FlashProve verifies which model answered, at up to 95 times the GPU time

Anthropic has shown that cryptographic inference proofs can reach a model with 400 billion parameters. FlashProve lets a user verify a response against a published commitment to the weights without receiving the weights themselves.

A proof for a 400 billion parameter model fits in 18.78 MB

FlashProve has two phases. The provider first commits to a specific set of model weights. After inference, it produces a zkSNARK proving that the given input and committed model led to the checked token.

Anthropic tested a public 4-bit version of Llama 4 Maverick. One H100 with 24 CPU cores handled a batch of 24 requests in about 223 seconds, or 110 tokens per second. Each proof was 18.78 MB and verification took 17 seconds on 24 threads or 21 seconds on one thread. The code, specification and Lean proofs are released under Apache 2.0.

Auditors can check the model without accessing its weights

For customers of model routers, the important property is that a provider can demonstrate which model actually served a request. The same mechanism could help independent evaluators or auditors who lack the compute or permission to run a proprietary model themselves.

FlashProve separates trust in a commercial claim from trust in a cryptographic proof. It does not say whether an answer is true or safe. It establishes the origin of a computation relative to particular weights and an input.

The prototype checks a different world from a normal chatbot

The performance comes with strict conditions. Proofs are generated post-hoc, the context is limited to 1,024 tokens and the main benchmark checks one token. It covers an exact integer model under greedy decoding, while production services commonly use floating point and sampling.

Proving consumed roughly 70 to 95 times the GPU time of the compared vLLM inference. Anthropic also says the technical report was AI-generated and not reviewed in detail. The formal Lean specification does not yet prove equivalence with the fast C++ and GPU code.

Reproduction will decide whether this becomes an audit layer

The next test is independent reproduction of the performance and an audit of the link between the Lean specification and executable code. Deployment also needs longer contexts, common sampling methods and much lower costs.

FlashProve has already moved the boundary of what can be proved for a large MoE model. Integration into real inference operations will decide whether the cryptographic experiment becomes a usable receipt for consequential computation.

Lilith's verdict

FlashProve can attach a cryptographic receipt to a model response. For now, that receipt weighs 18.78 MB and keeps the register busy up to 95 times longer than the kitchen.