FlashProve enables cryptographic verification of LLM inference outputs

Anthropic researchers and academic collaborators have released FlashProve, an open-source prototype that uses zero-knowledge proofs to verify large language model outputs. Published in November 2026, this system allows users to confirm that a response was generated by a specific set of model weights without exposing those weights or requiring significant computational resources for verification.

What happened

The team, including researchers from Anthropic, EPFL, MIT, and Succinct, introduced FlashProve to address growing trust issues in AI deployment. As models become integral to digital infrastructure, users face challenges verifying that the model serving them is the one they requested. Routing services might substitute cheaper models, or attackers could tamper with token streams. FlashProve provides a cryptographic solution where the provider generates a proof alongside the response, which the user can quickly verify.

This release marks progress toward Anthropic’s public goal of creating a prototype for provable inference by September 30, 2026. While the company previously met this goal through a different project involving trusted servers, FlashProve offers a software-only approach based on zero-knowledge succinct arguments of knowledge (zkSNARKs). The team released executable code, technical reports, and formal verification artifacts under the Apache 2.0 license to encourage community improvement.

The system demonstrates practical performance for large models. For Llama 4 Maverick, a 400-billion parameter mixture-of-experts model with 4-bit quantization, a single H100 GPU generates proofs at approximately 110 tokens per second. The resulting proof size is about 19 MB for a 1,024-token request. Although this process takes 70 to 95 times longer than standard inference using vLLM, it represents a significant speedup over prior open-source systems, which were orders of magnitude slower.

How it works

FlashProve relies on zkSNARKs, a cryptographic tool that allows a prover to convince a verifier that a computation was executed correctly without revealing any input data beyond the result. In this context, the "computation" is the forward pass of the neural network. The system operates in two phases. First, in an offline phase, the model provider publishes a commitment, which acts as a unique fingerprint for the specific model weights. This commitment pins down the exact weights while keeping them hidden.

In the online phase, when a user sends a prompt, the provider runs the model and generates a proof file. This file certifies that the committed model produced the specific output tokens for the given input. The user, acting as the verifier, checks this proof using the commitment, the prompt, and the response. Because the proof is succinct, verification is exponentially faster than re-running the model and can be done on a standard CPU in seconds. Crucially, the zero-knowledge property ensures the proof reveals nothing about the proprietary model weights.

To ensure the reliability of the cryptographic claims, the team used Lean, a formal verification language. They provided top-level auditable statements in Lean for the security guarantees, along with an interactive visualizer for the theorems. This approach counters the complexity of automated optimization by providing mathematically rigorous assurances that the protocol behaves as specified.

Key details

• FlashProve achieves proof generation speeds of ~110 tokens/second for Llama 4 Maverick (400B parameters) on a single H100 GPU.
• Proof sizes are approximately 19 MB per 1,024-token request, enabling efficient transmission and storage.
• The system uses 4-bit quantized weights and integer arithmetic during the prefill phase to optimize performance.
• Verification requires only the commitment, prompt, and response, allowing users to check validity without access to model weights.
• All code, Lean proofs, and documentation are released under the Apache 2.0 license to facilitate external audit and improvement.
• The solution is software-only, relying on computational hardness rather than trusted execution environments or specialized hardware.

Why it matters

For software engineers and technical leaders, FlashProve introduces a new layer of integrity to AI applications. It solves the problem of model substitution, where a third-party routing service might swap a premium model for a cheaper one. By attaching a cryptographic proof to each response, providers can offer verifiable guarantees to clients. This is particularly relevant for internal security teams who need to ensure that only approved, safe models are running in production environments, preventing rogue agents or compromised servers from serving malicious outputs.

The technology also has implications for regulatory compliance and AI pacing. Regulators could require providers to submit proofs that demonstrate hardware is being used for inference on approved models rather than for unauthorized training. This allows for oversight without exposing proprietary weights or requiring regulators to possess massive compute resources. Additionally, developers can use these proofs to demonstrate due diligence, such as proving that a specific frontier model scanned code for vulnerabilities, adding credibility to security claims.

What you can do

• Review the open-source FlashProve code and technical report to understand the implementation details of zkSNARKs for LLMs.
• Experiment with the provided C++ fast verifier and Lean provably correct verifier to test proof validation on your own infrastructure.
• Evaluate the trade-offs between proof generation overhead (70-95x inference time) and the security benefits for your specific use case.
• Consider how provable inference could integrate into your current AI routing or monitoring stack to prevent model substitution.
• Explore the Lean formalization artifacts to audit the mathematical foundations of the security guarantees provided by the system.
• Monitor further developments in zero-knowledge machine learning as the community builds upon this Apache 2.0 licensed foundation.