Anthropic releases FlashProve, an open-source prototype for provable LLM inference

On 2 November 2026 Anthropic's Frontier Red Team, working with researchers from EPFL, MIT and other groups, described progress on provable inference: a way for someone with modest computing power and no access to a model's weights to check that a response really came from the model a provider says it serves. Anthropic's examples include independent evaluators who need to know which model they are testing, customers who reach a model through a routing service, and token streams tampered with by an attacker.

The system, FlashProve, builds on a type of zero-knowledge proof called a zkSNARK, and Anthropic credits Claude with the improvements that make it much faster than earlier open-source systems. For Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with 4-bit weights, one H100 GPU generates proofs at around 110 tokens per second, with a proof of about 19 MB per 1,024-token request. That is roughly 70 to 95 times the GPU time of running the model with vLLM. The proofs hide the weights but not the architecture, and the top-level security claims are stated and proved in Lean.

Anthropic calls it a research prototype. Contexts are limited to 1,024 tokens, the proof covers an integer version of the model under greedy decoding, the system assumes a mixture-of-experts model, and side-channel attacks are out of scope. The code, Lean proofs, protocol specification and technical report are released under the Apache 2.0 license.