Anthropic's FlashProve can prove which model answered you — at about 72 times the GPU cost of serving it

Anthropic has published FlashProve, an open-source prototype that attaches a zero-knowledge proof to a language model's output, showing it came from one committed set of weights without revealing them. On a single H100 it proves Llama 4 Maverick at about 110 tokens per second. But that takes roughly 72 times the GPU time of ordinary serving, and it works only for 1,024-token windows and only for exact, greedy, integer-arithmetic decoding. It does not secure anyone's AI supply chain today. What it does is make "which model actually answered?" a question with a checkable answer instead of a leap of faith.

The short version

Almost every organisation that uses AI does so through someone else's servers: the model maker's API, a cloud marketplace, a reseller, or a "router" that picks a model for you. In each case, you trust that the model you selected is the one producing the replies. The output itself proves nothing. A cheaper or quantised model, a buggy inference stack, or an attacker who has compromised a server or sits in the middle of the token stream can produce text that looks just as plausible.

On November 2, 2026, Anthropic published "provable inference" research and released FlashProve, a prototype built with academic co-authors from EPFL, MIT and elsewhere. The idea works like a tamper-evident seal. The provider first publishes a short cryptographic commitment: a fingerprint that pins down one set of weights while keeping them secret. Then, for each reply, it produces a proof that "the committed model produces these output tokens". Anyone holding the commitment, the prompt and the reply can check the proof on an ordinary CPU, without the weights and without trusting the provider.

The catch is cost and scope. Proving is about 72 times slower than serving the same batch with vLLM, and proofs are about 19 MB. Verification takes 17–21 seconds per proof, and the system only covers short contexts and deterministic decoding. Anthropic calls it "intermediate progress, and not a completed research agenda".

Timeline

• 2025-04-07 — Researchers publish "Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs" (arXiv 2504.04715), concluding that "software-only methods are fundamentally unreliable" for detecting model swaps; Anthropic later cites it.
• 2026, undated — Moonshot AI publishes its Kimi Vendor Verifier alongside Kimi K2.6, after finding that differences between third-party APIs and its official API were "widespread".
• 2026-05-05 — Anthropic's Frontier Safety Roadmap moves the Phase 1 target for its "moonshot R&D" security projects (including provable inference) from May 15 to September 30, 2026.
• September 2026 — The Singapore AI Safety Hub (SASH) publishes a research note on what proving LLM inference costs.
• 2026-10-19 — Roadmap update: Anthropic says it "broadly achieved" the goal, with a prototype that "runs on production inference" and token signing on all internal traffic; the goal is renamed "inference verification".
• 2026-11-02 — Anthropic publishes the FlashProve post, technical report and Apache-2.0 code (page modified November 3).
• 2026-11-03 to 11-05 — TechCrunch and other outlets cover the release. As of November 5 we found no named outside expert reaction and no independent reproduction.

What we know

What is released. According to Anthropic's post, the release includes:

• a protocol specification and technical report;
• a GPU prover;
• a fast C++ verifier "which carries no formal guarantee";
• a slower verifier written in Lean, with Lean proofs of the top-level security statements;
• an interactive visualiser of the Lean theorems.

The GitHub README describes version 0.16.0 as "a research artifact: not maintained, not accepting contributions". The Llama 4 weights are not included. (Anthropic, GitHub)

The threat model. The post lists several situations where a user "cannot check that the responses came from the specific model" they selected:

• a model "secretly substituted in by a routing service for cost reasons";
• an attacker who "modifies the token stream while pretending to be a given model", in which case "a user has no way to detect it from the output alone";
• compromised inference servers ("As AI models grow more valuable, the servers that run them become prime targets"), citing RAND and a Wiz write-up of an NVIDIA Triton vulnerability chain;
• a more advanced model that runs "in place of the one that was authorized and present[s] itself as the weaker model";
• compliance checks for AI "pacing" agreements.

The post describes no specific incident that prompted the work.

The numbers. All are Anthropic's own measurements on Llama 4 Maverick (about 400B parameters, ~17B active per token) with 4-bit weights:

• The offline commitment phase "takes about 39 minutes", and a commitment "is good for about 16 million requests".
• A batch of 24 requests of 1,024 tokens "takes the prover about 223 seconds, which is 110 tokens per second" on one H100.
• That is "about 72 times longer than vLLM takes to process the same 24 requests" (66–77 across runs), and "about 94 times longer" at the highest vLLM load tested.
• "Each proof is 18.78 MB"; the client downloads a commitment of "~6.5 MB in all". Checking a proof "takes 17 seconds on 24 threads (and 21 seconds on a single thread)".

The post compares this with earlier open systems:

• zkLLM proved a 13B model at about 2.5 tokens per second on an A100 in 2024;
• DeepProve reaches "about 2.9 tok/s for GPT-2 and 1.4 tok/s for Gemma 3";
• SASH's prover reaches "≈1.25 tok/s on Llama 3.1 8B on a single H100".

The security claim. The README states that soundness is proved in Lean 4. A dishonest provider is caught except with a probability of about q/2^124 + 2^-101 after q hash queries. The README also warns that the commitment ID must come from a party the user trusts, not from the server being checked or from files shipped with the proof.

What Anthropic does in production is a different project. The roadmap's October 19 update says Anthropic "built a prototype that runs on production inference" that "checks that outputs come from a specific set of model weights". It also "rolled out signing on all of our internal token traffic", which "has already caught one extremely rare, benign integrity glitch". The FlashProve post says the roadmap goal was met "through a separate but related project, which signs our inference traffic and recomputes inference on a trusted server". The goal is now called "inference verification" rather than "provable inference". (Roadmap)

Technical analysis

What is actually proved. Conceptually, FlashProve turns one forward pass of a transformer into a large arithmetic statement and proves, with a zkSNARK, that the statement holds for the committed weights. Three design choices make it fit on one GPU:

• It proves only the experts a token actually uses in a Mixture-of-Experts model (~17B of 400B parameters).
• It proves requests in batches after they have been served, rather than on the hot path.
• It works over an exact integer version of the weights.

The last choice is the important caveat. Production inference runs in floating point and usually samples. Anthropic notes that "a reply from a floating-point implementation, or sampled decoding, could depart at some position and no longer exactly match the computation proved". So the proof certifies a reference computation that a real serving stack only approximates.

Why the AI-specific threat is real. Model integrity used to be an academic concern. It is now a practical one, for three reasons. First, the inference layer has become a high-value target. Our recent coverage of exposed AI gateways, stolen provider keys and inference-stack bugs shows attackers going after exactly the servers and middleware that sit between users and models. Second, the economics invite quiet substitution. A router that swaps a frontier model for a quantised one saves real money, and Kimi's vendor verifier exists because Moonshot found output differences between third-party providers and its own API to be "widespread". Third, the substitution research Anthropic cites concluded that statistical and log-probability tests are unreliable, because normal non-determinism in production hides small swaps.

Where this sits among the alternatives. There are roughly four ways to get assurance about which model ran. SASH's September note lays them out:

• trusted execution environments: single-digit to ~30% overhead, but you trust the hardware vendor, the firmware and the absence of side channels;
• recomputation by a third party holding the weights;
• spot checks of activations;
• zero-knowledge proofs, which move trust to cryptographic assumptions and to code both sides can read, at far higher cost.

Anthropic itself writes that "trusted hardware and cryptography are complementary approaches with different guarantees and tradeoffs". Tellingly, its own production system uses signing and recomputation, not FlashProve.

Our assessment: FlashProve's contribution is moving zero-knowledge inference from toy models to a frontier-sized open model on one GPU. By Anthropic's comparison, that is roughly two orders of magnitude faster than earlier open systems. The SASH note reported 46–122x overhead for decoded tokens and 400–1,100x over full requests on a much smaller model, so a ~72x figure on Maverick is notable. The measurements are not like-for-like, though, and nobody outside Anthropic has reproduced them yet.

What the proof does not cover. Anthropic is explicit about the limits:

• The architecture is not hidden ("hiding the architecture of the model is not a goal of this system").
• Side channels such as proof timing "could potentially reveal information about the weights" and are out of scope.
• Proving the outputs "does not establish that the hardware is not, e.g., training on the side".
• Contexts are capped at 1,024 tokens, "quite short in comparison to the contexts accumulated in chat settings".
• "We do not guarantee that all three (Lean, paper, code) match each other".

The post does not address system prompts, tool calls, retrieval or agent scaffolding. Our assessment: a proof that "these weights produced this text" says nothing about what else was fed into the context. That is where most real attacks on AI applications operate: prompt injection, poisoned retrieval, tampered tool output.

The trust anchor moves, it does not disappear. The scheme is only as good as the commitment the user checks against. The README insists the commitment ID must come from a trusted party, not the server. In practice, someone (the model maker, a registry, a regulator) must publish and stand behind commitments, and users must fetch them over a channel the attacker does not control. That is a key-distribution problem familiar from code signing, and it is unsolved here.

What remains unclear

• Per-token or per-reply? The post says "each verifier request is a window of 1,024 tokens, and each proof checks one token". Its overview, though, describes a proof that the model "produces these output tokens". The post does not make clear how a full multi-token reply is proved or what that costs; the README's full-model route proves "one token".
• Independent verification. As of November 5, 2026, we could find no published outside reproduction of the 110 tokens/second, 72x or 19 MB figures. The C++ verifier, which is the one anyone would actually run, has no formal guarantee.
• The production system. Anthropic gives no detail on how its signing-and-recomputation project works, what share of traffic is recomputed, or what the "benign integrity glitch" was.
• Closed models. The experiments use open weights. The post does not discuss whether a closed-model provider would publish commitments for its own models, or under what governance. TechCrunch reports that there are no plans to deploy FlashProve at Anthropic or any other lab; we did not find that statement in Anthropic's post.
• Sampling and long context. Both are left to future work, with no timeline.

Lessons and what to do

For security teams buying AI services:

• Treat "which model answered" as an unverified claim today. Ask providers and routers in writing how they guarantee model identity and version, whether they quantise, and what they log.
• Log the model identifiers, versions and response metadata your providers return, so a silent change is at least visible after the fact.
• Watch for behavioural drift on your own evaluation set. Kimi's vendor verifier shows the kind of checks that catch degraded deployments: parameter enforcement, tool-call accuracy, long-output stress tests.

For AI builders and platform teams:

• Sign or MAC token streams end to end between your inference servers and your application layer. Anthropic's own first production step was signing, and it caught a real (benign) integrity fault.
• Keep the inference tier on your threat model. Model servers, gateways and routers are now attack targets, and a compromised node can alter outputs without any visible error.
• If you evaluate FlashProve, use the Lean verifier for assurance claims and treat the fast verifier as unaudited, as Anthropic does.

For leadership and procurement:

• Contract terms should name the exact model and version, prohibit undisclosed substitution and require notice of changes. Cryptographic proof is years from routine use; contractual and logging controls are available now.
• Regulators and auditors working on AI compliance should note that technical verification of "which model ran" is becoming possible. It needs a trusted public commitment registry, though, and nobody has built that governance piece yet.

Sources

• Anthropic, "Provable inference" / FlashProve research post (November 2, 2026; modified November 3)
• FlashProve technical report
• FlashProve repository and README (v0.16.0)
• Anthropic, Frontier Safety Roadmap (October 19, 2026 update)
• Cai, Shi, Zhao, Song, "Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs" (arXiv 2504.04715)
• Moonshot AI, Kimi Vendor Verifier
• Singapore AI Safety Hub, "What proving LLM inference actually costs" (September 2026)

Coverage:

• TechCrunch, "Anthropic is working on a system to prove AI models' identity" (November 3, 2026)