Anthropic releases an open tool that proves which AI model wrote a reply, at 70–95× the compute
Anthropic says Claude made it far faster than earlier open tools. It is tested on one open model, with replies up to 1,024 tokens.
Today a user cannot check which model produced a reply: a routing service could swap in a cheaper one, or an attacker could alter it. On 2 November 2026, Anthropic’s Frontier Red Team and co-authors at EPFL and MIT released FlashProve, an open-source prototype (Apache 2.0 licence) that attaches a cryptographic proof to each reply. The proof is a zkSNARK, a short certificate that a computation was done correctly, and it reveals nothing about the model’s private weights.
Anthropic tested it on Llama 4 Maverick, an open model from Meta with 400 billion parameters, in a third party’s 4-bit version. One H100 GPU proved 110 tokens a second. Each proof for a 1,024-token request is about 19 MB and takes a 24-core CPU 17 seconds to check. Proving took about 72 times longer than the vLLM serving software took to answer the same requests, and about 94 times longer under heavy load.
Anthropic compares this with VerInf, the only earlier proof of the same model it knows of: 14.3 hours for 1,000 tokens on a DGX Spark, a 93.6 GB proof, almost a day to verify. Attestable, a commercial system, reports 53–77 tokens a second on a smaller 31B model with no open-source code.
The post says Claude produced the improvements that make FlashProve faster, found new ways to apply existing cryptography tools and wrote the protocol specification. Anthropic adds that Claude’s choices are hard to evaluate, so the security claims (completeness, soundness and zero knowledge) are stated as top-level theorems in Lean, a language for machine-checked proofs.
What it means
If the figures hold, proving which open model answered is now practical for audits, at a compute cost the earlier open system could not approach. It is too expensive for everyday chat, and nothing here lets a user verify Anthropic’s own models yet.
Caveats
- This is Anthropic’s own account of its own system. No independent group has benchmarked FlashProve, and the post does not give the human authors’ share of the work.
- Lean covers only the top-level statements about the protocol. The fast C++ verifier people would use has no formal guarantee, the prover is not verified, and the Lean, paper and code are not guaranteed to match. People must still audit that the statements say what is intended.
- The proof covers an integer version of the model under greedy decoding (always taking the likeliest token). A reply from a floating-point server or with sampled decoding could depart from it.
- Contexts stop at 1,024 tokens, far below the hundreds of thousands that chat models use. Only a mixture-of-experts model was tested, and the model’s architecture is not hidden.
- Anthropic’s Frontier Safety Roadmap set a goal of a provable-inference prototype by 30 September 2026. The post says that goal was met through a separate project, not FlashProve.