Anthropic Releases FlashProve for Cryptographic AI Inference Proofs

What happened

Anthropic released FlashProve on November 2, 2026: an open-source research prototype that operates with cryptographic proofs to show a language-model response came from committed weights without revealing them. A high-quality answer does not establish which model produced it: a routing service could substitute another system, an evaluator could receive a different model from the one intended for testing, or an attacker could alter the token stream. Anthropic is an artificial intelligence company based in San Francisco.

During an offline phase, the provider publishes a short commitment that identifies one exact set of weights while keeping them secret. For completed prompt-and-response pairs, the system produces a proof that the output tokens (the small pieces of text a model reads and writes) are the committed model’s output.

Checking a proof should reveal neither the weights nor intermediate computation values. The company reported proof generation at 110 tokens per second for Meta’s Llama 4 Maverick.

The work addresses a verification gap in hosted AI. Checking by rerunning the model is impractical for users when weights are private and the hardware requirements are substantial.

Binding Responses to Hidden Weights FlashProve operates with a zero-knowledge succinct argument of knowledge, or zkSNARK, in a software-only design rather than depending on trusted hardware. Anyone holding the commitment, prompt and reply can check the proof without access to the weights.

The intended properties are completeness, soundness, zero knowledge and succinctness. An honest proof should be accepted, while certifying a false statement should require breaking widely believed cryptographic assumptions.