Anthropic's FlashProve proves which committed weights wrote a reply

If you buy model access through a router or reseller, or you audit models for a living, you can now try Anthropic's answer to "which model actually replied?" FlashProve is open source, and its README hands you a prompt to give your own coding agent, which builds the verifier and checks a stored proof on an ordinary Linux CPU.

What changed#

On Nov 2, Anthropic's Frontier Red Team published FlashProve, a prototype that lets a provider commit to a model's weights and then attach a cryptographic proof (a zkSNARK) to each reply. Anyone holding the commitment, the prompt and the reply can check it without the weights. Anthropic says "Claude has produced improvements on zkSNARKs for inference, building a system that is substantially faster than prior open-source systems."

The numbers are Anthropic's own, on Meta's Llama 4 Maverick (400B parameters, a public 4-bit conversion): one H100 proves at about 110 tokens per second in batches of 24, each proof is about 19 MB, and a CPU checks one in 17 seconds on 24 threads. In those timed runs each request is a 1,024-token window, and each proof checks one token. The post puts proving at about 70 to 95 times the GPU time of running the model on vLLM. Code, Lean proofs and docs ship under Apache 2.0, and the README calls it "A research artifact: not maintained, not accepting contributions."

Why it matters#

Anthropic's post says a user today can't check which model produced a response, and names the cases: a routing service secretly swapping in a cheaper model, an attacker tampering with the token stream, and evaluators who need to know the model they test is the one being served. Our read: the verifier is something agent builders and auditors can run today, so it's worth knowing what a pass does and doesn't mean before anyone sells you on "verified" replies. Anthropic doesn't say it attaches these proofs to Claude. For its own traffic, the post says Anthropic met its goal of a verification prototype through "a separate but related project, which signs our inference traffic and recomputes inference on a trusted server".

How to use it (verifier only, no GPU)#

The README says the verify-only route needs Linux, bash and g++ 13 or later and under 2 GB of RAM, with a build of 1 to 2 minutes and a check under 2 seconds. These steps follow the README; we haven't run them.

1. Clone the repo on Linux and work as an ordinary user, not root.
2. Run verifier/build.sh and wait for a line starting THE VERIFIER IS BUILT:.
3. Run the README's bin/cp_verify command on examples/accepted-proof. The README says to expect YES and exit code 0, and adds: "This example is a small model with synthetic weights, so it shows only that the verifier works, not anything about a served model."
4. Read the eight checks under "When to accept" in Verify a proof before trusting a real proof.

Or hand the job to your coding agent with the README's own prompt, shown in the prompt box (verbatim from the README).

Gotchas#

• A pass doesn't name the model. The known-limits guide says the provider chooses what it commits to, even a small or degenerate model: "A yes does not say whose weights they are, that the shipped committer made the commitment, or which real model it is." Get the commitment ID from a party you trust, never from the server you check, per Verify a proof.
• Exit code 0 isn't enough. YES means exact match; WITHIN LIMITS is a looser policy, and the guide warns "Both kinds of accept exit with code 0, so read the last line." Its advice: "The project recommends no limits: if you cannot assess them, accept only exact match."
• A cut-off reply still passes. "Only the named output positions are covered, and a reply stopped short verifies as a shorter one." Compare the covered: line with your range.
• Commitments run out. Per the post, a commitment is good for about 16 million requests, and then the provider has to commit again.
• Integer model, greedy decoding, 1,024 tokens. Per the post, a reply from sampled decoding or a floating-point setup could stop matching the proved computation, and contexts are capped at 1,024 tokens.
• The fast verifier isn't proved. The post says: "Nevertheless, the C++ verifier is the one to use day to day: it carries no formal guarantee, and it agrees with the Lean verifier on every proof in our tests." The known-limits guide adds: "There has been no independent security audit."

What to watch#

Anthropic says: "In future work we plan to also hide architecture details." It describes the post as sharing intermediate progress, not a finished agenda. Our read: the signal is a follow-up Anthropic report, or any provider publishing a commitment ID for a model it serves. We found neither as of this check.

Last checked: Nov 3, 2026, 6:07 to 6:12 AM ET. What changed: first published Nov 3.

Sources#

• Anthropic: Progress on provable inference for large language models (Nov 2, 2026)
• GitHub: anthropics/FlashProve (README)
• FlashProve: Known limits (repo guide)
• FlashProve: Verify a proof (repo guide)
• FlashProve technical report (PDF)
• i10X: Anthropic's FlashProve Proves Which Model Wrote an Answer, at 400B Scale
• Neural Brew: Anthropic Releases FlashProve