Anthropic releases FlashProve cryptographic proof system for AI model verification

Anthropic's Frontier Red Team released FlashProve on November 3, 2026, an open-source cryptographic proof system enabling zero-knowledge provable inference for AI models. FlashProve verifies that an API output originates from committed model weights without revealing internal parameters. Designed to combat unauthorized model swapping, regulatory non-compliance, and output tampering, the prototype proves 110 tokens per second on a 400B MoE model using one H100 GPU. Anthropic verified its protocol using the Lean proof assistant.

Cryptographic architecture and operation

• ▪Anthropic's Frontier Red Team released FlashProve providing cryptographic proofs that an AI response originated from committed model weights
• ▪FlashProve operates in two phases: an offline phase that publishes a weight commitment taking 39 minutes for 16 million requests, and an online phase where GPUs produce proof for each request
• ▪FlashProve generates mathematical proofs without exposing an AI model's internal weights, allowing commercial AI developers to publish weight fingerprints while protecting proprietary IP
• ▪FlashProve uses hash-based cryptographic proofs to compile interactive oracle proofs, providing post-quantum security guarantees similar to Starknet's L2 validity proofs

Practical applications and use cases

• ▪FlashProve prevents AI providers from swapping in cheaper models to cut costs or using more expensive models to inflate benchmark performance
• ▪FlashProve enables regulators to verify that approved models run on compliant hardware, helping enforce AI pacing rules and output provenance
• ▪FlashProve allows third parties to cryptographically verify claims that specific tasks, such as vulnerability scans or business plans, were performed by specific AI models

Performance metrics and computational overhead

• ▪FlashProve proving incurs a computational overhead of 72x to 94x the GPU time of unproven vLLM inference on Llama 4 Maverick
• ▪FlashProve generates proof files of 18.78 MB, with client verification taking 17 seconds on 24 CPU threads and 21 seconds on a single thread

Hardware requirements for proving and verification

• ▪FlashProve prover hardware requires 1 Nvidia H100 80GB GPU, 24 CPU cores, and 290 GB of host RAM, while capping request context at 1,024 tokens
• ▪FlashProve verification requires no GPU and can be executed locally on a standard CPU

Comparison with existing zkML systems

• ▪FlashProve produces 18.78 MB proofs for Llama 4 Maverick, compared to VerInf's 93.6 GB proof size and Attestable's 4.35 to 7.92 MiB proof size on Gemma 4 31B
• ▪FlashProve achieves ~110 tokens per second on Llama 4 Maverick, whereas competing open-source zkML system VerInf yields ~0.02 tokens per second on the same model

Formal verification using Lean

• ▪Anthropic formalized FlashProve's cryptographic protocol in the Lean proof assistant to mathematically prove its completeness, soundness, and zero-knowledge properties
• ▪FlashProve provides both a C++ verifier for fast execution and a formally verified Lean verifier guaranteed to accept only proofs satisfying the mathematical soundness theorem