FlashProve can verify a model response, at the cost of a 19 MB proof

Anthropic has released FlashProve, an open source prototype for provable inference. A provider first makes a cryptographic commitment to a specific set of model weights. It can then attach a proof showing that this model produced the stated tokens for a given prompt.

A weight commitment binds one model to one response

The proof reveals neither the weights nor the intermediate computation. Anyone holding the commitment, prompt, response and proof can check the result without access to the model. This could expose model substitution behind an API, tampering with a token stream or a gap between the model evaluated by an auditor and the one served to customers.

Anthropic demonstrated the system on a 4 bit integer version of the 400 billion parameter Llama 4 Maverick. One H100 generated proofs at about 110 tokens per second. A proof for a 1,024 token request was 18.78 MB and took 17 seconds to verify on a 24 thread CPU.

Model audits could gain a verifiable receipt instead of a vendor promise

The practical value is greatest where model identity matters, rather than only output quality. A security evaluator could confirm that the model it tested was the one later served to customers. A company could also substantiate that an approved model version handled a sensitive task.

That changes the relationship between an inference provider and its customer. Today's API asks customers to trust the model name on an invoice. Provable inference could attach a machine verifiable receipt without forcing the provider to disclose its weights.

The prototype proves a narrower computation than a typical production API

FlashProve checks an integer model under greedy decoding. Ordinary inference using floating point arithmetic or sampling can diverge from the computation being proved. The fast C++ code is also not formally tied to the Lean specification, and Anthropic explicitly does not guarantee that the implementation, paper and formal model all match.

The cost is substantial. Proof generation consumed about 70 to 95 times as much GPU time as plain vLLM inference in Anthropic's measurements. It is also a post hoc system: it can detect a forged response after computation, but does not by itself prevent a user from receiving one first.

Production integration will determine whether the proof leaves the lab

The next step is to demonstrate proofs for production decoding, common architectures and the inference server that actually returns the response. Independent code review and costs at large traffic volumes will matter as well. Anthropic describes FlashProve as intermediate research and has announced no deployment in its own service or at another provider.

Lilith's verdict

FlashProve lets an auditor attach a cryptographic seal to a model response. For now, the seal is heavier than the letter and arrives after the recipient has opened it.