AI inference just got a receipt. Anthropic released FlashProve on November 2, 2026, as an open-source research prototype that uses cryptographic proofs to show a language-model response came from committed weights without revealing those weights. The point is simple: a convincing answer does not prove which model produced it.
That gap matters in hosted AI, where users cannot inspect private model weights or rerun a model without substantial hardware. A routing service could substitute another system, an evaluator could receive a different model from the one intended for testing, or an attacker could alter the token stream before delivery.
FlashProve addresses those problems with a zero-knowledge succinct argument of knowledge, or zkSNARK. Its software-only design avoids trusted hardware, placing the burden on cryptographic verification rather than on a machine that users must simply choose to trust.
How FlashProve Establishes Model Identity
During an offline phase, the provider publishes a short commitment identifying one exact set of weights while keeping those weights secret. For a completed prompt-and-response pair, the system then produces a proof that the output tokens came from the model represented by that commitment.
Anyone holding the commitment, prompt and reply can check the proof without access to the weights. The design targets four properties: completeness, soundness, zero knowledge and succinctness. An honest proof should be accepted, while certifying a false statement should require breaking cryptographic assumptions regarded as sound.
The verification process also reveals neither the weights nor intermediate computation values. FlashProve hides which mixture-of-experts subnetworks ran for each token, although the model’s architecture remains visible—an important distinction for systems that expose their structure without exposing every internal choice.
The implementation uses Maverick’s mixture-of-experts structure. Prover work scales with the roughly 17 billion parameters active for a token instead of all 400 billion, while still hiding the expert choices. Segmented weights stream from host memory, allowing the prover to fit on one 80 GB GPU alongside about 290 GB of host memory.
Performance Looks Useful, Not Magical
Anthropic reported proof generation at 110 tokens per second for Meta’s Llama 4 Maverick. The evaluation used a publicly available 4-bit conversion of the model, and a server with one H100 and 24 CPU cores proved a batch of 24 requests in about 223 seconds.
Each request produced an 18.78 MB proof, while the offline commitment step took about 39 minutes. Those figures make the system a research prototype, not an invisible checkbox that infrastructure teams can add between lunch and the next budget meeting.
Verification requires less specialized hardware. The client downloads an approximately 6.5 MB commitment and checks proofs on a CPU without a GPU, with Anthropic measuring 17 seconds using 24 threads and 21 seconds using one thread, including checks from the offline phase.
That split matters because proof generation carries the heavier computational load, while checking can happen on ordinary CPU hardware. The measurements do not erase the cost of generating and storing proofs, but they show a path toward independent verification without handing every reviewer the model or a GPU cluster.
Anthropic describes possible uses in customer integrity checks, independent evaluations, regulatory tools and enforcement of approved-model requirements. Inference certificates could attest that requests were served by a claimed model, giving organizations a cryptographic record instead of relying only on provider assurances.
Those certificates have a clear boundary. They would not establish that the same hardware was not also training another model, which limits what they can demonstrate about compliance rules based on how computing capacity is used.
FlashProve therefore solves one narrow problem with unusual precision: proving which committed model generated a response while keeping the model’s weights private. It does not turn hosted AI into a transparent system, and it does not settle every compliance question—but it gives evaluators a stronger answer than “trust the endpoint.”
Based on
- Anthropic Releases FlashProve for Cryptographic AI Inference Proofs — unite.ai
- Anthropic’s Claude will now leave a trail that shows whether a text was made with AI | The Independent — independent.co.uk
- Who gets to check the AI giants? A new group wants to set the rules — nbcnews.com
- Watch Anthropic to Spend $895 Billion in the Years Ahead – Bloomberg — bloomberg.com
- A new way of measuring AI models suggests China’s threat to OpenAI and Anthropic may have been overblown — africa.businessinsider.com
