Confirmed 2 Nov 2026 · Labs A one-minute read

Anthropic open-sourced a way to prove which model answered you, without showing its weights.

FlashProve, published November 2 and carded late, generates a cryptographic proof for each reply. Caveat: it costs 70 to 95 times the computing and stops at 1,024 tokens.

Until now

You trusted a provider's word about which model served your request.

Now

The claim can be checked by anyone, on an ordinary processor.

Why it matters

A provider can quietly serve a cheaper model than the one you pay for, and nobody outside could tell. A proof makes the swap detectable without exposing the weights. The overhead means nobody runs this in production yet. What changed is that it is now possible at frontier scale at all.

Established

Proofs run at about 110 tokens a second on 1 graphics processor.
Each proof is about 19 megabytes and verifies in seconds.
Code, protocol and machine-checked proofs are released under Apache 2.0.

Not established

That any provider will offer this. Anthropic announces no product.
Coverage of sampled outputs. Proofs assume exact integer greedy decoding.
That the fast verifier matches the formal one. It is unverified.

The five-minute readThe record, the timeline, the weight and 4 sources

The record

Anthropic's Frontier Red Team published its provable inference work on November 2, 2026, which we read at anthropic.com, with the code at github.com/anthropics/FlashProve. The release is under Apache 2.0 and contains a blog post, a technical report, a protocol specification, a prover, a C++ verifier, a Lean verifier, and Lean proofs of the top-level security statements with an interactive visualiser. The method is a zero-knowledge succinct argument: a provider commits to one set of weights, publishes a commitment identifier, then proves that each response came from the committed model without revealing the weights. The demonstration runs Llama 4 Maverick, a 400 billion parameter mixture-of-experts model with about 17 billion parameters active per token, using a third-party 4-bit conversion; the weights are not included. The prover uses 1 H100 graphics processor, 24 processor cores and about 290 gigabytes of host memory. Throughput is about 110 tokens a second, with a batch of 24 requests taking about 223 seconds. Each proof is about 18.78 megabytes. Overhead is about 72 times the graphics processor time of running the same batch on vLLM, 66 to 77 times across runs, and about 94 times at the highest load tested. The one-off weight commitment takes about 39 minutes and covers about 16 million requests before recommitment. Verification takes about 17 seconds on 24 threads, 21 seconds on 1, and the client downloads about 6.5 megabytes. Anthropic lists its own limits: the C++ verifier is not formally verified; proofs cover an exact integer version of the weights under greedy decoding, so floating point or sampled outputs may diverge; the architecture is not hidden; timing side channels are out of scope; the context limit is 1,024 tokens; and proving is post-hoc on batches. Anthropic calls the work intermediate progress and not a completed research agenda, and announces no production deployment. The systems it compares against, VerInf and DeepProve, run at about 0.02 and 1.4 to 2.9 tokens a second.

How it got here

Sep 30
Anthropic's own roadmap goal of a provable inference prototype falls due, met through a separate project that signs inference traffic and recomputes it on a trusted server.
Oct 19
Anthropic renames the goal inference verification, which it says is broader than provable inference.
Nov 2
FlashProve is published with code, a technical report, a protocol specification and machine-checked proofs, under Apache 2.0.
Nov 2
The same day, Anthropic's amended S-1 discloses it may imminently cross its own acceleration threshold. Edition 070 carded that and missed this.
Nov 4
Coverage reaches us 2 days late, which is why this card is dated November 2 and says so plainly.

Who has to react

Every provider serving models through an interface nobody can inspect; buyers who pay for a named model; regulators drafting model identity rules; the research groups behind VerInf and DeepProve; cloud resellers; and the Chinese laboratories Anthropic accused in September of routing customer requests to Claude.

What to watch

Would strengthen itAny provider offers proofs of model identity to customers, or an independent group reproduces FlashProve above 1,024 tokens of context or below 10 times overhead, by December 31, 2027.
Would weaken itNo third party publishes a reproduction or a fork with substantive changes, and Anthropic publishes no further inference verification work, by June 30, 2028.

Why it weighs this much

Signal strength

CostHigh

CommitmentMedium

ReversibilityHigh

PersistenceYears

Cost is high in engineering: a prover, 2 verifiers, a protocol specification and machine-checked proofs of the security statements are months of specialist work, and the compute behind the demonstration is not cheap. Commitment is medium, because publishing a prototype under Apache 2.0 commits Anthropic to nothing about its own service, and the repository is marked not maintained. Reversibility is high: the team can drop the line of work tomorrow and lose nothing but code it has already given away. Persistence is years, because open code and a published protocol outlive the group that wrote them.

The words

Zero-knowledge proof: A proof that a statement is true which reveals nothing else. Here it shows a reply came from specific weights without showing those weights.
Commitment: A short published fingerprint of a model's weights. It binds the provider to one model without publishing the model.
Lean: A language in which a proof is checked by a computer rather than trusted. Anthropic published machine-checked proofs of its security claims.

Sources

Your call

Which explanation do you believe?

A call is final. Other people's calls show after yours.