FlashProve Proves Which Model Answered, at 70-95x the GPU Cost

TL;DR

Anthropic released FlashProve, an open-source research prototype that attaches a zkSNARK proof to an LLM response, so anyone can verify the reply came from a specific committed set of weights without seeing those weights. Generating the proof costs 70 to 95 times the GPU time of plain inference: 72x at matched batch size, 94x at the highest vLLM load tested. It runs on 1,024-token contexts, integer models under greedy decoding, and exposes Mixture-of-Experts routing rather than hiding it. The code is on GitHub under Apache 2.0 with prover, C++ verifier and Lean 4 soundness proofs, marked unmaintained and closed to contributions. This is real cryptography against a real threat, priced far above what most deployments would pay for it.

FlashProve is the first thing Anthropic has shipped that you can actually check against the provable-inference commitment it made in April. The repo carries a prover, a C++ verifier, Lean 4 formal soundness proofs for the protocol, and example proofs. It is Apache 2.0, and labelled a research prototype that is not maintained and not accepting contributions.

What it does is narrow and genuinely useful. A provider commits to a set of weights, serves a response, and ships a proof alongside it. A verifier checks that proof against the commitment and learns one fact: this output came from those weights. The weights stay private, which is the whole trick, since a closed-weights lab has no other way to offer a check an outsider can run. The authors are Roy Rinberg, Alex Allain, Alessandro Chiesa, Miranda Christ, Rahul Dalal, Giacomo Fenzi, Ben Mayer and Guy Weissenberg.

Phase 1 of a safety commitment, confirmed after the deadline

The research post is the public face of something Anthropic owed. Provable inference was a Frontier Safety Roadmap commitment set on 2 April 2026, with Phase 1 originally due 15 May. It slipped to 30 September, per Forkast’s reporting, with Anthropic citing a need to put resources into a broader internal initiative. That reporting also logs a further timeline correction in July, which I have not seen confirmed against Anthropic’s own changelog.

The 30 September deadline passed with no blog post, press release, or social update. Confirmation came 15 days ago, in a roadmap page update describing Phase 1 as “broadly achieved” and renaming the goal to “inference verification.” The dedicated research post followed about two weeks after that.

The roadmap also reports something more immediately useful than the zkSNARK. Anthropic says it “rolled out signing on all of our internal token traffic, which has already caught one extremely rare, benign integrity glitch.” One glitch caught by cheap signatures, zero caught by expensive proofs, because the expensive proofs do not run in production.

The price: 70 to 95 times the GPU cost of answering

Proving a response costs 70 to 95 times the GPU time of producing it, per Anthropic’s own reported numbers: 72x at matched batch size, rising to 94x under the heaviest vLLM load tested. That is the figure every other claim about FlashProve has to survive. A provider weighing it is choosing between answering one query with a proof and answering roughly 90 without.

Anthropic puts the number in the post rather than burying it, and the technical report lists proof generation overhead as one of six limitations in Section 7. The others are model size constraints, determinism requirements, precision and floating-point handling, verification costs, and applicability scope. Read in order, they stack into a tight operating envelope.

Proofs run on 1,024-token contexts. The models are integer models under greedy decoding; production LLMs run floating-point sampling. For Mixture-of-Experts models, the routing structure gets exposed instead of hidden, traded away for prover efficiency. Each constraint is reasonable in a research prototype, and each one sits between the prototype and a deployed system. The same shape showed up in Anthropic’s formal verification work on 123 OSS-Fuzz libraries: publish the artifact, state the scope honestly, do not promise a product.

Hollow weights, and the cheaper check the same team proposed

Two pieces of outside context cut against reading “cryptographically proven” as settled.

In August, Chen Gong, Beijie Liu and Mengyuan Li posted the Hollow-LLM Attack preprint, which argues that zero-knowledge verification of LLM inference can be undermined by constructing weights that are computationally trivial to prove. If that holds, the guarantee is narrower than it sounds: the proof attests that some committed weights produced the output, and the question of whether those weights are the real model moves into the commitment step. I could not confirm the preprint names FlashProve or Anthropic, so read it as a general critique of this class of scheme; whether it lands on FlashProve is unconfirmed.

The second complication is Anthropic’s own earlier work. Around November 2025, Rinberg and Anthropic-affiliated co-authors published Verifying LLM Inference to Detect Model Weight Exfiltration, proposing statistical, non-cryptographic verification for much the same family of threats. That approach costs a rounding error next to 94x. For detecting weight exfiltration or auditing a deployed model, a statistical check that catches most cheating at negligible cost beats a cryptographic one nobody runs.

Where FlashProve earns its price is the adversarial single-shot case: a regulator, an evaluation lab, or a counterparty who needs one specific response to hold up against a hostile reading. Spot-checking a handful of 1,024-token completions at 94x is affordable. Applying it to a whole production token stream is not, and Anthropic does not claim otherwise.

So the useful thing to track from here is the overhead figure, and whether the next version moves it. FlashProve is concrete enough to measure one against, which is more than this research line had a week ago.

Sources: Progress on provable inference for large language models • FlashProve technical report • anthropics/FlashProve • Frontier Safety Roadmap

Coverage: Anthropic’s Provable-Inference Deadline Arrived Today • Hollow-LLM Attack • Verifying LLM Inference to Detect Model Weight Exfiltration