Anthropic’s FlashProve uses zero-knowledge proofs to verify large AI model outputs

Anthropic released FlashProve on November 2, 2026, an open-source research prototype built on a hash-based zkSNARK that verifies which model produced an output without revealing its weights, activations or routing decisions. Tested on Meta's 4-bit quantized Llama 4 Maverick (400.7 billion parameters) on a single NVIDIA H100 GPU, FlashProve reached about 110 tokens per second, processed 24 requests in roughly 223 seconds, and generated approximately 19 MB proofs per 1,024-token request that a standard CPU verifies in 17 to 21 seconds. Anthropic, which led the work through Roy Rinberg and Alex Allain with contributors from EPFL, MIT and StarkWare, said proving overhead runs at roughly 70 to 95 times standard vLLM inference GPU time, making FlashProve an intermediary research tool rather than production-ready; code is available under the Apache 2.0 license.

Anthropic’s FlashProve uses zero-knowledge proofs to verify large AI model outputs Anthropic / Wikimedia Commons Public domain The open-source research prototype proves which model produced a response without exposing its weights, though the proving overhead remains steep Every time you send a prompt to an AI model, you are trusting that the model on the other end is the one you were promised. Until now, you had essentially no way to check. Anthropic https://cryptobriefing.com/markets/anthropic/ wants to change that. The company released FlashProve , a system built on a hash-based zkSNARK that can verify outputs from large language models without revealing the model’s weights. Unveiled on November 2, 2026, the open-source research prototype targets a problem most users never think about. Nobody can currently confirm whether a response came from the model a developer claims, or from a cheaper one a routing service swapped in to save money. An attacker tampering with the token stream is another possibility. The person typing the prompt would never know. How FlashProve works A zkSNARK, short for zero-knowledge succinct non-interactive argument of knowledge, is a type of cryptographic proof. It lets one party demonstrate that a computation was performed correctly without revealing the private inputs behind it. FlashProve runs in two phases. First, during an offline step, the model provider commits to a specific set of neural network weights. That commitment comes out to approximately 6.5 MB and takes around 39 minutes of processing to generate. Second, for each individual inference, the system produces a succinct proof. That proof confirms the committed model generated exactly the output tokens it claims, in response to a given prompt. The crucial part is what stays hidden. The model’s weights, its activations, and its routing decisions all remain confidential. The system is designed specifically for mixture-of-experts MoE language models. These architectures route each input through a subset of specialized sub-networks, which is why protecting routing decisions matters. AI, tech, and the markets they move—in one daily briefing. Daily. Free. Join 34,000+ readers across crypto, finance, and policy. The benchmarks, and the bill Anthropic tested FlashProve on Meta https://cryptobriefing.com/markets/meta/ ’s 4-bit quantized Llama 4 Maverick, a model with 400.7 billion parameters. Running on a single NVIDIA https://cryptobriefing.com/markets/nvidia/ H100 GPU, FlashProve hit around 110 tokens per second. It processed a batch of 24 requests in roughly 223 seconds. Each 1,024-token request produced a proof of approximately 19 MB. A standard CPU can verify that proof in around 17 to 21 seconds, with no access to the model weights at all. The catch is cost. Proving overhead runs at roughly 70 to 95 times the GPU time needed for standard vLLM inference. In other words, proving that an answer is legitimate currently costs far more compute than producing the answer in the first place. Anthropic labels FlashProve as an intermediary research tool, not something ready for production deployment. Crypto’s toolkit, applied to AI The project was led by Roy Rinberg and Alex Allain of Anthropic. The contributor list reads like a who’s who of applied cryptography: Alessandro Chiesa, Giacomo Fenzi, and Guy Weissenberg from EPFL, with Chiesa also affiliated with StarkWare. Miranda Christ joined from MIT and RESI, Rahul Dalal from Anthropic’s STEM Fellows Program and Succinct, and Ben Mayer from the Anthropic Fellows Program and MIT. FlashProve also takes a different route than trusted-hardware approaches to inference verification. Rather than relying on a secure chip to vouch for the computation, it leans on math. The formal security properties of the proofs have been machine-checked in Lean, a proof assistant. All code and technical materials are available under the Apache 2.0 license on the anthropics/FlashProve GitHub repository. What this means The biggest thing to watch is the overhead. At roughly 70 to 95 times the GPU cost of normal inference, FlashProve is a proof of concept, not a business model. Any path to real-world use runs through shrinking that multiple. Proof size is another variable. Roughly 19 MB per 1,024-token request is manageable for audits and spot checks, but heavy for verifying every single interaction at scale. For now, FlashProve shows that cryptographically verifying a frontier-scale model is possible on a single GPU. Making it cheap enough to matter is the next, considerably harder, chapter. Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy https://cryptobriefing.com/editorial-policy/ . More in AI See all https://cryptobriefing.com/artificial-intelligence/