Anthropic published a research post on November 2, 2026 describing FlashProve, an open-source prototype that lets a model provider commit to a model and then prove that each response was produced by that model. The post, from Anthropic’s Frontier Red Team, says it is meant to share “intermediate progress, and not a completed research agenda.” TechCrunch reported on the release on November 3, 2026 and said there are no plans to deploy FlashProve at Anthropic or any other lab.

The problem the post describes

The post says users generally cannot confirm that a response came from the model they requested. It cites routing services silently substituting cheaper models and attackers tampering with the token stream, and it lists possible uses including independent evaluation, third-party routing, regulatory compliance and detection of server compromise.

How the system works, per the post

  • FlashProve is a software-only zero-knowledge proof system (a zkSNARK) that the post says is built from hash functions and claims to be secure against quantum attacks.
  • In an offline phase, the prover publishes a short commitment, a kind of fingerprint, to the model’s weights, which stay hidden.
  • In an online phase, for each request, the prover produces a proof that the committed model produces the given output tokens when evaluated.
  • A checker needs only the commitment, the prompt and the reply. The weights, intermediate values and which experts ran are hidden; the model’s architecture is not, and the authors say “hiding the architecture of the model is not a goal of this system.”

Reported performance

The figures below are the authors’, measured on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with about 17 billion parameters active per token, using public 4-bit weights, on one H100 GPU and 24 CPU cores.

  • Proving speed: about 110 tokens per second in the online phase, with a batch of 24 requests taking about 223 seconds.
  • Proof size: 18.78 MB per proof.
  • One-time setup: the offline phase takes about 39 minutes per model, and a commitment is good for about 16 million requests before a new one is needed.
  • Verification: CPU only. A client downloads a commitment of about 6.5 MB plus one proof per request; checking takes about 17 seconds on 24 threads and 21 seconds on one thread.
  • Overhead: proving a 24-request batch takes about 72 times as long as the vLLM serving baseline per GPU (66 to 77 times across runs), and about 94 times at the highest vLLM load tested; the headline range is roughly 70 to 95 times. The baseline used the FP8 release on eight H100 GPUs.
  • Accuracy: the post reports no accuracy or output-quality metric. It says the integer model is expected, and empirically tested, to stay within “some small error rate” of floating-point inference but does not quantify it.

Limits the authors state

  • The proof is about an integer model under greedy decoding, so floating-point or sampled replies could diverge, and adversarially designed prompts are not covered.
  • The system assumes the served model uses a mixture-of-experts architecture.
  • Contexts are limited to 1,024 tokens.
  • Side channels, such as timing measurements that could leak information about the weights, are “out of scope for this release.”
  • The code, the Lean proofs and the paper are not guaranteed to match each other, and the C++ verifier has no formal guarantee, though it agrees with the Lean verifier on tests.
  • Proofs show that hardware is serving inference but do not establish that it is not, for example, training on the side.

What was released

Anthropic released a blog post, a technical report, a protocol specification, code (a prover, a C++ verifier and a Lean verifier), Lean proofs and an interactive visualizer. Code, proofs and documentation are under the Apache 2.0 license. The Llama 4 weights are not included and must be downloaded from Hugging Face under Meta’s license. The authors include Anthropic staff and fellows and researchers affiliated with EPFL, MIT, StarkWare, RESI and Succinct.

Comparison with earlier work

The post compares FlashProve with earlier systems, noting that the rows differ in model, hardware and settings. It lists, for example, zkLLM at about 2.5 tokens per second batched on one A100 for LLaMA-2-13B, DeepProve at about 2.9 tokens per second for GPT-2 on one machine, and a commercial attestation product at 53 to 77 tokens per second for Gemma 4 31B on one H100, with no open-source library at the time of writing.

Sources and notes

This post is based on Anthropic’s research post “Progress on provable inference for large language models” (November 2, 2026) and TechCrunch’s report by Russell Brandom (November 3, 2026, 2:41 p.m. PST). Lens did not read the technical report, specification or code, and did not run or verify the system; all performance figures are the authors’. The post is internally inconsistent on proof size: its executive summary gives about 19 MB per 1,024-token request, while its evaluation section describes each proof as checking one token.

Image: a brass combination lock on a leather case, by Huskyherz via Wikimedia Commons, licensed under CC0; cropped. Stand-in photo used as a visual metaphor; it is not related to the research and does not show the events described.