# FlashProve Proves Model Identity at 72x Overhead [2026]

> Source: <https://shattered.io/anthropic-flashprove-provable-inference-72x-overhead-2026/>
> Published: 2026-11-04 19:31:04+00:00

Anthropic released FlashProve on November 2, 2026, a research prototype that produces a cryptographic proof that one specific language model generated one specific reply. The company’s research post, [“Progress on provable inference for large language models,”](https://www.anthropic.com/research/provable-inference) carries a November 2 date and shows an update on November 3. It is the clearest public step yet toward provable inference, the idea that you should be able to check which model answered you instead of taking a provider’s word for it.

The prototype targets large Mixture-of-Experts (MoE) language models and relies on a zkSNARK, a zero-knowledge succinct argument of knowledge. Anthropic built it with researchers at EPFL, MIT, and StarkWare. The team tested it on Llama 4 Maverick, a 400-billion-parameter MoE model, and measured it against vLLM running the same model in FP8 on eight H100 GPUs. The overhead came out at about 72 times per GPU across runs and about 94 times at the heaviest tested load.

That price tag explains why nobody plans to ship this tomorrow. It also explains why the release still matters. Buyers who compare hosted-inference vendors, as we did in our [OpenRouter pricing breakdown against Together and Fireworks](https://shattered.io/openrouter-pricing-vs-together-ai-vs-fireworks-ai-5-5-percent-fee-2026/), usually weigh price and latency. Neither number tells you which model produced the text. FlashProve is the first open attempt at a practical answer for a model of this size.

Don't miss new tech stories on Google

Add Shattered once in the Google app and our stories show up in your news suggestions.

[Add now](https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F)

## What Anthropic Announced on November 2

The announcement is short on promises and long on artifacts. Anthropic published a research post, and the team released the prover, two verifiers, the formal proofs, and a protocol specification under the Apache 2.0 license. Anyone can read the code, run it, and attack it. That is a deliberate choice for a security primitive, because a proof system nobody can audit is just another claim to trust.

The framing is also modest. The researchers describe the work as intermediate progress, not a finished program, and TechCrunch reported that there are no plans to deploy FlashProve at Anthropic or at another lab. So this is not a product launch. No pricing, no commercial availability, and no customer deployment has been announced, and any article claiming otherwise is running ahead of the source material.

What Anthropic did ship is a concrete answer to a question the industry has mostly handled with contracts and reputation. When you call a hosted model, you receive text. You do not receive evidence. The provider could route your request to a cheaper model, an intermediary could tamper with the token stream, and the reply would still read like a competent answer. FlashProve is built to close that gap with math instead of policy.

## How Provable Inference for LLMs Works

Provable inference attaches a proof to a model’s output. The proof states that a specific model, identified by a published commitment, produced that exact reply for that exact input. A checker who holds the proof can verify the claim without rerunning the model and without seeing its internals.

TechCrunch described the mechanism with an email analogy. Cryptographic signatures let a recipient confirm a message came from its claimed sender, and FlashProve aims to give model outputs the same property. Per TechCrunch’s reading of the post, the scheme would hold up against impostors, including the lab that runs the model. For that to work, labs would publish a fingerprint of each model they release, and outputs could later be matched against it. Those fingerprints do not reveal the model’s weights, which is what lets closed-model makers participate without surrendering their most valuable asset.

### The three formal properties

Anthropic’s release addresses three properties that any proof system has to get right. Completeness means an honest prover with a true statement can always convince the verifier. Soundness means a cheating prover cannot convince the verifier of a false statement, except with negligible probability. Zero-knowledge means the proof reveals nothing beyond the fact that the statement holds.

For a language model, soundness is the property buyers care about. It is what stops a provider from claiming a premium model answered when a cheaper one did. Zero-knowledge is what the provider cares about, because it keeps the weights private. Completeness is the plumbing that makes the whole thing usable.

### Why a zkSNARK fits the job

A zkSNARK produces a proof that is small compared with the computation it covers and quick to check. That asymmetry is the whole point. Generating the proof is expensive, and verifying it is cheap. TechCrunch noted the system is designed to be lightweight enough for verification on a local device, which would put the check in the hands of the person who received the reply. Teams that already wrap model calls in checks, such as the patterns in our [guide to AI guardrails for LLM apps](https://shattered.io/ai-guardrails-llm-app-python-12-steps-2026/), could eventually add a proof check to the same pipeline.

## What Is in the Apache 2.0 Release

[Help Net Security’s write-up](https://www.helpnetsecurity.com/2026/11/04/anthropic-flashprove-provable-inference/) lists three executables in the repository. One is the prover. One is a fast verifier written in C++. The third is a second verifier written in Lean, the proof assistant the team used to state and prove the protocol’s completeness, soundness, and zero-knowledge properties. The release also includes the formal proofs behind them and a protocol specification.

| Item | What the sources confirm | 
|---|---|
| System | FlashProve, a research prototype for provable inference of large MoE language models | 
| Technique | zkSNARK (zero-knowledge succinct argument of knowledge) | 
| Collaborators | EPFL, MIT, and StarkWare | 
| License | Apache 2.0, covering the prover, two verifiers, formal proofs, and protocol specification | 
| Verifiers | One fast verifier in C++, one in Lean | 
| Test model | Llama 4 Maverick, a 400-billion-parameter MoE model | 
| Baseline | vLLM running the same model in FP8 on eight H100 GPUs | 
| Overhead | About 72 times per GPU across runs, about 94 times at the heaviest tested load | 
| Deployment | No plans to deploy at Anthropic or another lab, per TechCrunch | 

One detail separates this release from many research drops. The model weights are not in it. Help Net Security reports that readers must pull Llama 4 Maverick from Hugging Face themselves under Meta’s license. That keeps the repository light and sidesteps any redistribution question, though it also means reproducing the results takes real hardware and a license acceptance step.

## Two Verifiers, One Trust Question

Shipping two verifiers looks redundant until you think about what a verifier is for. The C++ verifier is the one you would run day to day. It is fast. The Lean verifier is a reference implementation that runs slowly, and Help Net Security says that is fine because its job is to establish that the verifier accepts only the statements the soundness theorem covers. On every test proof, the two reportedly agreed.

The team is also candid about what it cannot guarantee. According to the same report, three versions of the system exist: the paper, the Lean protocol, and the code that actually runs. Anthropic does not promise all three say the same thing. Someone has to compare the Lean statements against the code by hand, and the repository ships an interactive visualizer to help with that audit. The prover has no formal tooling behind it, so it gets audited the old-fashioned way, by people reading it.

That candor is useful. A formally verified protocol sitting next to unverified code can give a false sense of safety, and the authors appear to know it. For security teams, the takeaway is practical. Treat the Lean artifacts as strong evidence about the protocol, treat the C++ and prover code as ordinary software that needs review, and do not mistake one for the other.

```
# Conceptual flow of provable inference (illustrative, not FlashProve's actual commands)
1. Lab commits to a model once and publishes the fingerprint (weights stay private)
2. Client sends a prompt to the hosted model
3. Prover generates a zkSNARK alongside the reply
4. Client downloads the fingerprint and the proof
5. Verifier checks: this model produced this reply for this prompt
6. Accept if the proof checks out, reject and flag the provider if not
```

## The Llama 4 Maverick Benchmark Against vLLM

Anthropic picked a hard target. Llama 4 Maverick is a 400-billion-parameter MoE model. That makes it a fair stress test for a system built for large MoE models. Readers tracking which open models are worth running can compare Maverick’s class against others in our [open-weight AI models spec sheet](https://shattered.io/open-weight-ai-models-side-by-side-the-spec-sheet/).

The baseline was vLLM, a widely used inference engine, serving the same model in FP8 on eight H100 GPUs. Against that baseline, Anthropic reports the prover costs about 72 times as much per GPU across runs and about 94 times at the heaviest load it tested. Those two figures are the ones the verified source supports.

### Reading the 72x and 94x figures

A simple illustration shows the scale. If a batch of requests consumes one GPU-hour on vLLM, proving that same batch would consume roughly 72 GPU-hours at the lower figure and roughly 94 at the higher one. That is our arithmetic on Anthropic’s ratios, not a number from the post, and the real cost depends on batch shape and hardware.

Two things stand out. First, the overhead rises with load, which is the opposite of what a production operator wants. Second, a ratio near 100 is still a research number. Whether the gap narrows depends on how much of the cost is fundamental and how much is the price of a first prototype.

## Numbers Anthropic Has Not Confirmed

Secondary coverage has already added figures that the Anthropic source reviewed for this article does not confirm. Readers should treat them as reported, not established. The table below separates what is solid from what is circulating.

| Claim | Where it appears | Status | 
|---|---|---|
| About 72x per GPU, about 94x at peak load | Anthropic’s research page, echoed by Help Net Security | Confirmed | 
| 70 to 95x GPU-time overhead | Secondary reports | Unconfirmed as a range | 
| Roughly 110 tokens per second on one H100 | Help Net Security and other secondary reports | Unconfirmed in Anthropic source | 
| Roughly 19 MB per proof | Secondary reports | Unconfirmed in Anthropic source | 
| 4-bit quantization of the test model | Secondary reports | Unconfirmed, and not repeated here | 
| Pricing, availability, or customer use | None found | Not announced | 

Help Net Security reports the prover moving about 110 tokens per second on one H100 with 24 CPU cores, and a proof for a 1,024-token request of roughly 19 MB. Those figures look plausible and may well be accurate. They still fall under the rule that applies to every number in a fast-moving story: attribute it, flag the gap, and wait for the primary source to catch up.

The 70 to 95 times range deserves a note of its own. It rounds the two confirmed ratios into a band, which is a reasonable shorthand but not what the research page states. Quote the confirmed 72 and 94 when precision matters.

## Why Model Identity Matters for API Buyers

The case for provable inference starts with incentives. TechCrunch reported that the researchers see the system preventing an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive one to inflate its performance results. Both are plausible abuses. A provider under margin pressure has a reason to serve a smaller model, and a provider chasing a leaderboard has a reason to run something heavier during evaluation.

Third-party claims are the other use. TechCrunch relayed the researchers’ examples: a developer might say a software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might say a business plan got a green light from an appropriate model. Today a reader has no way to test those statements. With a proof attached, the claim becomes checkable.

Security teams will see a third angle. Anthropic’s post says these proofs can make it harder for attackers to hijack a chat. That matters in a year when stolen cloud credentials and abused model endpoints are routine, as our reporting on [LLMjacking and $1 million cloud bills](https://shattered.io/llmjacking-attacks-1-million-cloud-bills-mandiant-google-2026/) showed. A proof does not stop credential theft, but it narrows what an attacker can pass off as a legitimate model reply.

## Market Impact: Who Pays for a 72x Overhead

At roughly 72 to 94 times the GPU cost, FlashProve will not touch the economics of ordinary chat traffic. Nobody will prove every reply to a casual question. The near-term market is narrow and specific: audits, evaluations, regulated workflows, and high-stakes claims where a single verified output is worth far more than the compute it burns.

Evaluators are the first obvious customers. Anthropic’s post says safety evaluators could use proofs to confirm that the model they test is the same one served to customers. That addresses a long-running complaint about benchmark gaming, where a lab shows its best model to testers and ships something else. A proof on a sampled set of evaluation requests would turn that worry into a checkable fact.

The cost side cuts the other way for buyers chasing savings. Companies moving workloads to cheaper self-hosted models, such as the shift we covered in [Revolut’s 10x cut in AI coding costs with GLM-5.1](https://shattered.io/revolut-self-hosted-glm-ai-coding-costs-10x-2026/), gain a reason to ask whether the cheaper model is really the one answering. Provable inference offers a way to confirm that a cost-saving swap is the one you agreed to, and not a quiet downgrade.

Chip vendors have little to cheer yet. A 72x multiplier on GPU time would in theory consume enormous capacity if it were ever applied at scale, but no one plans to apply it at scale. The more realistic effect is on research budgets. Expect more teams to work on faster proving, and expect specialized hardware for zero-knowledge workloads to get a fresh look from people who have so far associated it only with crypto.

## Competitive Comparison: Ways to Trust a Model

FlashProve is not the only way to build trust in a hosted model. It sits in a field of approaches that differ in what they prove, what you must still trust, and what they cost. The table below is our analysis of the categories, not a ranking of named products.

| Approach | What it shows | What you still trust | Cost profile | 
|---|---|---|---|
| Provider’s word and contract | Nothing cryptographic | The provider, fully | Free | 
| Third-party benchmarks | Average behavior on test sets | That the tested model is the served model | Low per run | 
| Behavioral fingerprinting | A statistical resemblance to a known model | The statistics, and that nobody mimics them | Low to moderate | 
| Hardware attestation | A given software stack ran on given hardware | The chip vendor and the attestation chain | Moderate | 
| zkSNARK proof (FlashProve) | This model produced this reply | The math, the committed fingerprint, and the code | About 72 to 94 times GPU overhead in the prototype | 

The comparison clarifies the pitch. Benchmarks and fingerprinting tell you something probabilistic about a model. Hardware attestation shifts trust to a chip vendor. A zkSNARK shifts trust to mathematics and to the correctness of the implementation, which is why Anthropic released formal proofs and two verifiers. The price is the overhead, and that price is why the other approaches will stay in use for years.

## Historical Context: From Zero-Knowledge Theory to LLM Proofs

Zero-knowledge proofs began as a theoretical idea in cryptography, a way to convince someone a statement is true without handing over the reason. For decades they stayed mostly in papers. Production use arrived largely through cryptocurrency scaling, where companies such as StarkWare built systems to prove that large batches of transactions were processed correctly. StarkWare’s presence on this project reflects that lineage.

Applying the same idea to machine learning is a newer and harder problem. Neural networks involve huge numbers of arithmetic operations over approximate numbers, and proof systems prefer exact arithmetic over finite fields. Proving a reply from a 400-billion-parameter MoE model, even at a steep overhead, marks a jump in ambition.

There is a parallel with another cryptographic transition now underway. Our explainer on [QKD versus post-quantum cryptography](https://shattered.io/qkd-vs-pqc-quantum-key-distribution-post-quantum-cryptography-2026/) describes how software-based schemes tend to beat exotic hardware in practice. Provable inference follows the same pattern. It asks for new software and published fingerprints, not new silicon in every data center, which gives it a path to adoption that hardware-first ideas lack.

## What Anthropic Says in Its Own Words

Anthropic is the only named voice in the verified material, so the quotes below all come from the company’s own posts and from TechCrunch’s report of them. They show how the authors frame the work.

The research page opens with a plain statement of intent. Anthropic writes: “Today, we release FlashProve: an open-source performant prototype for provable inference.” The same page describes the scope plainly. Anthropic writes, “FlashProve is a system for provable inference of large Mixture-of-Experts (MoE) language models.”

On applications, Anthropic’s [announcement thread on X](https://x.com/AnthropicAI/status/2117710942826123294) says: “These proofs have a range of applications. They can, for instance, make it harder for attackers to hijack a chat, or enable safety evaluators to verify that the model they’re testing is the same one being served to customers.” The thread closes the argument with a forward look: “Further progress in provable inference will likely be an important part of improving trust in AI deployment.”

The researchers also set expectations. As [TechCrunch reported](https://techcrunch.com/2026/11/03/anthropic-is-working-on-a-system-to-prove-ai-models-identity/), they wrote: “This research post is meant to share intermediate progress, and not a completed research agenda.” Read together, the quotes describe a team confident in the direction, specific about use cases, and careful not to oversell a prototype.

## Limits and Open Questions

Several questions remain open, and the release does not pretend otherwise. The first is adoption. A proof is only useful if labs publish fingerprints and clients check them. TechCrunch reported that the scheme requires labs to publish a fingerprint for each model they release. Nothing in the announcement says any lab has agreed to do so, and Anthropic has said it has no plans to deploy the system.

The second is scope. FlashProve targets large MoE models, and the tested example is one specific model. Dense architectures, multimodal inputs, long contexts, and fine-tuned variants are not covered by anything verified here. A proof that one model produced one reply says nothing on its own about whether that reply was good, safe, or accurate.

The third is the gap between the formal and the real. As noted earlier, Anthropic does not promise the paper, the Lean protocol, and the running code say the same thing. Closing that gap will take outside reviewers, and the open license invites them. For broader context on where this research sits among other model and tooling news, see our [AI and machine learning coverage](https://shattered.io/ai-machine-learning/).

## Five Predictions for Provable Inference

These are our forecasts, built from the facts above. None comes from Anthropic or any named expert.

- **Overhead drops before anyone deploys.** The current 72 to 94 times range is a prototype figure. Expect follow-up work from academic and industry groups aimed at cutting it, since the code is open and the target is public.
- **Evaluators adopt it first.** Safety testers and benchmark operators have the strongest reason to pay for verified identity on a sampled set of requests, and the lowest volume to worry about.
- **Regulators will notice.** Rules that demand transparency about AI systems create demand for evidence. Our[EU AI Act timeline to 2028](https://shattered.io/eu-ai-act-world-first-ai-law-five-dates-to-2028-2026/) shows how many compliance dates are coming, and verifiable model identity fits that conversation.
- **Fingerprints arrive with open-weight releases first.** Publishing a commitment is easiest for models whose weights are already public, so expect experiments there before any closed frontier model follows.
- **Rivals respond with their own schemes.** When one lab publishes a trust primitive, others tend to publish competing designs or critiques within months. A shared standard, if it comes, will take longer than a year.

## What to Watch Next

Three signals will show whether FlashProve becomes infrastructure or stays a paper. Watch the repository for outside contributions and independent audits of the prover. Watch for any lab, Anthropic or otherwise, that moves from “no plans” to a pilot. And watch the overhead figure, because every drop in that number widens the set of use cases that can afford a proof.

For engineers today, the practical advice is simple. Read the protocol specification, run the Lean verifier if you have the appetite, and note which parts of the stack are formally covered and which are not. For buyers of hosted models, keep asking providers hard questions about which model serves which request, and treat any claim of verified inference as unproven until it ships with a proof you can check yourself.

## FAQ: Provable Inference and FlashProve

**What is FlashProve?** FlashProve is a research prototype from Anthropic for provable inference of large Mixture-of-Experts language models. It uses a zkSNARK to generate a cryptographic proof that one specific model generated one specific reply.

**Who built it?** Anthropic built it with collaborators at EPFL, MIT, and StarkWare. The research page is dated November 2, 2026, and was updated November 3.

**Is FlashProve open source?** Yes. The prover, two verifiers (one in C++, one in Lean), the formal proofs, and the protocol specification were released under the Apache 2.0 license. The Llama 4 Maverick weights are not included, and users obtain them separately.

**How much slower is proving than normal inference?** Against vLLM running Llama 4 Maverick in FP8 on eight H100 GPUs, the overhead was about 72 times per GPU across runs and about 94 times at the heaviest tested load. Secondary reports round this to 70 to 95 times, which Anthropic’s source does not state as a range.

**Will Anthropic or other labs deploy it?** Not at present. TechCrunch reported there are no plans to deploy FlashProve at Anthropic or another lab. No pricing, commercial availability, or customer use has been announced.

**Does the proof reveal a model’s weights?** No. Per TechCrunch, the fingerprints labs would publish do not reveal weights, and zero-knowledge is one of the three formal properties the release addresses.

**What can provable inference be used for?** Anthropic’s post points to making chat hijacking harder and letting safety evaluators confirm the tested model matches the served one. TechCrunch adds that it could expose a secret swap to a cheaper or pricier model.

**Are the 110 tokens per second and 19 MB figures official?** Those numbers come from secondary reports such as Help Net Security. The Anthropic source reviewed for this article does not confirm them, so treat them as reported until the primary page or repository states them.