Anthropic releases FlashProve, a zkSNARK prototype for provable LLM inference
On 2 Nov 2026 Anthropic’s Frontier Red Team published FlashProve, an open-source prototype for provable inference: a provider commits to model weights and attaches a zkSNARK so users can check that a reply came from that committed model without learning the weights. On Llama 4 Maverick (≈400B MoE, 4-bit), Anthropic reports about 110 tokens/sec proving on one H100 and ≈19 MB proofs per 1,024-token request, about 70–95× the GPU time of vLLM on the same GPU. Code and Lean artifacts are Apache 2.0; Anthropic calls this intermediate research with stated limits.
Verified against Anthropic’s research post Progress on provable inference for large language models (Published Nov 2, 2026, Frontier Red Team): Anthropic describes progress on provable inference and releases an open-source prototype called FlashProve.
Anthropic states that users today cannot readily check that API tokens came from the claimed model weights, rather than a cheaper substitute or a tampered stream. Provable inference aims to let a user with limited compute and no weight access verify that a response was produced by a specified model. FlashProve uses a zkSNARK (zero-knowledge succinct argument): proofs are short and relatively cheap to check, and by design reveal nothing about the weights to the verifier; Anthropic notes that model architecture is not hidden.
There are two phases. Offline, the provider publishes a commitment (a short fingerprint) to the weights. Online, given a prompt and output tokens, the provider produces a proof claiming that the committed model yields those outputs on that input. Honest proofs should verify; forging a proof of a false claim should be infeasible under standard cryptographic assumptions.
Reported measurements use the public 4-bit conversion of Llama 4 Maverick (≈400B-parameter mixture-of-experts; Anthropic says ~17B parameters are used per token). Each verifier request is a 1,024-token window. The prover uses one H100 plus 24 CPU cores. Anthropic reports ~39 minutes for the offline commitment (good for about 16 million requests before recommitment, for technical reasons they discuss), 223 seconds online for a batch of 24 requests (110 tokens/sec), and ~18.78 MB per proof. The verifier needs no GPU: the commitment is ~6.5 MB total, and checking one proof takes ~17 seconds on 24 threads (~21 seconds single-threaded). Versus vLLM FP8 inference of the same model on eight H100s, Anthropic says proving a batch of 24 requests takes about 72× as long per GPU as vLLM (about 66–77 across runs), and about 94× at the highest load they tried—summarized in the post as roughly 70–95×.
The release includes the blog post, a technical report, a protocol description, executable prover/verifier code (including a fast C++ verifier and a Lean verifier), and Lean proofs of top-level security claims with an interactive visualizer. Code, Lean proofs, and docs are under Apache 2.0. Anthropic frames this as intermediate research, not a finished agenda, and lists limits such as: no formal guarantee that the fast executable matches Lean/paper; proofs cover an integer model under greedy decoding (floating-point or sampled decoding may diverge); efficiency assumes an MoE layout; side channels are out of scope; context length is currently up to about 1,024 tokens.
Performance figures, scope, and caveats are Anthropic’s; they are not independent IdeaDawn retests.