Anthropic's Frontier Red Team published a research post on November 2 and open-sourced FlashProve under Apache 2.0. A model provider commits to hidden weights once, then attaches a zero-knowledge proof to each reply, so a user without the weights can check on an ordinary CPU that the reply really came from that model. That targets routing services that quietly swap in cheaper models and tampered token streams. Anthropic reports about 110 tokens/s on one H100 for Llama 4 Maverick (400B MoE, 4-bit), proofs of about 19 MB per 1,024-token request, and roughly 70-95x the GPU time of vLLM inference. It is an unmaintained research prototype limited to 1,024-token contexts and greedy decoding of an integer version of the model. Anthropic engineer Steve Weis shared the release on X.
Key Takeaways
- ✓Anthropic-reported: on Llama 4 Maverick (400B MoE, 4-bit) one H100 proves about 110 tokens/s (prefill, 24 requests per batch), with proofs of about 19 MB per 1,024-token request.
- ✓It is costly: roughly 70-95x the GPU time of vLLM inference; the performance page lists about 270 GB of host memory for serving and about 39 minutes to commit to a set of weights.
- ✓Verification needs no GPU: the C++ verifier checks a proof in about 21 seconds on one thread, and a slower Lean verifier plus Lean 4 proofs of the security theorem are included.
- ✓Against prior work: VerInf proved the same model at about 0.02 tokens/s; the commercial Attestable reached 53-77 tokens/s on Gemma 4 31B but has no open-source release.
- ✓Limits: v0.16.0 is an unmaintained research prototype with 1,024-token contexts, greedy decoding of an integer model only, and no architecture hiding.
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and Industry Pain Points
When you call an AI model today, you cannot confirm the reply came from the model you chose: a routing service may swap in a cheaper model to save money, or an attacker may tamper with the token stream. Frontier weights are private, and even if they were public most users could not afford to rerun the model to check. On November 2, Anthropic's Frontier Red Team, with researchers from EPFL, MIT and others, released FlashProve as a cryptographic approach to provable inference. Anthropic engineer Steve Weis shared the release on X.
Architecture and Mechanism
FlashProve uses zkSNARKs (zero-knowledge succinct arguments). Offline, the provider publishes a hiding commitment that pins down one set of weights. Online, each reply carries a proof, and anyone holding the commitment, prompt and reply can check that those weights produce exactly those tokens on that prompt, while the proof reveals nothing about the weights. Anthropic says Claude contributed improvements to zkSNARKs for inference, and the top-level security statements are formalized and proved in Lean.
Benchmarks and Measured Results
All figures are Anthropic-reported: on Llama 4 Maverick (400B MoE, 4-bit) one H100 proves about 110 tokens/s, proofs are about 19 MB per request, and GPU time is roughly 70-95x that of vLLM; the C++ verifier takes about 21 seconds on one thread. The earlier open-source VerInf proved the same model at about 0.02 tokens/s. There is no task-level benchmark.
Developer Guide
The anthropics/FlashProve repo is Apache 2.0 and its README includes a prompt for a coding agent to build the verifier and check a stored example proof, which needs only Linux, g++ 13 and under 2 GB of RAM. Full proving needs an H100 and about 270 GB of host memory. It is an unmaintained research prototype with 1,024-token contexts, so treat it as a research and evaluation tool.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.