvidia H100. A verifier needs only the approximately 6.2 MB commitment and standard CPU cores — Anthropic's tests show verification completing in 17 seconds on 24 threads, 21 seconds on a single thread.

110 Tokens Per Second: Progress Measured Against a Very Low Bar

Performance numbers require context. FlashProve's 110 tok/s represents an extraordinary advance over prior academic attempts at the same scale: the previous state of the art for proving inference on Llama 4 Maverick was VerInf, which achieved roughly 0.02 tok/s and produced proofs of 93.6 GB — nearly one full day to verify a single request. FlashProve is approximately 5,500 times faster on proof generation and reduces proof size by a factor of roughly 5,000, as documented in FlashProve's published benchmarks.

Against production inference, the gap is different. Standard vLLM throughput on the same hardware reaches thousands of tokens per second; FlashProve requires 72 to 94 times more GPU compute per batch. At current overhead, integrating FlashProve into a production API would multiply inference cost by roughly the same factor, making it economically impractical as a standard feature. Anthropic explicitly states there are no plans to deploy FlashProve at the lab or any other.

Attestable and the Nascent AI Attestation Market

Anthropic is not alone in this space. Attestable, an AI attestation startup that raised $20 million in seed funding in August 2026 in a round led by TLV Partners and Altimeter Capital, has claimed 53 to 77 tokens per second on a single H100 for Gemma 4 31B in alpha testing — a smaller model than Maverick. Attestable has not published its proof system design. That opacity makes independent evaluation impossible: a commercial attestation product whose cryptographic construction cannot be audited provides a weaker trust guarantee than a published and open-source system, regardless of raw speed. FlashProve's Apache 2.0 release directly pressures the emerging market to publish its methods.

The broader competitive field also includes DeepProve, an academic system achieving 2.9 tok/s on a single GPU and 31 tok/s distributed — though on smaller models than Maverick. Hardware-based alternatives using Trusted Execution Environments (TEEs) offer lower overhead but require trusting a hardware vendor's supply chain, cannot provide post-quantum security, and have faced documented side-channel vulnerabilities.

What FlashProve Cannot Yet Do

Significant constraints remain. The current implementation is hard-limited to 1,024 tokens per proof — a fraction of the context windows that production AI APIs support. Only greedy (argmax) decoding is supported; sampling-based generation, which most deployed systems use, cannot currently be proved. The commitment reveals model structure details rather than hiding them entirely: a provider can verify outputs without disclosing weights, but cannot hide the architecture from parties examining the commitment. Side-channel attacks on the proof generation process have not been addressed. And 18.78 MB per request, while dramatically smaller than 93.6 GB, is several orders of magnitude larger than a standard API response — the brief's characterization of this as "compact" requires qualification.

A Research Prototype That Points Toward Regulatory Infrastructure

The most consequential application of FlashProve may not be consumer trust but regulatory compliance. Anthropic's post explicitly names "third-party independent safety evaluations without requiring direct model access" as a primary use case — which maps directly to audit requirements emerging under the EU AI Act and voluntary commitments made to the US AI Safety Institute. If provable inference matures, regulators could require labs to publish cryptographic commitments for all deployed models, enabling third parties to verify which model processed regulated data, generated compliance filings, or participated in activities subject to export controls or compute monitoring agreements. The commitment-and-proof paradigm offers a pathway to meaningful model accountability that does not require exposing proprietary weights — a structure both regulators and labs have incentive to support.

Anthropic met its own Frontier Safety Roadmap deadline for a provable-inference prototype in September 2026 through a separate hardware-based signing project. FlashProve is the cryptographic complement: slower and not yet production-ready, but auditable, post-quantum-secure, and designed to be improved by the broader research community. How quickly that community closes the remaining performance gap — from 110 tok/s to something approaching production viability — will determine whether cryptographic model identity becomes a standard feature of AI infrastructure or remains an aspirational research direction.