FlashProve explained: proving which AI model really answered you

You call an AI service that says it is running a particular model. How would you know? Today the honest answer is: you wouldn't, short of statistical audits and trust. On 2 November 2026 Anthropic's Frontier Red Team and collaborators from EPFL, MIT, StarkWare and Succinct released FlashProve, an open-source prototype that lets a provider attach a mathematical receipt to a reply, which anyone can check on an ordinary computer. It is slow, narrow and explicitly unfinished, but it is an open demonstration of this on a 400-billion-parameter model.

The plain-English version

Imagine buying a bottle labelled as a famous olive oil. You cannot taste the difference in the shop, and the seller could pour in something cheaper. Now imagine the producer seals each batch with a tamper-proof stamp, registered in advance, and gives you a way to check the stamp that does not require opening the bottle or learning the recipe.

That is the idea. AI companies keep their model "recipes", the billions of numbers called weights, secret. When you use a model through an app or a reseller, you cannot see which model actually wrote your answer. Cheaper stand-ins are a real concern: researchers who audited so-called shadow APIs describe endpoints advertised as a top model that fingerprint as a much smaller one, and a separate study lays out how providers could quietly swap in quantized or cheaper models.

FlashProve works in two steps. First, the provider publishes a short fingerprint, a "commitment", of its secret weights. That fingerprint locks in one exact set of weights, so the provider cannot later claim a different set. Second, for a given conversation, the provider can produce a proof: a compact file saying "the next word here is exactly what the model behind that fingerprint would have produced". You check the file on a normal CPU in about 17 to 21 seconds, according to Anthropic's technical report. You learn nothing about the weights.

Three things to keep straight. The proof says which model, not whether the answer is right; a committed model that makes a mistake still passes. It is also a research prototype: the demonstration uses Meta's open Llama 4 Maverick, not a Claude model, and a proof currently costs far more computing than the answer itself. And someone still has to confirm that the fingerprint really belongs to the model the provider advertises.

So: FlashProve is a proof-of-origin stamp for AI replies. The stamp works, can be checked cheaply, and is open source. Making it cheap enough to put on everything is the work that remains.

How it actually works

The problem. A verifier who does not have the weights cannot re-run the model. A verifier who did have them would hold the provider's most valuable asset. Cryptographers call the way out zero-knowledge succinct arguments: short proofs that a computation was done correctly, revealing nothing else.

The old way. Earlier proving systems for neural networks existed (the report cites, for example, zkLLM and VerInf), but we could not verify their exact speeds, so we make no numeric comparison here.

The new idea, as a walkthrough:

1. Commit (offline, once per model). The provider encodes the weights with an error-correcting code, hashes the result into a commitment, and proves the encoding is well formed. For Llama 4 Maverick this takes about 39 minutes and the provider stores 2.15 GB of files.
2. Run (online). For a request, the provider runs the model and records a trace: the value after every multiplication, rounding and nonlinear step.
3. Prove. The prover shows that every step follows the model's arithmetic given the committed weights; that in each expert layer the expert that ran had the highest router score; that all values stay in range; and that the checked token had the highest score of the whole vocabulary.
4. Verify. The verifier sends random challenges. Because the proof is built on hashes, it needs no secret setup, and Anthropic says that makes it post-quantum secure.

Why integer maths. Proof systems compute inside finite fields, where integer arithmetic matches exactly as long as numbers stay in range. Floating-point arithmetic is not bit-for-bit reproducible across machines. So FlashProve proves an exact integer, 4-bit-weight version of the model.

Why it is feasible at 400B. The model is a mixture of experts, so only about 17 billion parameters are active per token, and the prover's work follows that count, not the full 400B. Requests are also proved afterwards, in batches, with the weight commitment opened once per batch. And the 232 GB of weights stay in ordinary RAM and are streamed to a single 80 GB GPU one segment at a time.

All of these are Anthropic's own measurements.

The deep dive

The statement being proved

Per the technical report, a request is a token sequence (prompt plus reply) and a range of positions. The claim: for every position in the range, the next token is the committed model's greedy choice, i.e. $t_i = \arg\max_v \; s_v(t_{<i}; M)$ where $M$ is the committed weight vector. In the Llama 4 Maverick evaluation each proof checks one token, the one following the prompt. The authors also tried checking every token of the reply and report no measurable speed difference. Counted in checked tokens only, throughput is 39.1 tokens per second, against 110 when counting all 1,024 processed tokens.

Toolkit: IOPs, sumchecks, lookups

FlashProve is an interactive oracle proof (IOP) compiled into a non-interactive, hash-based argument. The report assembles it from reductions ("interactive oracle reductions"), each turning one claim into a simpler one.

• Code proximity tests with linear constraints. The weights and trace are sent as oracles encoded with a code. The report cites WHIR-style proximity testing, combining sumcheck, interleaved codes and code-switching.
• Sumcheck. Matrix products reduce to linear claims on the encoded oracles. The report counts roughly two thousand sumchecks per request.
• Lookups. Operations such as softmax and SiLU are awkward as field arithmetic. Since the functions are known in advance, the prover instead shows each $(x, f(x))$ pair is a row of a public table, checked with a grand-product or LogUp-GKR argument. Tables stay small because each function is needed on only $2^{16}$ inputs; beyond that SiLU is cut off and the softmax exponential rounds to zero.
• MoE routing. Routing choices are held as indicator vectors over experts, and the verifier checks the expert product as a sum over all experts weighted by the vector, so its queries to the weights do not reveal which expert ran.
• Approximate range checks. Instead of one lookup per value, FlashProve checks random sums over whole matrices. The price is imperfect completeness: an honest prover is rejected with tiny probability, which could itself leak information about the weights. The report says a retry mechanism is planned.

Batching and the proof DAG

Several clients' requests share the expensive weight-commitment opening, but each client must receive a proof that reveals nothing about the others. The solution is a fork-and-join structure of hash chains with a small Merkle tree joining them. The report targets 128 bits of security.

Numbers and comparisons

The overhead figure compares different set-ups (4-bit integer proving on one GPU against an FP8 vLLM deployment on eight), a caveat the report itself spells out. Secondary coverage rounds it to "70 to 95 times".

Formal verification, and its odd twist

The protocol and its security properties (completeness, soundness, zero-knowledge in the random oracle model) are formalised in Lean. Two verifiers ship: a fast C++ one for daily use with no formal guarantee, and a slower pure-Lean one proven to accept only what the soundness theorem covers.

Then comes the twist. The technical report states that it was AI-generated and not reviewed in detail, and that the GPU prover code and the CPU verifier code are AI-generated from the Lean representation and not proved equivalent to it. The authors argue that prover bugs cannot break soundness (the verifier only has to trust itself) but could break completeness or leak weights. Zero-knowledge is so far formally proved only for single-request proving, not batches.

Closest related approaches

Proofs are one of three families for catching model substitution. Statistical approaches such as DiFR (co-authored by FlashProve's Roy Rinberg) and single-token fingerprinting detect deviations from a reference model; the latter's authors do not claim cryptographic guarantees. Trusted hardware (TEEs) is the third. FlashProve's differentiator is a mathematical guarantee that does not depend on trusting a chip vendor, at a large compute price.

Why it matters

Everyday users. Nothing changes tomorrow. The longer-term hope is a "verified model" badge that means something: when an app says it uses a given model, a third party can check, instead of relying on a brand promise.

Developers and builders. Anyone reselling or routing model access gains a way to demonstrate they serve what they advertise, and anyone buying gains a way to test. The realistic early pattern, as AI Weekly frames it, is audits and procurement checks rather than a proof on every chat message.

Companies and regulators. Regulated settings such as finance, health and government need evidence about which system produced a decision. A commitment published in advance, plus sampled proofs, could become part of an audit trail. The same machinery pairs naturally with provenance efforts such as text watermarking: watermarks say "an AI wrote this", proofs say "this specific model did".

The field. Two second-order effects stand out. First, proof overhead in the tens rather than thousands is a step change: earlier zero-knowledge proving of LLMs was generally far costlier, although we could not verify a specific figure for that comparison. Second, building a proof system with AI agents writing code against a machine-checked specification is itself a signal about how high-assurance software may be made, and how much then depends on trusting the specification.

What to be skeptical of

Cost. Crypto Briefing calls ~70-95x overhead "a proof of concept, not a business model". Anthropic's report says it is sharing intermediate progress, and the repository is marked "not maintained", as AlphaSignal also notes.

Narrow scope. Context is limited to 1,024 tokens, far below typical chat sessions. The proof covers an integer version of the model under greedy decoding or fixed-seed sampling; a floating-point deployment or sampled output could diverge from what was proved. The architecture is not hidden, and side channels such as proof timing are out of scope.

One token per proof. In the evaluated configuration a proof certifies one token, the one after the prompt, not an entire long reply. A provider could therefore be caught only if checked positions are chosen unpredictably.

What "the right model" means. A proof ties a reply to a commitment. Whether the commitment belongs to the advertised model is a separate trust question, as AlphaSignal's reading of the report notes. Weight theft and prompt storage are outside the model.

Trust in the toolchain. Report and code are largely AI-generated, formal proofs rely on the Lean kernel, and the fast verifier is not itself formally verified. Anthropic says a carefully reviewed paper will follow.

Independent review. At the time of writing, the coverage we found was mostly restatements of Anthropic's own numbers; we did not find an independent replication or named expert critique. Treat all performance figures as vendor-reported.

What to watch next

• A reviewed paper. Anthropic says a carefully reviewed technical paper will follow. Check whether claims and numbers change.
• Independent replication. Does someone outside Anthropic reproduce ~110 tokens per second and ~19 MB proofs from the repository?
• Longer contexts and sampling. The next milestone is lifting the 1,024-token window and handling non-greedy decoding, since real chat uses both.
• Overhead. Does the 72x figure fall by an order of magnitude? The report lists optimisations it did not yet apply.
• Adoption. Does any API provider or reseller publish a weight commitment and offer sampled proofs?
• Related coverage. For the broader trust-in-AI-outputs thread, see our explainers on OpenAI's textGrain watermark and Anthropic's S-1 and compute commitments.

One more story from the same news cycle deserves its own piece: Anthropic's amended IPO filing says it may soon meet its internal threshold for AI-accelerated progress, according to Dataconomy's report. We will return to it once the underlying data is public.

How this was made: researched and written by an AI model (Claude) from the primary sources listed above, then checked claim-by-claim against those sources in a separate AI fact-check pass. Spotted an error? Email [email protected] and we correct it publicly. Our process.