--- title: Anthropic open-sources FlashProve, a system for proving... description: Anthropic open-sourced FlashProve, a library that lets a model provider cryptographically prove an output came from a specific model, without revealing the... canonical: https://daily.dev/posts/anthropic-open-sources-flashprove-a-system-for-proving-which-model-produced-an-output-0w15kpdqw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic open-sources FlashProve, a system for proving which model produced an output | daily.dev og:description: Anthropic open-sourced FlashProve, a library that lets a model provider cryptographically prove an output came from a specific model, without revealing the... og:url: https://daily.dev/posts/anthropic-open-sources-flashprove-a-system-for-proving-which-model-produced-an-output-0w15kpdqw og:image: https://api.daily.dev/og/posts/0w15KpdqW.png og:image:alt: Anthropic open-sources FlashProve, a system for proving which model produced an output og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic open-sources FlashProve, a system for proving which model produced an output **[Collections](https://daily.dev/sources/collections)** · 3 min read · 15 upvotes · 0 comments ## Summary Anthropic open-sourced FlashProve, a library that lets a model provider cryptographically prove an output came from a specific model, without revealing the weights. On Meta's Llama 4 Maverick (400B parameters), a single Nvidia H100 produced proofs at 110 tokens per second, each about 19MB, and an ordinary CPU verified one in about 17 seconds. The prior system, VerInf, generated 93.6GB proofs that took nearly a day to check. Claude wrote the code, and its security guarantees are proved in Lean 4 rather than reviewed by a human. ## Content Anthropic has released FlashProve, an open-source prototype for what it calls provable inference. A model provider can use it to show cryptographically that a response came from a specific set of weights, without revealing those weights. @scaling01 put the aim this way: proving an output wasn't produced by a weaker, distilled or otherwise tampered-with version. ## What it's for Anthropic lists a few uses. Proofs could make it harder for attackers to hijack a chat. They could also let safety evaluators confirm that the model they tested is the one served to customers. @rohanpaul_ai gave a more everyday case: if you pay a reseller for a top model, you currently can't tell whether a cheaper one answered instead. One write-up compares the idea to cryptographic email signatures. Labs would publish a fingerprint for each model, and anyone could match outputs against it. The system is built so verification can run on a local device. ## How it works FlashProve uses a zkSNARK, building on established cryptographic techniques. The release includes a technical report, executable prover and verifier code, and Lean-formalized proofs of completeness, soundness and zero-knowledge. According to @rohanpaul_ai, Claude built the system, and since its code is hard to audit, the security guarantees are proved in Lean 4, a proof-checking language. Anthropic's collaborators on the work were Alessandro Chiesa, @GiacomoFenzi, @gwberg95, @miranda__christ, Rahul Dalal and Ben Mayer (@transmissions11). ## The numbers It was tested on Meta's Llama 4 Maverick, a 400B-parameter mixture-of-experts open model with 4-bit quantization, not on Claude. Reported figures: - A single Nvidia H100 produces proofs at about 110 tokens per second. - Each proof is roughly 19 MB (reported as 18.78 MB) for a 1,024-token request. - Verification takes about 17 seconds on 24 CPU threads. Another account reports 21 seconds on a single thread. - Proving costs 70 to 95 times more than running the model directly with vLLM. The only earlier system known to prove this model, VerInf, produced 93.6 GB proofs for 1,000 tokens that took 14.3 hours to check. FlashProve is far cheaper to verify, though the proving overhead is still large. ## Limits Context is capped at 1,024 tokens. FlashProve isn't part of the Claude API, and Anthropic describes it as intermediate progress with no deployment plans yet. The company says further work on provable inference will likely matter for trust in AI deployment, and has published the code on GitHub so others can build on it. ## Questions this post answers ### How fast can FlashProve generate proofs on a single H100 GPU for Llama 4 Maverick? FlashProve produces proofs at 110 tokens per second on a single Nvidia H100 GPU when run on Meta's Llama 4 Maverick, a 400 billion parameter open model. Each proof is about 19MB and can be verified on an ordinary CPU in roughly 17 seconds, a major efficiency gain over prior approaches. _Teams evaluating provable inference setups can follow benchmarks like this one on daily.dev._ ### How does FlashProve compare to VerInf for proving model inference? FlashProve is dramatically more efficient than VerInf, the only earlier known system capable of proving Llama 4 Maverick's outputs. VerInf generated proofs of 93.6GB that took almost a day to verify, while FlashProve produces 19MB proofs verifiable on a CPU in about 17 seconds, a gap of several orders of magnitude. _Anyone comparing cryptographic verification tools for AI inference can track updates like this on daily.dev._ ### Who wrote the code for Anthropic's FlashProve system and how was it verified? Claude wrote the code for FlashProve, according to a report from rohanpaul_ai. Because AI-generated code is hard for humans to audit, Anthropic proved the system's security guarantees mathematically in Lean 4, a proof-checking language, rather than relying on manual code review. _Developers curious about AI-written code and formal verification can follow stories like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 4 discussions and 112 comments across hackernews (as of 2026-11-05). **TL;DR:** Discussion centers on a sharp attribution dispute with the original VerInf researcher, while a large separate thread debates whether provable inference actually solves a problem anyone has, with many skeptical that it offers real value given the 70-95x overhead and the need to still trust the provider. **Sentiment:** 20% positive · 35% mixed · 45% skeptical **The case for** - Some see real value for auditing third-party routing services, OpenRouter-style resellers, and detecting silent model substitution/quantization. - A few note verification is cheap and fast for clients (CPU-only, ~17s) compared to the cost of re-running inference. - Academic/industry practitioners researching ZKP auditing say this validates their own early results and represents meaningful efficiency gains over prior work like VerInf. **The pushback** - Many argue the proof only shows which weights were used, not that inputs/outputs weren't tampered with or that users can trust the provider at all, making it of limited practical value. - The original VerInf author and others claim the work copies prior research with very little attribution, sparking a lengthy dispute. - Several find the 70-95x GPU overhead and multi-gigabyte proof sizes impractical, with HTTPS and existing trust models already covering most concerns. - Some suspect the real motivation is internal (regulatory capture, locking in model-router revenue, or distinguishing "premium" models) rather than genuine user benefit. - Comparisons to alternatives like TEEs/confidential computing or simple digital signatures are seen as potentially simpler and more practical. **By community** - hackernews (heated): A contentious attribution dispute over uncredited prior research dominates alongside a broader, divided debate about whether provable inference is actually useful or just an expensive solution in search of a problem. **Hottest debate:** Whether cryptographically proving which model weights generated a response is genuinely useful, versus being a costly, narrow fix that still requires trusting the provider. **Open questions** - Does the released work give sufficient credit to the VerInf project it builds on? - Is this actually practical for batched, heterogeneous-hardware production inference rather than toy-scale 1k-context demos? - How does this compare in cost/practicality to alternatives like TEEs/confidential computing or simple cryptographic signing of outputs? **Highlights** > This is built on VerInf, work that I did as a MARS fellow. They ripped everything down to the choice of 400B Maverick from us with very little attribution. Cool, I guess... https://github.com/jamespetrie/verinf > — [neuwirth on hackernews · 10 comments](https://news.ycombinator.com/item?id=50370121) > This is an exaggeration. The commitment scheme is related but different (Ligero vs Zook). Matmuls are different (Freivald vs Sumcheck), lookups are different (LogUp vs Grand Product), the packing is different. What original ideas are in VerInf that are also in this work besides the choice of benchmark? > — [remcob on hackernews](https://news.ycombinator.com/item?id=50376342) > At first I thought this was work on the far more important problem of proving that LLM output is provable and correct given some source of truth. But it's about the trivial problem of 'proving' which model is being used. Who will find this useful? I can't really think of a use for it, because if you don't trust the provider of your models, it's game over really - you're already giving them all sorts of private data, you're relying on their service, you have to trust them to some extent and this doesn't really help because unless you are running the service yourself. Seems like more of an internal problem for Anthropic than something that would interest others. > — [grey-area on hackernews · 5 comments](https://news.ycombinator.com/item?id=50368869) > For open-weight models, provable inference is trivial: just redo the computation! This is much faster, cheaper, and doesn't require any fancy cryptography, just deterministic inference (which, if you read carefully, the ZKP approach needs too). See https://lukechampine.com/repligraphs Of course, it's unlikely that we'll get open-weight models from OpenAI or Anthropic any time soon. That means we have to choose between a) fancy ZKPs, b) signed responses, or c) comparing results from multiple inference providers. Whatever method ends up being used, it's clear to me that some form of provable inference is inevitable. People haven't caught on to its more significant applications, but they will. (This post touches upon one of them: model-driven audits.) Think about it: we can prove that a particular mind authored a particular artifact. That's never been possible before! You can't prove that Melville wrote Moby Dick, for example; but you can prove that Claude wrote a poem, or that Gemini approved a pull request, or that GPT got a particular score on some eval. This is a more powerful primitive than a cryptographic signature. > — [nemo1618 on hackernews · 2 comments](https://news.ycombinator.com/item?id=50370540) > As a client, you're still paying for the compute even if it happens on the service provider's side. Running the same computation twice (perhaps by another provider) is 2x the cost; but if you ask the provider to make this proof, that increases the cost 70-95 times according to the article. With that level of overhead, all kinds of otherwise inefficient approaches of getting compute start to seem comparably cheap. This is progress, but it still needs like a hundredfold improvement in order to become practical; I don't see a usecase where the benefits of this proof would be worth 70x or even 7x increase in cost. > — [PeterisP on hackernews](https://news.ycombinator.com/item?id=50372790) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50368626) · 217 points · 106 comments - [hackernews](https://news.ycombinator.com/item?id=50348831) · 10 points · 0 comments - [hackernews](https://news.ycombinator.com/item?id=50362579) · 7 points · 6 comments - [hackernews](https://news.ycombinator.com/item?id=50354148) · 7 points · 0 comments ## Similar posts on daily.dev - [The Rise of The Theorem Prover](https://daily.dev/posts/the-rise-of-the-theorem-prover-sc6qo4m8q) · Medium · 0 upvotes · 0 comments - [AI On Your Gaming PC](https://daily.dev/posts/ai-on-your-gaming-pc-a7iadecz7) · Hackaday · 2 upvotes · 2 comments --- Tags: [#anthropic](https://daily.dev/tags/anthropic), [#ai-security](https://daily.dev/tags/ai-security), [#zero-knowledge-proofs](https://daily.dev/tags/zero-knowledge-proofs) [View this post on daily.dev](https://daily.dev/posts/anthropic-open-sources-flashprove-a-system-for-proving-which-model-produced-an-output-0w15kpdqw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anthropic open-sources FlashProve, a system for proving which model produced an output","url":"https://daily.dev/posts/anthropic-open-sources-flashprove-a-system-for-proving-which-model-produced-an-output-0w15kpdqw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anthropic-open-sources-flashprove-a-system-for-proving-which-model-produced-an-output-0w15kpdqw"},"datePublished":"2026-11-03T20:16:42.899Z","dateModified":"2026-11-05T09:46:10.176Z","description":"Anthropic open-sourced FlashProve, a library that lets a model provider cryptographically prove an output came from a specific model, without revealing the...","image":"https://pbs.twimg.com/media/HWOgJ1ua0AAKtYr.jpg","thumbnailUrl":"https://pbs.twimg.com/media/HWOgJ1ua0AAKtYr.jpg","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/anthropic-open-sources-flashprove-a-system-for-proving-which-model-produced-an-output-0w15kpdqw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":15},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"anthropic,ai-security,zero-knowledge-proofs","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Anthropic open-sources FlashProve, a system for proving which model produced an output"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/anthropic-open-sources-flashprove-a-system-for-proving-which-model-produced-an-output-0w15kpdqw#faq","mainEntity":[{"@type":"Question","name":"How fast can FlashProve generate proofs on a single H100 GPU for Llama 4 Maverick?","acceptedAnswer":{"@type":"Answer","text":"FlashProve produces proofs at 110 tokens per second on a single Nvidia H100 GPU when run on Meta's Llama 4 Maverick, a 400 billion parameter open model. Each proof is about 19MB and can be verified on an ordinary CPU in roughly 17 seconds, a major efficiency gain over prior approaches. Teams evaluating provable inference setups can follow benchmarks like this one on daily.dev."}},{"@type":"Question","name":"How does FlashProve compare to VerInf for proving model inference?","acceptedAnswer":{"@type":"Answer","text":"FlashProve is dramatically more efficient than VerInf, the only earlier known system capable of proving Llama 4 Maverick's outputs. VerInf generated proofs of 93.6GB that took almost a day to verify, while FlashProve produces 19MB proofs verifiable on a CPU in about 17 seconds, a gap of several orders of magnitude. Anyone comparing cryptographic verification tools for AI inference can track updates like this on daily.dev."}},{"@type":"Question","name":"Who wrote the code for Anthropic's FlashProve system and how was it verified?","acceptedAnswer":{"@type":"Answer","text":"Claude wrote the code for FlashProve, according to a report from rohanpaul_ai. Because AI-generated code is hard for humans to audit, Anthropic proved the system's security guarantees mathematically in Lean 4, a proof-checking language, rather than relying on manual code review. Developers curious about AI-written code and formal verification can follow stories like this on daily.dev."}}]} ```