Announced 2 Nov 2026 · Sources checked
What Anthropic released
Anthropic's Frontier Red Team published a research post on provable inference, and with it a system called FlashProve. The post describes FlashProve as "an open-source performant prototype for provable inference" and frames the release as intermediate progress rather than a finished research agenda. The researchers write that they are sharing it "explicitly with the goal that others look at what we have done, take it, and improve it."
The release is five artifacts, not one paper. There is the blog post that outlines the system and its applications, a technical report with the details, a protocol specification document that Anthropic says was written by Claude, executable code containing a prover and two verifiers (a fast one in C++ and a provably correct one in Lean), and Lean proofs of the top-level mathematical statements with an interactive visualizer to help auditors check them. Everything is released under the Apache 2.0 license.
The GitHub repository, anthropics/FlashProve, describes itself as "a research prototype for zero-knowledge proofs of AI inference" and carries a blunt warning in its own description: "Not maintained." The repository was created on 30 October 2026. That detail matters more than it looks, because it sets the expectation for anyone tempted to treat this as infrastructure they can build a business on today.
The author list is a mix of Anthropic staff and outside academics: Roy Rinberg and Alex Allain of Anthropic; Alessandro Chiesa of EPFL and StarkWare; Miranda Christ of MIT and RESI; Rahul Dalal of the Anthropic STEM Fellows Program and Succinct; Giacomo Fenzi of EPFL; Ben Mayer of the Anthropic Fellows Program and MIT; and Guy Weissenberg of EPFL. Zero-knowledge proof systems are exactly the kind of work where academic cryptographers and lab engineers have to sit in the same room, and the list reflects that.
How provable inference actually works
The problem the post opens with is simple to state. When you talk to a person face to face you have ways of knowing it is them. When you talk to a model, you have almost none. A user querying a model today "cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream." Judging by output quality alone does not settle it.
Provable inference flips that. The provider commits to a specific model, then attaches a short cryptographic certificate to each response showing the response was computed by that committed model. Anthropic's chosen tool is a zkSNARK, a zero-knowledge succinct argument of knowledge, which proves a computation was executed correctly while revealing nothing beyond the correctness of the computation and staying exponentially cheaper to verify than to produce.
In practice that means the model provider is the prover and the user is the verifier. The provider publishes a commitment to the model, generates a proof for the request, and the user checks the proof on ordinary hardware. Crucially the commitment and the inference proofs hide the weights, which is what makes the scheme usable at all for closed commercial models. Anthropic is explicit about the boundary of that guarantee: hiding the architecture of the model "is not a goal of this system."
Anthropic also says it leaned on formal verification to keep the optimization work honest. The post notes that Claude is good at optimization but "often makes decisions that are hard to evaluate, especially in large complex systems," so the team countered with top-level auditable statements written in Lean, the formal verification language, for the claimed security guarantees. That is a small but telling admission about how the work was done: an AI system helped build the thing, and the humans wrote machine-checkable statements to bound what it was allowed to claim.
The numbers Anthropic published
The performance figures are the part that decides whether this is a curiosity or a foundation. Anthropic tested on Llama 4 Maverick, a 400B-parameter mixture-of-experts model, with 4-bit quantized weights and integer arithmetic in prefill. On that configuration, a single H100 GPU generated proofs at around 110 tokens per second, with a proof size of roughly 19 MB per 1,024-token request.
The overhead is stated just as plainly: that is about 70 to 95 times the GPU time that vLLM, a common open-source inference library, takes to process prompts of the same length. Anyone who has priced GPU seconds will read that number and immediately understand the commercial problem. A 70x to 95x multiplier on serving cost is not something a consumer chatbot can absorb per message.
Anthropic's own framing is comparative rather than absolute. It says Claude produced improvements on zkSNARKs for inference and built a system "substantially faster than prior open-source systems," and that prior open-source systems are orders of magnitude slower, a comparison it develops in section six of the post. The interesting claim is not that provable inference is free. It is that the gap between cryptographic verification and plain inference has narrowed from impractical to merely expensive on one class of large model.
There is also a design choice buried in that sentence about integer arithmetic in prefill. Quantized integer math is what makes the arithmetic circuit cheap enough for a proof system to handle, and 4-bit weights are what a lot of real serving already uses. Neither choice is an accident: the prototype was built around the deployment shape that inference providers actually ship.
Who needs this, according to Anthropic
The post lays out several concrete scenarios rather than gesturing at trust in general. One is pricing, or what a regulator might call pacing. Some proposals for regulating and pacing AI development rely on monitoring hardware and how it is used, for example requiring a provider to devote GPUs to inference rather than training. A provider could cheat by serving cheaper models while freeing hardware for training. With proofs, a regulator can request certificates covering the inference requests served in a period, check them without owning the provider's hardware setup, and still learn nothing about proprietary model internals. Anthropic adds the honest caveat that this "does not establish that the hardware is not, e.g., training on the side."
A second scenario is substitution by intermediaries. Clients who reach a model through a third-party routing service want assurance that the tokens came from the model they paid for. A third is evaluators: independent testers need to know the model they are benchmarking before and after release is the model being served, otherwise a benchmark number is a claim about an unverified object.
A fourth is tamper detection. If an attacker modifies the token stream while pretending to be a given model, a user has no way to catch it from the output alone. TechCrunch's write-up of the release puts the same point in simpler terms: the system is meant to stop an impostor from disguising one model as another, "even when the impostor is the lab that built and runs the model," and it names the two failure modes people actually worry about, a company swapping in a cheaper model to cut costs or a more expensive one to inflate results.
TechCrunch also flags the third-party claim problem the researchers raise: a developer might say their software library was scanned for vulnerabilities by a frontier security model, or that a business plan was approved by some model. Proving either claim to a skeptical customer is currently impossible. That is the kind of narrow, checkable use case where a 70x overhead might actually be worth paying, because the alternative is nobody believing you.
What the prototype does not do
It is not deployed. TechCrunch reports plainly that research on the system is ongoing and that there are no plans to deploy it at Anthropic or any other lab. In a market where every research post gets read as a product roadmap, that sentence is the one to keep.
It does not hide architecture. Weight secrecy is preserved, architecture secrecy is not, and Anthropic says so in the summary rather than in a footnote. For a lab whose models are already public about being mixture-of-experts, that is a cheap concession. For a lab treating architecture as a trade secret, it is not.
It does not make verification free for the provider. The 70 to 95 times figure is GPU time for generating proofs, and proof generation is on top of serving the model. The verification side is the cheap half: proofs land around 19 MB per 1,024 tokens and are designed to be checkable on a local device, which is the whole reason the design is asymmetric.
And it does not yet establish a governance regime. Anthropic is careful to describe the system as something that "could contribute to a toolkit for verifying compliance with AI pacing requirements," and to say the certificates show what was served rather than what the hardware was doing when it was not serving. Turning a prototype into an audit standard would need labs to publish commitments, auditors to accept them, and someone to define what a valid commitment looks like. None of that exists yet.
Why this lands now
The timing is not subtle. Model substitution is a live commercial temptation: routing layers, resellers and API aggregators all sit between users and weights, and every one of them has an incentive to serve something cheaper than advertised. Meanwhile the policy conversation has moved toward hardware-level monitoring and pacing proposals, which only work if someone can verify what a GPU was actually doing.
Anthropic has been unusually willing to publish governance-adjacent research this quarter. It has also been unusually exposed to the argument that safety claims need external verification, having spent the year arguing about evaluation standards while preparing to sell compute at scale. This week's earlier news that the company's draft IPO filing shows $16.3 billion in revenue alongside an $80.7 billion loss is a reminder that a lab publishing cryptographic audit tooling is also a lab with a very large incentive to be trusted by institutional buyers.
There is a second-order story here too. Anthropic says the protocol specification document was written by Claude, and that the human team compensated with Lean proofs of the top-level claims. That is a template for how AI-assisted cryptography will get reviewed: let the model do the optimization and the spec writing, then demand machine-checkable statements about the security properties, because a model's prose about its own correctness is worth nothing.
Whether other labs adopt anything like this is the open question. A verification standard with one participant is a press release. The code is Apache 2.0 and the repository says not maintained, which is an invitation rather than a commitment, and the interesting signal in the next few months will be whether any inference provider or auditor picks the format up.
Common questions
What is provable inference in one sentence?
Provable inference is a way for a model provider to attach a cryptographic proof to a response showing that the response was generated by a specific committed model, so a user can check which model actually answered without seeing its weights.
Is FlashProve available to use in production?
No. Anthropic describes it as intermediate research with no deployment planned at Anthropic or any other lab, and the GitHub repository description states that it is not maintained.
How much does proving a response cost?
Anthropic reports that a single H100 generated proofs at around 110 tokens per second for a 400B-parameter Llama 4 Maverick in 4-bit quantization, roughly 70 to 95 times the GPU time vLLM needs to serve the same prompt, with about 19 MB of proof per 1,024-token request.
Sources & further reading
How this story was made
Written by Kristian Kostov with AI assistance and checked against the linked sources. Company performance claims are attributed to the company. Analysis reflects AiLookout’s interpretation; we have not independently tested the products discussed. The cover is an AI-generated editorial illustration, not a photograph or evidence of an actual event.
Our editorial standards
