Anthropic FlashProve Releases Open-Source zkSNARK Tool for AI Output Verification

Anthropic released FlashProve on November 2, 2026, as an open-source research prototype that uses zkSNARKs to generate cryptographic proofs that an AI output originated from a specific committed set of model weights without exposing those weights. The system targets API providers and auditors who need to confirm model integrity amid concerns over model substitution or tampering. It addresses verification gaps that currently affect customer trust and regulatory compliance in AI services.

Technical Specifications and Performance Metrics

The release includes separate offline and online phases. In the offline phase a provider creates and publishes a 6.5 MB hiding commitment to the model weights, a process that takes roughly 39 minutes and supports about 16 million subsequent requests. In the online phase the prover attaches an 18.78–19 MB proof to each response, allowing any party to verify correctness on standard CPU hardware without access to the original weights or a GPU.

Tests on a 4-bit quantized version of Meta’s Llama 4 Maverick model, which has 400.7 billion total parameters and 17 billion active parameters per token, showed a single NVIDIA H100 GPU delivering 110 tokens per second in proving throughput when handling a batch of 24 requests over 223 seconds. CPU verification of a 1,024-token request completed in 17 seconds on 24 threads or 21 seconds on a single thread. The protocol supports only greedy decoding and caps context at 1,024 tokens.

Proving overhead ranges from 70 to 95 times the GPU time required for standard vLLM inference of the same prompts, with typical loads near 72 times and peak loads reaching 94 times. Soundness, completeness, and zero-knowledge properties were formally verified in Lean 4, with a soundness error bounded at roughly q/2^124 plus 2^−101 after q hash queries. The proof discloses nothing about model weights, intermediate activations, or mixture-of-experts routing decisions.

Background, Use Cases, and Current Limitations

Current AI APIs offer no reliable way for users to confirm which model generated a given response, leaving room for routing services to substitute cheaper models or for tampering to occur undetected. FlashProve complements trusted execution environments by providing a software-based verification path that works across any hardware. Potential applications include third-party audit of model claims, tamper detection in high-stakes deployments, and support for regulatory reporting that requires proof of model provenance.

The Apache 2.0 licensed repository at anthropics/FlashProve contains the prover implementation, a fast C++ verifier named cp_verify, a slower formally verified Lean verifier, the protocol specification, the technical report, and the Lean proof scripts. The project is labeled version 0.16.0 and is explicitly described as a non-maintained research artifact that does not accept external contributions.

Practical constraints include the high computational cost of proof generation, the 1,024-token context limit, and the requirement that providers publish fresh commitments before verification can begin. Verification also assumes the commitment identifier itself is trusted. Anthropic stated that the release aims to accelerate community work on provable inference without providing a timeline for production deployment.