Anthropic releases FlashProve prototype for inference proofs

Anthropic says FlashProve lets a provider commit to a model and prove that each response came from that model.[2] The provider publishes a commitment that pins down one exact set of weights while keeping those weights hidden.[2] A verifier can use that commitment, the prompt and the reply to check a proof without seeing the model weights.[2] Anthropic identifies customer integrity checks, independent evaluations, regulatory tools and approved-model enforcement as potential uses.[1] It says the approach could help prevent a provider from secretly substituting a cheaper model or using a different model to inflate evaluation results.[3]

FlashProve uses a software-only zkSNARK approach rather than relying on trusted hardware.[2] Anthropic says the proof is designed to reveal nothing about model weights or intermediate computation values.[1] It is also designed to conceal which mixture-of-experts subnetworks ran for each token, but does not conceal the model architecture.[1] Anthropic evaluated FlashProve on Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model.[2] The proof is not a general record of every possible way to run that model: it covers an exact integer version of the weights under greedy decoding.[1]

Anthropic released the code, Lean proofs and documentation under the Apache 2.0 license.[2] The code is publicly available on GitHub under an open-source license.[3] The performance documentation puts the model commitment step at about 39 minutes.[4] The documented prover setup uses one 80 GB GPU and about 290 GB of host memory.[1] Anthropic says a user with far less hardware than the provider can check proof files without elaborate infrastructure.[2] Anthropic says it has no plans to deploy FlashProve at its own lab or another lab.[3]

The repository labels version 0.16.0 an unmaintained research artifact that is not accepting contributions, despite Anthropic’s invitation for others to examine and improve the work.[5][3] The project has not undergone an independent security audit, and testing of weight hiding and adversarial proofs remains limited.[1] Anthropic says floating-point inference or sampled decoding can depart from the computation covered by the proof.[1] The documented context limit is 1,024 tokens, and the guarantees do not cover timing or other side-channel attacks.[1] Anthropic also cautions that proof certificates do not show that the same hardware is not training another model.[1]