Anthropic announced FlashProve, a system built on a hash‑based zkSNARK that can cryptographically verify outputs from large language models while keeping the model’s weights private. The prototype was released on November 2, 2026, and is provided as open‑source software under the Apache 2.0 license.
How FlashProve works
The process consists of two phases. First, the model provider creates a commitment to a specific set of neural‑network weights, generating a 6.5 MB commitment after about 39 minutes of offline processing. Second, for each inference request, FlashProve produces a succinct proof that the committed model generated the exact output tokens for the given prompt. The proof does not expose the model’s weights, activations, or routing decisions.
Performance benchmarks
Anthropic tested FlashProve on Meta’s 4‑bit quantized Llama 4 Maverick, a 400.7‑billion‑parameter mixture‑of‑experts model. Running on a single NVIDIA H100 GPU, the system processed roughly 110 tokens per second and handled a batch of 24 requests in about 223 seconds. Each 1,024‑token request produced a proof of approximately 19 MB, which a standard CPU can verify in 17–21 seconds.
The computational cost of generating proofs is significant, ranging from 70 to 95 times the GPU time required for standard inference. Consequently, FlashProve is described as a research tool rather than a production‑ready solution.
Development and verification
The project was led by Roy Rinberg and Alex Allain of Anthropic, with contributions from researchers at EPFL, MIT, StarkWare, Succinct, and other institutions. The formal security properties of the proofs have been machine‑checked using the Lean proof assistant.
Implications
FlashProve demonstrates that it is technically possible to verify the provenance of responses from frontier‑scale AI models using cryptographic proofs. However, the high proving overhead and proof size (about 19 MB per 1,024‑token request) present challenges for scaling the approach to routine use.
