{"schema":"sanctity-signal/0.2","record_type":"signal","id":"anthropic-flashprove-e073","domain":"labs","drop_id":"signal-e073","occurred_at":"2026-11-02","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"Anthropic","action_type":"publication of an open-source zero-knowledge system, with code, protocol specification and machine-checked security proofs, that proves a response came from committed model weights","observed":"Anthropic's Frontier Red Team published its provable inference work on November 2, 2026, which we read at anthropic.com, with the code at github.com/anthropics/FlashProve. The release is under Apache 2.0 and contains a blog post, a technical report, a protocol specification, a prover, a C++ verifier, a Lean verifier, and Lean proofs of the top-level security statements with an interactive visualiser. The method is a zero-knowledge succinct argument: a provider commits to one set of weights, publishes a commitment identifier, then proves that each response came from the committed model without revealing the weights. The demonstration runs Llama 4 Maverick, a 400 billion parameter mixture-of-experts model with about 17 billion parameters active per token, using a third-party 4-bit conversion; the weights are not included. The prover uses 1 H100 graphics processor, 24 processor cores and about 290 gigabytes of host memory. Throughput is about 110 tokens a second, with a batch of 24 requests taking about 223 seconds. Each proof is about 18.78 megabytes. Overhead is about 72 times the graphics processor time of running the same batch on vLLM, 66 to 77 times across runs, and about 94 times at the highest load tested. The one-off weight commitment takes about 39 minutes and covers about 16 million requests before recommitment. Verification takes about 17 seconds on 24 threads, 21 seconds on 1, and the client downloads about 6.5 megabytes. Anthropic lists its own limits: the C++ verifier is not formally verified; proofs cover an exact integer version of the weights under greedy decoding, so floating point or sampled outputs may diverge; the architecture is not hidden; timing side channels are out of scope; the context limit is 1,024 tokens; and proving is post-hoc on batches. Anthropic calls the work intermediate progress and not a completed research agenda, and announces no production deployment. The systems it compares against, VerInf and DeepProve, run at about 0.02 and 1.4 to 2.9 tokens a second.","evidence":{"status":"verified","note":null,"sources":[{"role":"primary","label":"Anthropic, Provable inference, Frontier Red Team, published Nov 2, 2026","url":"https://www.anthropic.com/research/provable-inference"},{"role":"primary","label":"Anthropic, FlashProve repository, version 0.16.0, Apache 2.0","url":"https://github.com/anthropics/FlashProve"},{"role":"corrob","label":"AlphaSignal: FlashProve cryptographically proves which AI model answered you, Nov 2026","url":"https://alphasignal.ai/news/anthropic-s-flashprove-cryptographically-proves-which-ai-model-answered-you"},{"role":"corrob","label":"Gigazine: Anthropic has developed FlashProve, a system that proves output came from a specific model, Nov 4, 2026","url":"https://gigazine.net/gsc_news/en/20261104-anthropic-flashprove/"}]},"strength":{"cost":"High","commitment":"Medium","reversibility":"High","persistence":"Years","rationale":"Cost is high in engineering: a prover, 2 verifiers, a protocol specification and machine-checked proofs of the security statements are months of specialist work, and the compute behind the demonstration is not cheap. Commitment is medium, because publishing a prototype under Apache 2.0 commits Anthropic to nothing about its own service, and the repository is marked not maintained. Reversibility is high: the team can drop the line of work tomorrow and lose nothing but code it has already given away. Persistence is years, because open code and a published protocol outlive the group that wrote them."},"shift":{"prior":"You trusted a provider's word about which model served your request.","action":"Anthropic's Frontier Red Team published its provable inference work on November 2, 2026, which we read at anthropic.com, with the code at github.com/anthropics/FlashProve. The release is under Apache 2.0 and contains a blog post, a technical report, a protocol specification, a prover, a C++ verifier, a Lean verifier, and Lean proofs of the top-level security statements with an interactive visualiser. The method is a zero-knowledge succinct argument: a provider commits to one set of weights, publishes a commitment identifier, then proves that each response came from the committed model without revealing the weights. The demonstration runs Llama 4 Maverick, a 400 billion parameter mixture-of-experts model with about 17 billion parameters active per token, using a third-party 4-bit conversion; the weights are not included. The prover uses 1 H100 graphics processor, 24 processor cores and about 290 gigabytes of host memory. Throughput is about 110 tokens a second, with a batch of 24 requests taking about 223 seconds. Each proof is about 18.78 megabytes. Overhead is about 72 times the graphics processor time of running the same batch on vLLM, 66 to 77 times across runs, and about 94 times at the highest load tested. The one-off weight commitment takes about 39 minutes and covers about 16 million requests before recommitment. Verification takes about 17 seconds on 24 threads, 21 seconds on 1, and the client downloads about 6.5 megabytes. Anthropic lists its own limits: the C++ verifier is not formally verified; proofs cover an exact integer version of the weights under greedy decoding, so floating point or sampled outputs may diverge; the architecture is not hidden; timing side channels are out of scope; the context limit is 1,024 tokens; and proving is post-hoc on batches. Anthropic calls the work intermediate progress and not a completed research agenda, and announces no production deployment. The systems it compares against, VerInf and DeepProve, run at about 0.02 and 1.4 to 2.9 tokens a second.","update":"The claim can be checked by anyone, on an ordinary processor."},"inference":{"established":["Proofs run at about 110 tokens a second on 1 graphics processor.","Each proof is about 19 megabytes and verifies in seconds.","Code, protocol and machine-checked proofs are released under Apache 2.0."],"unknown":["That any provider will offer this. Anthropic announces no product.","Coverage of sampled outputs. Proofs assume exact integer greedy decoding.","That the fast verifier matches the formal one. It is unverified."]},"narrative":{"hook":"Anthropic open-sourced a way to prove which model answered you, without showing its weights.","plain":"FlashProve, published November 2 and carded late, generates a cryptographic proof for each reply. Caveat: it costs 70 to 95 times the computing and stops at 1,024 tokens.","story":["A provider can quietly serve a cheaper model than the one you pay for, and nobody outside could tell. A proof makes the swap detectable without exposing the weights. The overhead means nobody runs this in production yet. What changed is that it is now possible at frontier scale at all."],"trail":[{"d":"SEP 30","t":"Anthropic's own roadmap goal of a provable inference prototype falls due, met through a separate project that signs inference traffic and recomputes it on a trusted server."},{"d":"OCT 19","t":"Anthropic renames the goal inference verification, which it says is broader than provable inference."},{"d":"NOV 2","t":"FlashProve is published with code, a technical report, a protocol specification and machine-checked proofs, under Apache 2.0."},{"d":"NOV 2","t":"The same day, Anthropic's amended S-1 discloses it may imminently cross its own acceleration threshold. Edition 070 carded that and missed this."},{"d":"NOV 4","t":"Coverage reaches us 2 days late, which is why this card is dated November 2 and says so plainly."},{"d":"Reacts","r":true,"t":"Every provider serving models through an interface nobody can inspect; buyers who pay for a named model; regulators drafting model identity rules; the research groups behind VerInf and DeepProve; cloud resellers; and the Chinese laboratories Anthropic accused in September of routing customer requests to Claude."}],"glossary":[{"term":"Zero-knowledge proof","def":"A proof that a statement is true which reveals nothing else. Here it shows a reply came from specific weights without showing those weights."},{"term":"Commitment","def":"A short published fingerprint of a model's weights. It binds the provider to one model without publishing the model."},{"term":"Lean","def":"A language in which a proof is checked by a computer rather than trusted. Anthropic published machine-checked proofs of its security claims."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"Verification just became feasible","text":"From about 0.02 tokens a second to 110 moves this out of theory.","abstain":false},{"id":"b","label":"One red team's side project","text":"An unmaintained prototype, 1,024 tokens, no product behind it.","abstain":false},{"id":"c","label":"A marker laid before the rules","text":"Publish the protocol and the proofs before anyone legislates what verification means.","abstain":false},{"id":"d","label":"The field's normal next step","text":"Zero-knowledge machine learning has advanced for years. This is the next paper.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"Any provider offers proofs of model identity to customers, or an independent group reproduces FlashProve above 1,024 tokens of context or below 10 times overhead, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"},{"linked_interpretation":"a","direction":"weakens","observable_event":"No third party publishes a reproduction or a fork with substantive changes, and Anthropic publishes no further inference verification work, by June 30, 2028.","window_end":"2028-06-30","state":"unresolved"}]}