Anthropic FlashProve: Cryptographic Proof Which AI Model Answers, Here's How It Works

FlashProve is an open source system from Anthropic that creates cryptographic proof (zkSNARK) that an AI answer was actually generated by a particular model, without revealing the weight of that model. This is important because so far we can only trust that the API we pay for actually uses the promised model.

The release announced by Anthropic through the research article "Progress on provable inference for large language models" was immediately discussed by the technology media, crypto community and AI developers from November 2–3 2026. The reason is simple: for the first time, this kind of proof can be created for a model with 400 billion parameters with one GPU, in a reasonable amount of time.

This article explains what it actually proves, how it works, the numbers, the limitations, and what it means for developers in Indonesia who use AI modeling APIs every day.

What problem does FlashProve want to solve?

When you call an AI model API, either directly to the provider or via a router/reseller, you send a prompt and receive a text. There is no technical way to ensure that text comes out of the model you choose. Some scenarios of concern:

• Silent model substitution. Intermediary services charge large model prices, but secretly serve cheaper models or coarser quantized versions.
• A compromised inference server. The attacker changes the answer token midway.
• Regulatory compliance. Regulators want to ensure that only approved models are used for certain services.
• Independent evaluation. Third-party benchmark results can be proven to actually come from the claimed model.

This issue feels increasingly relevant after a series of supply chain cases in the AI ​​tool ecosystem, such as plugins that were secretly installed into Claude Code and Codex. Blind trust in intermediaries turns out to be expensive.

How does FlashProve work?

FlashProve uses zkSNARK ( zero-knowledge succinct non-interactive argument of knowledge). In short: one party can prove that a computation was executed correctly, the proof is concise and quickly checked, and the examiner does not know the secret data used (here: model weights).

The flow consists of three steps:

1. Commitment (offline). The provider creates a cryptographic “fingerprint” from a set of exact weights. The process takes about 39 minutes, the result is about 6.5 MB, and according to CellCog and AI Polix's summary it lasts for approximately 16 million requests before it has to be updated.
2. Proof per request. For each pair of prompt and answer, the prover recomputes the inference and then creates a proof that the committed model, given that prompt, produces that answer token.
3. Verification. Whoever holds the commit, prompt, and answer can check the proof on a regular CPU. There are only two results: valid or rejected.

For the mixture-of-experts (MoE) model, the expert's choice on each token is also hidden. What is not hidden is the model architecture, for example the number of layers and the shape of the MoE.

A simple analogy with a hash

A commit is similar to publishing the hash of a file: other people don't know the contents of the file, but if the contents are changed, the hash changes. The example below is just an analogy to understand the concept of commitment, not how FlashProve works (FlashProve uses a much more complicated commitment scheme and proof system):

import hashlib, secrets

# "Bobot" rahasia milik penyedia (di dunia nyata: ratusan GB)
bobot = b"layer0:0.12,-0.98,...;layer1:..."
garam = secrets.token_bytes(32)          # agar bobot tidak bisa ditebak

komitmen = hashlib.sha256(garam + bobot).hexdigest()
print("Komitmen publik:", komitmen)

# Jika penyedia diam-diam mengganti bobot, komitmennya tidak cocok lagi
bobot_murah = b"layer0:0.10,-0.95,...;layer1:..."
print(hashlib.sha256(garam + bobot_murah).hexdigest() == komitmen)  # False

The difference is, a regular hash only binds the contents of the file. zkSNARK in FlashProve proves an even stronger point: that computing inference over bound weights produces a particular answer, without revealing the weights.

What are the numbers?

Anthropic tested FlashProve on Meta's Llama 4 Maverick, a MoE model of about 400 billion parameters (about 17 billion actives per token), using the 4-bit public version.

Sources differ slightly on rounding: AI Weekly writes "over 100 tokens/second" and overhead 72–94×, Interesting Engineering writes about 70–95×. The figures in the table follow the details Unite.AI and CellCog referenced in the Anthropic report.

Why is this considered a leap?

Zero-knowledge proofs for language models have been researched for several years, but very slowly. According to a comparison cited by Anthropic, the VerInf system took about 14.3 hours for 1,000 tokens on the same model with a 93.6 GB token.

Please note, models and hardware vary, so the graph above is not an apples-to-apples comparison. The closest competitor, Attestable, achieved 53–77 tokens/second on the dense 31B model, but its code was not released.

Myth vs fact

What are the limitations?

Anthropic is quite open about limits in its known limits repository document. Most important points:

• The proof includes an integer version of the weights with greedy decoding. Floating-point or sampling inference (temperature > 0) can differ from proven computing.
• The maximum context is 1,024 tokens, well below the context window of the current frontier model.
• Lean is used to formally prove the properties of completeness, soundness, and zero-knowledge (in the random oracle model). However, the fast C++ verifier is only tested for compatibility with the Lean verifier, not formally verified.
• Side-channel attacks, for example from the time of proof generation, are out of scope.
• The repository has research artifact status: it is not maintained and does not accept contributions.
• According to the project documentation, almost all of the software, Lean proofs and documentation were written by AI systems under human direction.

There are also differences between sources regarding teams. AI Polix mentioned collaborations with EPFL, MIT, StarkWare, and Succinct (including Alessandro Chiesa), while Unite.AI wrote that only Anthropic was mentioned as an organization. The release date is also reported as November 2 (Unite.AI, CellCog, AI Polix) or November 3, 2026 (AI Weekly).

What does this mean for Indonesian developers?

In the short term, there's nothing you need to change in the production code. But the direction of the industry is clear: “which model answers” ​​can be something that is proven, not simply claimed. Some practical implications:

• When choosing a reseller/router API model, ask how they guarantee the models they serve. In the future, evidence of inference may become a requirement in procurement contracts.
• For regulated sectors (finance, health, government), the concept of “only approved models” now has a technical path to audit.
• For open-weight models like the Mistral Large 4 or Kimi K3.1 Pro, a weight commitment can help prove that the hosting provider has not lowered the quantization quality on the sly.
• For researchers, the code and specifications are Apache 2.0 licensed, so they can be studied and developed.

If you want to try the verifier, the documentation compiled by CellCog says the requirements are quite light: Linux, g++ 13, and RAM under 2 GB. Check your environment first:

# Cek versi kompiler (butuh g++ 13 menurut dokumentasi)
g++ --version | head -n1

# Cek jumlah core CPU (verifikasi ±17 detik dicapai dengan 24 thread)
nproc

# Cek RAM yang tersedia
free -h

Follow the build instructions in the official README repository anthropics/FlashProve, as the exact commands may change.

While waiting for this technology to mature, basic practices remain in place: note the model and version used on each call, keep request logs, and monitor your API usage. If you manage many APIs in one place, the dashboard at console.apipedia.id can help monitor quotas and usage logs.

FAQs

Is FlashProve already used in Claude's API?

There is no such information yet. Anthropic calls it a research prototype and an "intermediate advance," and its testing used the Llama 4 Maverick, not the Claude model.

How is zkSNARK different from ordinary digital signatures?

Digital signatures only prove who sent the message. zkSNARK proves that a computation (here model inference) was executed correctly on committed secret data, without exposing that data.

Why only greedy decoding?

The proof must match deterministic computing. Random sampling and floating-point arithmetic mean that results can differ between runs, so the current version proves the integer model with greedy decoding.

What are the additional costs of using FlashProve?

According to Anthropic's report, creating a proof takes about 72 times the GPU time compared to serving the same request with vLLM, and up to about 94 times at the highest load tested.

Does this evidence guarantee that the AI ​​is not hallucinating?

No. FlashProve only guarantees the answer comes from the committed model weights. Whether the content of the answer is right or wrong is still a matter for the model itself.

Source

• Unite.AI: Anthropic Releases FlashProve for Cryptographic AI Inference Proofs
• AI Polix: Anthropic releases FlashProve, open-source zkSNARK provable inference
• CellCog: Anthropic FlashProve, Proving Which Model Answered
• Interesting Engineering: Anthropic unveils cryptographic tool to verify model outputs
• AI Weekly: Anthropic opens FlashProve to prove replies match model weights
• Anthropic: Progress on provable inference for large language models
• GitHub: anthropics/FlashProve