Anthropic open-sources FlashProve for cryptographic proofs of LLM inference

Anthropic and academic collaborators from EPFL, MIT, StarkWare and Succinct published FlashProve on 2 November 2026 (shared on X late on 3 November UTC), releasing an Apache 2.0 software prototype for provable LLM inference alongside a technical report and machine-checked Lean security theorems. Without trusted hardware enclaves, FlashProve uses zero-knowledge succinct arguments (zkSNARKs) built from interactive oracle proofs, code proximity tests and lookup arguments so a provider can prove a response came from specific committed weights without revealing those weights or which experts fired.

FlashProve splits verification into two stages and scales prover compute only with active mixture-of-experts parameters rather than total model size, streaming layer segments from ~290 GB of host RAM onto a single 80 GB H100 GPU. In a one-time 39-minute offline phase, the server publishes a ~6.5 MB cryptographic commitment valid across roughly 16 million requests. In the post-hoc online phase on 4-bit Llama 4 Maverick (400B total parameters, 17B active per token), one H100 GPU plus 24 CPU cores proves batches of 24 requests (1,024-token windows) in 223 seconds, or 110 tokens per second.

Each proof measures 18.78 MB and verifies on a client CPU with no GPU in 17 seconds across 24 threads (21 s single-threaded) using the C++ verifier, alongside a formally verified Lean verifier. Per GPU, proving still takes roughly 72 to 94 times longer than unverified FP8 vLLM inference, making FlashProve suited to statistical auditing, safety evaluations and tamper detection rather than inline real-time serving.