How fast is FlashProve?

On Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model in 4-bit weights, a single H100 GPU generates proofs at around 110 tokens per second, with a proof of about 19 MB per 1,024-token request. That is roughly 70 to 95 times the GPU time vLLM needs to run the model itself. Anthropic says prior open-source systems were orders of magnitude slower.

Why does provable inference matter?

Today a user cannot check that a response came from the model a developer or router claims: a routing service could swap in a cheaper model, or an attacker could tamper with the token stream. Proofs let customers of third-party routers verify they got the model they paid for, let independent evaluators confirm the model they test is the one being served, and could help providers demonstrate compliance with commitments or regulation.

Can I use FlashProve in production?

Not as a drop-in service. Anthropic calls it a research prototype sharing intermediate progress. It assumes a mixture-of-experts architecture, the fast C++ verifier has no formal guarantees (the Lean verifier does, but is slow), and proofs add about two orders of magnitude of GPU cost. No provider has announced proofs on its API.

Quick Answer

What Is Anthropic FlashProve? Provable Inference Explained

Q: What is Anthropic FlashProve?

FlashProve is an open-source research prototype for provable inference, released by Anthropic on November 3, 2026 under the Apache 2.0 licence. A model provider commits to a model's weights and then attaches a cryptographic proof (a zkSNARK) to each response, which a user can verify to confirm the response came from that committed model, without learning the weights.

Published: November 6, 2026

The short answer

FlashProve lets you check, cryptographically, that a response came from a specific AI model. Anthropic released it on November 3, 2026 as an open-source prototype (Apache 2.0): the provider commits to a model, then sends a short proof with each response; anyone can verify the proof on modest hardware without seeing the weights. It is a research release, not a feature of the Claude API.

How it works

Commit. The provider publishes a cryptographic commitment to the model’s weights. The commitment hides the weights; it does not try to hide the architecture.
Prove. For each request, the provider generates a zkSNARK (zero-knowledge succinct argument of knowledge) showing that the response is what the committed model produces for that prompt.
Verify. The user checks the proof. If the response came from any other model, or the token stream was altered, verification fails.

Anthropic ships five artifacts: a blog post, a technical report, a protocol specification written by Claude, executable code (a prover, a fast C++ verifier and a provably correct verifier in Lean) and Lean proofs of the top-level security statements with an interactive visualiser. Anthropic says Claude produced the performance improvements, and the Lean statements exist so humans can audit claims that are hard to check in a large codebase.

Key numbers

	FlashProve (Anthropic measurements)
Test model	Llama 4 Maverick, 400B MoE, 4-bit weights
Proof throughput	~110 tokens/second on one H100
Proof size	~19 MB per 1,024-token request
Overhead	~70–95× the GPU time of serving with vLLM
Licence	Apache 2.0 (code, Lean proofs, docs)
Repository	github.com/anthropics/FlashProve

Who would use it

Customers of model routers and resellers, who today cannot prove they received the model they paid for rather than a cheaper substitute.
Independent evaluators, who need to know the model they test before and after release is the one actually served.
Security teams, to detect a tampered token stream that imitates a trusted model.
Regulators and auditors, as one tool for checking providers’ commitments on which models they deploy.

Limitations

Research prototype: no service, SLA or API integration.
Mixture-of-experts only: the system uses MoE structure for its efficiency gains; dense models are not the target.
Cost: 70–95× extra GPU time is acceptable for audits or sampled spot checks, not for proving every token of a consumer chat.
Assurance gap: formal guarantees cover the Lean implementation; the fast C++ code is derived from the same design but is not itself proved.

How it relates to other trust tools

Provable inference answers which model produced this. It does not say whether the content is true or safe, and it differs from content provenance labels on generated media. For the wider question of how AI answers earn trust, see our note on how to evaluate a new AI model.

Last verified: November 6, 2026.