When you send a prompt to an AI service, you see only the words that come back. You cannot tell whether the provider used the model it advertised or quietly swapped in a smaller, cheaper one. FlashProve is a new open-source research project from Anthropic that tries to solve that problem with cryptography. The project’s GitHub page describes it as “a research prototype for zero-knowledge proofs of AI inference,” and adds that it is not maintained.

The problem it targets

According to the project’s technical report, a client has no guarantee that a provider uses the claimed model. The provider could use a smaller or weaker model, or even switch models between requests. Publishing the weights would in principle allow checking, but the report notes that most providers keep them secret, and most clients lack the resources to run the model themselves anyway.

How FlashProve works, in plain terms

The report describes a two-step approach:

  1. In an offline phase, the provider commits to the model’s weights using a short “hiding” commitment. Think of it as a fingerprint of the model that does not reveal the model itself.
  2. For each request, the provider proves that it correctly evaluated the committed model on the client’s input.

The proof is “zero knowledge,” meaning it reveals nothing about the weights, and “succinct,” meaning the client can check it much faster than running the model. The report says the verifier runs on ordinary consumer hardware and needs no GPU.

What it can do today

The authors say FlashProve works for a Mixture-of-Experts model, specifically Llama 4 Maverick, and runs on one GPU. Some of the numbers they report:

  1. Each proof is about 18.78 MB.
  2. Checking a proof takes about 17 seconds on 24 CPU threads, or 21 seconds on a single thread.
  3. A batch of 24 requests takes about 223 seconds to prove, which the report puts at 110 tokens per second across the batch.
  4. Proving requests one at a time takes 58 seconds each, but the throughput drops to 17.6 tokens per second.
  5. Compared with simply running the same job on vLLM, the report says proving takes about 72 times longer per GPU.

Those figures show why this is a research demonstration rather than something you could switch on for a chatbot tomorrow. Proving costs far more computing than answering.

The limitations, in the authors’ own words

The report has a candid limitations section, and it is worth reading closely:

  1. The technical paper itself was AI-generated, and the authors say they did not review it in detail. A carefully reviewed paper is promised later.
  2. The GPU prover code and the CPU verifier code were generated by AI from a Lean specification and are not proved equivalent to it.
  3. Zero knowledge is formally proved only when requests are proved one at a time, not yet in a batch.
  4. The system proves an integer version of the model under greedy decoding or fixed-seed sampling, so a reply from a normal floating-point setup could differ from what was proved.
  5. The prover runs on one GPU and does not yet support multi-GPU setups.

The report adds that mistakes in the prover code could not affect soundness, meaning a dishonest result still would not pass, but could affect completeness or leak information about the weights.

Why it matters

The idea behind FlashProve, being able to verify an AI answer without seeing the model, has uses well beyond this one project. Regulators, businesses and individual users all have reasons to want assurance that the model they are paying for is the model answering. The authors write that they encourage the community to pay “even more” attention to the crossover between cryptographic proofs and AI safety.

It is important to keep expectations realistic. The GitHub page labels it a research prototype and not maintained, and the authors chose to prioritize an early release over every possible optimization. This is a demonstration of what is possible, not a product.

What to watch next

Keep an eye on whether the reviewed paper arrives, whether the performance gap narrows and whether other groups build on the code. If proving costs fall, “provable inference” could become a standard option for services that need to show their work.

The bottom line

FlashProve is an early but concrete step toward AI answers you can verify rather than simply trust. It is slow, limited and openly unfinished, and that honesty is part of what makes it worth understanding.

*Sources: the FlashProve GitHub repository and its technical report, as linked above. Figures are as reported by the authors in November 2026.*

Image: Data center infrastructure in the United States by DOE/National Renewable Energy Laboratory (NREL) via Wikimedia Commons, Public Domain Mark 1.0