Anthropic’s FlashProve Proves Which Model Wrote an Answer, at 400B Scale

i10X Quick Take

Quick Take

1. The finding: Anthropic’s open-source FlashProve generates cryptographic proofs that an output came from committed model weights, for a 400-billion-parameter model shaped like Llama 4 Maverick, on a single H100 at about 111 prompt tokens per second.
2. The numbers: Each proof is about 19 MB, takes 21 seconds to check on one CPU thread and reveals nothing about the weights by design, but proving costs 20 to 93 times the GPU time of serving with vLLM.
3. The caveat: Each proof covers one output token of a special integer model, nothing is proved about the C++ programs, and AI systems wrote the paper and code with no independent human review so far.

When you call an AI model through an API or a router, you cannot check which model actually answered. Anthropic’s Frontier Red Team now presents a prototype that tackles this cryptographically. In the post “Progress on provable inference for large language models” and the accompanying technical report “FlashProve: Hash-Based Proofs of LLM Inference at 400 Billion Parameters”, Roy Rinberg and Alex Allain of Anthropic, together with collaborators from EPFL, StarkWare, MIT and Succinct, release a zero-knowledge proof system for LLM outputs. The provider commits to its weights once and then attaches a short proof to a response, which anyone can verify without seeing the weights.

What the study shows

FlashProve is a hash-based “commit-and-prove” argument, a form of zkSNARK. The team tested it on public, mostly 4-bit weights of Llama 4 Maverick (400.7 billion parameters, a mixture-of-experts model), converted into an integer model so that results are bit-exact across machines.

• Speed: In batches of 24 requests with 1,024-token windows, one H100 proves 111.23 prefill tokens per second at steady state, about 9.2 seconds per request. With one request per batch, the rate drops to 17.41 tokens per second.
• Size and checking: A proof file has 18.74 to 18.81 MB. The C++ verifier checks one in 21.14 seconds on a single thread. Committing to the weights once takes about 39 minutes.
• Cost: Per GPU, proving takes 71.4 to 93.0 times the GPU time of stock vLLM for prefill and 20.1 times for decoding at 512 streams, and the authors say these multiples could be higher.
• Rejecting fakes: On synthetic weights, the released verifier rejected all 57 proof files made by malicious provers, 24 of them claiming a false output. In the timed runs on the public weights, the programs rejected 240 of 240 altered copies of honest proofs.
• Machine-checked theorems: Soundness, completeness and zero knowledge of the protocol are proved in the Lean proof assistant, with a soundness error of about q/2¹²⁴ + 2⁻¹⁰¹ after q hash queries.

System (as reported)	Model	Hardware	Proving	Proof size
FlashProve	Integer Llama 4 Maverick (400.7B MoE), 1,024 tokens	One H100	111 tokens/s in batches of 24	18.7–18.8 MB
VerInf	Integer Llama 4 Maverick, 1,000 tokens	One DGX Spark	14.3 h	93.6 GB
zkLLM	OPT-13B / LLaMA-2-13B, 2,048 tokens	One A100	713 s / 803 s	160–188 kB

Why it matters: Checking the model behind the answer

Anthropic names three use cases. Regulators could check that hardware is really serving inference. Providers could detect a compromised server, or a stronger model passing itself off as a weaker one, because every response must carry a valid proof for the committed weights. And users of routers or evaluators testing a model could confirm that the tokens came from the model they paid for or tested.

Previous zero-knowledge systems for LLMs mostly handled models with a few billion parameters or needed hours per proof. Showing that a 400B model can be proved at over 100 tokens per second on one GPU moves provable inference from theory toward something that could be priced into a service. Code, Lean proofs and documentation are released under Apache 2.0 so that others can audit and improve them.

Method in brief

• Protocol: The weights are encoded with a masked Reed–Solomon code and committed via Merkle trees; offline, link and online proofs show the output is the greedy result of the committed weights. Fiat–Shamir makes the proofs non-interactive.
• Implementation: Committer, prover and a fast verifier in C++ and CUDA, a vLLM integration, and a second, provably correct verifier in Lean.
• Tests: Timed runs on one H100 of an eight-GPU host, honest and malicious proofs on synthetic and public weights, and fault-injection tests of the weight masking.

What remains open

• One token per proof: In the timed runs, each proof certifies the model’s run over the prompt and checks one output token, the one that follows the prompt.
• Not today’s serving stacks: Proofs require serving the integer model itself. Of 96 outputs each from two standard floating-point engines, none matched it at every position, and the integer model’s greedy token differs from the 16-bit model’s at 6.81% of positions. Its task quality was not measured.
• Programs are unproved: The Lean theorems cover the protocol, not the C++ programs that clients run by default, and no security level is claimed for them. Almost no attacks were sought; the authors stress that this “is not a finding of safety”.
• Weight hiding is a judgment: That the programs hide the weights rests on design, code review and a few tests, not a proof, and it does not cover a real model’s weights.
• No human review: Under human direction, AI systems wrote the paper, almost all of the code and the Lean library, and made every reported test; as far as the authors know, no person has checked these.
• Commitments are not identities: A commitment does not say whose model it holds, so clients must trust whoever publishes it.

Context: Signing AI output

Anthropic had set itself the goal of a provable-inference prototype by September 30, 2026, and says it met that goal with a separate system that signs inference traffic and recomputes inference on a trusted server. FlashProve pursues the same aim without trusted hardware. The demo uses a Meta model architecture because its weights are public; Anthropic says Claude built the system and found new ways to apply state-of-the-art cryptography, while the Lean statements are meant to make its hard-to-evaluate decisions auditable. The topic connects to recent safety work on i10X, such as frontier models sabotaging successor training and LLMjacking attacks on cloud accounts. More research is collected in Safety & Alignment and Security & Defense.

What it means for providers, routers and regulators

• Providers: Proof-carrying responses are now technically feasible for large open models, but at many times the GPU cost, and only for an integer model served bit-exactly.
• Routers and API buyers: In the long run, proofs could replace trust in whoever forwards your request. For now, it is a prototype to evaluate, not a feature to demand.
• Auditors and regulators: The open release with Lean proofs is a concrete base for independent review, which the authors explicitly invite.

About the analysis

Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.

This article is based on Anthropic’s blog post of November 2, 2026 and the full FlashProve technical report from the public GitHub release, including its limitations sections. The report is not peer-reviewed and has no arXiv ID or DOI. All numbers come from the report; i10X did not rerun the system. The chart was drawn by i10X from Section 7.8. Anthropic evaluates its own system here. AI tools assisted with research and drafting; the selection, fact-checking and final editing were done by the i10X editorial team.

i10x Perspective

FlashProve doesn’t make verifiable AI cheap yet, but it makes it concrete. Proving 400 billion parameters on one GPU is the kind of step that turns “trust us” into “check it”, and the candid list of what is not yet proved shows how much work remains.