Anthropic Open-Sources FlashProve: zkSNARK Proofs That a Reply Came From the Committed Model, About 110 Tokens/s for 400B Llama 4 Maverick on One H100
Anthropic's Frontier Red Team published a research post on November 2 and open-sourced FlashProve under Apache 2.0. A model provider commits to hidden weights once, then attaches a zero-knowledge proof to each reply, so a user without the weights can check on an ordinary CPU that the reply really came from that model. That targets routing services that quietly swap in cheaper models and tampered token streams. Anthropic reports about 110 tokens/s on one H100 for Llama 4 Maverick (400B MoE, 4-bit), proofs of about 19 MB per 1,024-token request, and roughly 70-95x the GPU time of vLLM inference. It is an unmaintained research prototype limited to 1,024-token contexts and greedy decoding of an integer version of the model. Anthropic engineer Steve Weis shared the release on X.
Key Takeaways
- Anthropic-reported: on Llama 4 Maverick (400B MoE, 4-bit) one H100 proves about 110 tokens/s (prefill, 24 requests per batch), with proofs of about 19 MB per 1,024-token request.
- It is costly: roughly 70-95x the GPU time of vLLM inference; the performance page lists about 270 GB of host memory for serving and about 39 minutes to commit to a set of weights.
- Verification needs no GPU: the C++ verifier checks a proof in about 21 seconds on one thread, and a slower Lean verifier plus Lean 4 proofs of the security theorem are included.
- Against prior work: VerInf proved the same model at about 0.02 tokens/s; the commercial Attestable reached 53-77 tokens/s on Gemma 4 31B but has no open-source release.
- Limits: v0.16.0 is an unmaintained research prototype with 1,024-token contexts, greedy decoding of an integer model only, and no architecture hiding.
