# Anthropic's FlashProve proves a commitment, not a model's identity

URL: https://www.thedeepfeed.ai/posts/2026-11-09-flashprove-proves-the-commitment-not-the-model/
Category: Research
Published: 2026-11-09
Author: the-deep-feed
Tags: anthropic, cryptography, zero-knowledge, verification, inference
Kind: deep

> Anthropic open-sourced FlashProve, a prototype that cryptographically proves a reply came from committed weights. Its own docs say a 'yes' doesn't tell you whose model it is, and the proof costs roughly 70-95x the GPU time.

## TL;DR

- FlashProve produces a zero-knowledge proof that a reply came from **committed weights**, without revealing them.
- Tested on **Llama 4 Maverick** (400B MoE): about **110 tokens/s** proving on one H100 and about **17 s** to verify on 24 CPU threads.
- Overhead is about **72x** GPU time versus vLLM, rising to about **94x** at the heaviest load tested (Help Net Security).
- Its own docs say **"The provider chooses the model"**: a proof doesn't say whose weights they are.
- Apache 2.0 research prototype; TechCrunch reports **no plans to deploy** it at Anthropic or any other lab.

Headlines say Anthropic built a way to prove which model answered you. That's close, but the gap matters. FlashProve proves that a reply was computed from a specific set of weights the provider committed to earlier. Whether those weights are the model you were promised depends on who vouches for the commitment, and the repo's own documentation says so plainly.

![FlashProve proves a reply came from committed weights, not whose model they are](/post-images/2026-11-09-flashprove-proves-the-commitment-not-the-model/flashprove-commitment-not-identity.jpg)

# What it does

Anthropic's [research post](https://www.anthropic.com/research/provable-inference) frames the problem: when you call a hosted API, you can't tell whether the provider swapped in a cheaper model, or whether the model an evaluator tested is the one being served. FlashProve produces a zkSNARK proof that a response came from the committed weights. A checker can verify the proof on CPUs without seeing the weights. [TechCrunch](https://techcrunch.com/2026/11/03/anthropic-is-working-on-a-system-to-prove-ai-models-identity/) notes this would let a lab publish a "fingerprint" of each model without giving up its weights.

[Help Net Security](https://www.helpnetsecurity.com/2026/11/04/anthropic-flashprove-provable-inference/) reports that the work comes from Anthropic's Frontier Red Team with collaborators at EPFL, MIT and StarkWare. The [release](https://github.com/anthropics/FlashProve) includes a CUDA prover, a fast C++ verifier and a slow reference verifier in Lean, under Apache 2.0.

# The numbers

On Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model, Help Net Security reports:

- about **110 tokens per second** of prefill at a batch of 24 requests, on one H100 with 24 CPU cores;
- an **18.78 MB** proof, each checking one token over a 1,024-token window, checked in about **17 seconds** on 24 threads;
- a one-off commitment taking about 39 minutes per model and covering roughly **16 million requests**;
- about **72x** GPU overhead versus vLLM serving the same model in FP8 on eight H100s, and about **94x** at the heaviest load tested.

# What it doesn't prove

The [known-limits guide](https://github.com/anthropics/FlashProve/blob/main/guide/known-limits.md) is unusually candid. "The provider chooses the model," it says: "A yes does not say whose weights they are... or which real model it is." It advises getting the commitment ID from a party you trust, never from the server. Proofs cover a quantized integer version of the model. In one measurement, its top token differed from the original model's at 6.81% of positions. The C++ verifier and the prover are tested against the protocol, not formally proved. Anthropic calls trusted hardware a complementary approach with different trade-offs, not a competitor.

# Our read

FlashProve turns "trust the provider" into "trust whoever publishes the commitment". That is real progress for regulators and evaluators, which are the use cases Anthropic highlights. It does nothing for an ordinary API user until labs or auditors publish commitments for production models, and nobody has committed to that. At 70x to 95x the compute, it is also a tool for audits and sampling, not something that can run on every request. It fits the recurring theme of [who checks the proof](/posts/2026-10-17-who-checks-the-proof/).

## Sources

- [Anthropic — Progress on provable inference for large language models (Nov 2026)](https://www.anthropic.com/research/provable-inference)
- [GitHub — anthropics/FlashProve](https://github.com/anthropics/FlashProve)
- [GitHub — FlashProve known limits](https://github.com/anthropics/FlashProve/blob/main/guide/known-limits.md)
- [TechCrunch — Anthropic is working on a system to prove AI models' identity (Nov 3, 2026)](https://techcrunch.com/2026/11/03/anthropic-is-working-on-a-system-to-prove-ai-models-identity/)
- [Help Net Security — Anthropic open-sources FlashProve, its provable inference prototype for MoE models (Nov 4, 2026)](https://www.helpnetsecurity.com/2026/11/04/anthropic-flashprove-provable-inference/)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-11-09-flashprove-proves-the-commitment-not-the-model/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt