FlashProve proofs cost ~70-95x the GPU time of inference

Anthropic on November 3 open-sourced FlashProve, a prototype in which a model provider commits to a set of weights and attaches a cryptographic proof to each response showing that the committed model produced it. A client can then check which model answered without seeing the weights or running the model. The speed figure was measured under narrow conditions: one H100 generates proofs at about 110 tokens/second for Llama 4 Maverick in 4-bit weights, and that still takes roughly 70-95x the GPU time of running the model on vLLM. Anthropic calls the work intermediate progress.

The proofs are zkSNARKs, a kind of proof that is short, quick to check and reveals nothing beyond the claim it certifies. In Anthropic’s write-up, the goal is twofold: speed up work on provable inference, and show that this kind of proof is practical for it. The code is on GitHub under Apache 2.0. It includes a prover, a fast verifier in C++ and a provably correct verifier in Lean, a formal verification language. Alongside the code are a technical report, a protocol specification written by Claude, and Lean proofs of the top-level security statements, with an interactive visualizer to help auditors.

What the 70-95x covers

The benchmark model is Llama 4 Maverick, a 400B-parameter mixture of experts, with weights quantized to 4 bits and integer arithmetic used in prefill. Under those conditions a single H100 proves at around 110 tokens/second, so proving a 1,024-token request takes roughly nine seconds of H100 time. Each such request carries a proof of about 19 MB. The 70-95x multiple compares that proving time with the GPU time vLLM needs to process prompts of the same length.

Those quantization and integer conditions are where the difficulty lies. Proof systems work over finite fields. The authors of OpenLLM, a paper from Zhejiang University, Ant Group and others posted to the IACR ePrint archive, say LLM inference is hard to prove for two reasons: it involves a large number of non-linear operations, and its real-valued computation has to be modelled in those fields. That adds compute and memory overhead and can cost numerical precision. Anthropic says prior open-source systems are orders of magnitude slower than FlashProve, and it compares them in section 6 of its report.

The commitment and the proofs keep the weights hidden. Hiding the model’s architecture is not one of the system’s goals.

Where Claude came in

Anthropic credits Claude with the improvements over earlier zkSNARK systems for inference. It says Claude found new ways to apply state-of-the-art tools from the cryptography and security literature while keeping to well-established design principles for proof systems. Anthropic also adds its own caveat: “Claude is good at optimization, but often makes decisions that are hard to evaluate, especially in large complex systems.” To address that, the team wrote the claimed security guarantees as top-level statements in Lean that auditors can check.

Who would check the proofs

Independent evaluators are the first case Anthropic names. When they test a model before and after release, they need to know that the model they evaluate is the one being served. Clients who reach a model through a third-party routing service want assurance that the tokens came from the model they paid for. And an attacker who tampers with the token stream while posing as a given model would have to produce valid proofs for the committed weights to avoid detection.

Anthropic also points to rules that would pace AI development by monitoring hardware. A regulator could ask a provider for proofs covering the requests it served over a given period, and the provider could not produce them unless its hardware was genuinely serving the claimed model. Anthropic states the limit too: such proofs show that the hardware served inference, but they do not establish that it was not also training on the side.

Anthropic met its own public commitment in this area by another route. Its Frontier Safety Roadmap promised a provable-inference prototype by September 30, 2026. The company says a separate but related project met that goal: it signs Anthropic’s inference traffic and recomputes inference on a trusted server. FlashProve pursues the same objective by a different method.