Anthropic’s Frontier Red Team has released FlashProve, an open-source prototype for proving that an AI response originated from a specific, committed set of model weights. The system uses zkSNARK cryptography to verify model identity without revealing the weights themselves. On a 400B parameter mixture-of-experts model known as Llama 4 Maverick, FlashProve generates proofs at approximately 110 tokens per second using a single H100 GPU. This addresses a current limitation where developers cannot independently verify which model an API call actually invoked.
System specifications and performance
The prototype targets a 400B parameter mixture-of-experts model, activating roughly 17B parameters per token. Context is capped at 1,024 tokens per request. The prover requires one H100 GPU with 80 GB of memory, 24 CPU cores, and approximately 290 GB of host RAM. The verifier runs entirely on a CPU and requires no graphics card.
Benchmarks indicate FlashProve is orders of magnitude faster than previous open-source zkML systems running on the same hardware. The system achieves 110 tokens per second for proof generation on a single H100. Verification of a proof takes 17 seconds with 24 CPU threads and 18.78 MB of data. However, generating the proof costs between 70 and 95 times more GPU time than standard vLLM inference.
Use cases for provable inference
Currently, a user querying a model cannot confirm which specific model produced the response. A routing service could swap in a cheaper alternative. An attacker could also tamper with the token stream. Assessing output quality alone is insufficient for verification.
Anthropic lists four potential applications:
- Regulators could confirm hardware is serving inference, supporting AI pacing rules.
- Labs could detect tampered inference servers.
- Users could verify text provenance.
- Regulators could enforce the serving of only approved models.
Technical operation
FlashProve consists of a prover, managed by the model provider, and a verifier, used by the client. The process operates in two phases:
- Offline: The provider publishes a commitment, a short fingerprint binding one exact set of weights. This setup takes about 39 minutes and covers approximately 16 million requests.
- Online: For each request, the GPU produces a proof that the committed model generated those tokens.
The system compiles an interactive oracle proof into a cryptographic proof using hash functions. Anthropic states this offers post-quantum security. It belongs to the same family used by validity-proof Layer 2 networks such as Starknet.
Three engineering choices drive the speed. Prover work scales with the roughly 17B active parameters, not the full 400B. Requests are proved in batches after the fact, similar to prefill. Weights stream from host memory, meaning a single 80 GB GPU is sufficient.
Benchmark results
Anthropic measured the public 4-bit Maverick weights on one H100 with 24 CPU cores. Results from the repository performance guide show:
- A batch of 24 yields 111.23 tokens per second, taking roughly 221 to 226 seconds per batch.
- A batch of 1 yields 17.41 tokens per second.
- A batch of 64 yields 123.31 tokens per second, but this is flagged as unreliable on 80 GB cards.
- Proof size is 18.78 MB. The client downloads roughly 6.5 MB once per commitment.
- Verification takes 17 seconds on 24 threads and 21 seconds on a single thread.
When compared against vLLM running FP8 Maverick on eight H100s, proving costs about 72 times the GPU time per batch. At vLLM’s highest tested load, the gap widens to about 94 times.
Comparison with other zkML systems
FlashProve benchmarks against several other systems including Attestable, VerInf, DeepProve, and zkLLM. The comparison table highlights differences in model proven, throughput, hardware, proof size, and verification time.
FlashProve proves Llama 4 Maverick (400B MoE) at roughly 110 tokens per second. Attestable tests Gemma 4 31B (dense) at 53 to 77 tokens per second. VerInf processes Llama 4 Maverick at approximately 0.02 tokens per second, taking 14.3 hours for 1,000 tokens. DeepProve operates on GPT-2 and Gemma 3, achieving 2.9 and 1.4 tokens per second respectively. zkLLM claims full inference in under 15 minutes.
In terms of hardware, FlashProve uses one H100 plus 24 CPU cores. Attestable uses one H100. VerInf requires one DGX Spark. DeepProve runs on a single machine distributed at 31 tokens per second. zkLLM runs on a GPU using CUDA. Proof sizes vary significantly, with FlashProve at 18.78 MB and Attestable between 4.35 and 7.92 MiB. Verification times range from 157 to 648 milliseconds for Attestable to 17.7 hours for VerInf.
Security verification
Cryptographic code is brittle, so Anthropic formalized the protocol in Lean. It proves completeness, soundness and zero knowledge. The README states a cheating provider is caught except with a probability of about q/2^124 plus 2^-101.
FlashProve ships with two verifiers. A fast C++ verifier is for daily use but carries no formal guarantee. A slower Lean verifier is proven to accept only what the soundness theorem accepts. The Anthropic team notes Claude helped optimize the system.
What it means
Developers and users gain a way to cryptographically confirm a model’s identity without exposing its weights. This prevents routing services from silently swapping models and allows verification of text origin. The trade-off is significant computational cost for the prover, which currently limits practical deployment to high-value scenarios.
