Anthropic FlashProve: open-source cryptographic proof that a reply came from the promised model
What is it?
FlashProve lets a model provider prove that a reply came from one specific set of committed weights without revealing those weights. It's built on zkSNARKs, a cryptographic method that shows a computation was done correctly with a short proof that reveals nothing else. On a 4-bit Llama 4 Maverick (a 400B MoE), a single H100 proves about 110 tokens per secondVendor claim, and each 1,024-token request produces a proof of about 19 MBVendor claim. Checking a proof takes around 17 secondsVendor claim on a 24-core CPU, no GPU needed. The prover, a fast C++ verifier, a slower Lean-verified verifier and the Lean proofs are all released under Apache 2.0.
Why does it matter?
Right now a user can't tell whether a routing service quietly swapped in a cheaper model or an attacker tampered with the token stream. If proofs like this get practical, third-party API resellers, model evaluators and compliance checks could finally pin down which model actually answered. The cost is still 70-95x the GPU timeVendor claim of running the same requests on vLLM, so for now it fits spot checks and after-the-fact audits.
Maturity
ResearchIt's a research prototype. Anthropic says it handles contexts up to 1,024 tokens, proves only an integer model with greedy decoding, and doesn't guarantee that the fast C++ code matches the Lean spec.
How to track it
- Reproduction: see whether the 110 tokens per second figure holds up in GitHub issues and independent measurements.
- Scope: watch for longer contexts, sampled decoding and architecture hiding in follow-up versions.
- Real use: check for official word on Anthropic attaching proofs to its own API or to work with evaluators.