TL;DR
Anthropic’s FlashProve is an open-source research prototype for proving that a committed model produced an output without disclosing its weights. Its reported performance is promising for research, but verification is still expensive, constrained and not equivalent to proving an answer is correct.
Introduction
An agent can use a model through an API, a gateway and a router without ever seeing the model weights. That makes it hard for a customer or evaluator to independently verify whether the advertised model actually ran. A plausible answer is not proof of provenance: a cheaper model, modified output stream or different configuration can look convincing.
Anthropic’s November 2 research release approaches this as a cryptographic problem. FlashProve uses a zero-knowledge proof system to bind an inference result to a prior commitment to model weights. The company released code and formal statements, not a production guarantee for every Claude response. (Source : Anthropic — Progress on provable inference for large language models)
From a model promise to a checkable statement
The provider first commits to a model. Later, it supplies a proof that the computation associated with a prompt and output is consistent with that commitment. A verifier can check the proof without receiving the private weights. The architecture is not hidden in the current design, so the privacy claim is narrower than concealing every detail of a model.
This addresses a real gap in agent infrastructure: a benchmark buyer, enterprise customer or auditor may care whether a specific committed model was used, not merely whether the output looks competent. But the commitment still has to be connected to a trusted identity. If an attacker can substitute both the model and the commitment, the mathematics alone cannot tell the customer which commitment they should trust. Key distribution, versioning and contractual identity remain operational problems.
The prototype’s code, Lean proofs and documentation use the Apache 2.0 license. Anthropic’s demonstration uses a separately obtained quantized Llama 4 Maverick model; its weights are not part of the release and remain subject to Meta’s terms. (Source : Anthropic — Release and licensing)
The throughput number needs its denominator
Anthropic reports roughly 110 processed tokens per second on one H100 for a 400-billion-parameter mixture-of-experts model using four-bit weights, with a proof of approximately 19 MB per 1,024-token request. It also estimates roughly 70–95 times the GPU time of ordinary vLLM inference in its measured setting. These are vendor research measurements, not an independent production benchmark. (Source : Anthropic — Executive summary)
The denominator matters. The technical report’s setup includes a proof of one token within a 1,024-token window; processing those context tokens is not the same as proving each generated token at that rate. The report separately discusses a lower verified-token throughput when every token of the reply is verified. Comparing a headline number to a streaming API without accounting for which operations are proved would overstate practical performance. (Source : Anthropic — FlashProve technical report)
The window itself is another constraint. A 1,024-token research context is small compared with the long, evolving histories of many agents. Increasing it changes proof generation, memory and verification economics. Proof delivery can also be post hoc: detecting a substituted answer after it has been acted upon is different from preventing the action.
Proof is not accuracy, safety or privacy of the prompt
A valid proof is evidence about a specified computation under the scheme’s assumptions. It does not establish that the answer is true, that a tool call is safe, or that the model has not been manipulated by hostile retrieved content. Nor does it automatically certify upstream retrieval, tool execution, human approval or the identity behind a published model commitment.
For an agent, an eventual chain of evidence would have to cover more than inference: tool inputs and outputs, execution permissions, audit logs and the relationship between a proof and the action it authorized. Even then, cryptography can preserve the integrity of a bad decision. Review and evaluation do not disappear.
Formal verification also has scope. Anthropic published Lean statements and a Lean verifier alongside executable code; that is valuable for independent scrutiny, but a formal statement about part of a protocol should not be mistaken for a complete audit of every implementation and operational dependency. The technical report notes limitations and calls the release intermediate research. (Source : Anthropic — Technical report)
What builders should watch
The near-term opportunity is likely selective verification rather than proofs on every token of every chat. High-value evaluations or disputed outputs may justify extra compute and verification delay before ordinary interactive workloads do. Builders should ask for the precise model commitment, numerical format, supported context, tokens actually covered, proof size and time to verify, rather than accepting a single throughput figure.
Equally important is an independent reproduction. An open implementation makes that possible; it does not itself establish that the performance, cryptographic assumptions or integration are production-ready. FlashProve is best understood as infrastructure for an auditable future, not a turnkey authenticity stamp today.
FAQ
Does FlashProve reveal the weights?
The design aims to hide committed weights; Anthropic says the architecture is not hidden.
Does a valid proof mean the answer is correct?
No. It concerns the specified model computation, not factual accuracy or the safety of a downstream action.
Is the prototype ready for every agent workload?
Not established. The released demonstration has a short context and substantial reported proving overhead.
Is the code open source?
The released code, Lean proofs and documentation are Apache 2.0; the model weights used in the example have separate terms.
Further Reading
— The Agent Report