---
title: Anthropic releases FlashProve, an open-source prototype that proves a response came from the exact model weights a provider committed to | ctxsec
url: https://ctxsec.com/items/anthropic-flashprove-provable-inference-moe-open-source
description: "Anthropic's FlashProve lets a model provider publish a short commitment that pins down one exact set of weights (without revealing them), then attach a proof to each response that anyone can check on a CPU. Anthropic demonstrated it on Llama 4 Maverick (400B-parameter MoE, 4-bit weights): one H100 generates proofs at about 110 tokens/second, with about 19 MB of proof per 1,024-token request, roughly 70-95x the GPU time of normal inference. Code, a C++ verifier, a Lean-verified verifier and Lean proofs of the top-level security claims are released under Apache 2.0. Anthropic says Claude did much of the design and implementation."
status: "official (Anthropic research post and open-source release, Nov 4); prototype"
published: 2026-11-04
---

> Anthropic's FlashProve lets a model provider publish a short commitment that pins down one exact set of weights (without revealing them), then attach a proof to each response that anyone can check on a CPU. Anthropic demonstrated it on Llama 4 Maverick (400B-parameter MoE, 4-bit weights): one H100 generates proofs at about 110 tokens/second, with about 19 MB of proof per 1,024-token request, roughly 70-95x the GPU time of normal inference. Code, a C++ verifier, a Lean-verified verifier and Lean proofs of the top-level security claims are released under Apache 2.0. Anthropic says Claude did much of the design and implementation.

[← AI](/ai) · [markdown](/items/anthropic-flashprove-provable-inference-moe-open-source.md)

official (Anthropic research post and open-source release, Nov 4); prototype

2026-11-04

### Anthropic releases FlashProve, an open-source prototype that proves a response came from the exact model weights a provider committed to

Why it matters for security: it is a path to checking that an API provider or reseller is serving the model it claims (not a cheaper or tampered one), which matters for routed or third-party model endpoints. It hides weights but not architecture, and the cost overhead keeps it a prototype for now.

Sources: [Anthropic: Progress on provable inference for large language models](https://www.anthropic.com/research/provable-inference) · [GitHub: anthropics/FlashProve](https://github.com/anthropics/FlashProve/)