Anthropic has released FlashProve, an open-source research prototype that produces cryptographic proofs of which model generated a response. On a 400B-parameter model, its research post says, proving takes “~70-95x the GPU time of running the model itself on vLLM, a common open-source library”.
As we read it, that overhead is a cost line. One H100 proves at around 110 tokens per second, and one commitment to the weights is good for about 16 million requests. Proving all of them would take about 41,000 H100-hours, by our arithmetic.
Business Pill · Verification Cost
An evergreen Business Engineer explainer on verification cost: something cheap to make is not always cheap to check. It teaches the general idea only and does not discuss FlashProve or Anthropic.
The key insight: Anthropic’s FlashProve proves which committed model produced a response at about 70-95 times the GPU time of serving it, on one H100 for a 400B-parameter model. One commitment covers about 16 million requests; proving them all would take about 41,000 H100-hours, by our arithmetic, while each check runs on a CPU.
The post, dated 2 November, describes a zkSNARK, a type of cryptographic proof, that lets a model provider “commit to a model and then prove that each response was produced by that model”. The proof hides the weights. It says “Claude has produced improvements on zkSNARKs for inference, building a system that is substantially faster than prior open-source systems”.
The release includes a technical report, a protocol description, a prover, a fast C++ verifier, a verifier written in Lean and Lean proofs for the top-level security statements, all “under the Apache 2.0 license”. The GitHub repository describes itself as “A research prototype for zero-knowledge proofs of AI inference. Not maintained.”
Roy Rinberg and Alex Allain of Anthropic lead the author list, with six collaborators including Alessandro Chiesa of EPFL and StarkWare.
FlashProve proving time per GPU as a multiple of stock vLLM’s GPU time, by vLLM workload: 20.1x against decoding at 512 streams, 71.4x against prefill of 24 windows at once and 93.0x against prefill at the highest load tried, on an integer model the size of Llama 4 Maverick on one H100. The authors say the multiples omit committing and serving and could be higher. Source: FlashProve protocol paper, Section 7.8; Anthropic research post, 2 November 2026.
What Was Posted on X
HOLY SHIT. Anthropic just unveiled FlashProve, a zero-knowledge system Claude helped build that can cryptographically prove an AI response came from the exact model weights claimed, WITHOUT revealing the weights. That means a router, cloud host or attacker can no longer quietly swap in a cheaper or tampered model without getting caught.
On Llama 4 Maverick 400B, one H100 proves 110 tokens/sec with ~19MB proofs, and anyone can verify them in seconds on a CPU. The ONLY earlier proof of this model took 14.3 HOURS for 1,000 tokens and produced a 93.6GB proof.
And this is wild: because Claude โoften makes decisions that are hard to evaluate,โ Anthropic formally proved FlashProveโs top-level security guarantees in Lean. Meanwhile, the technical paper itself was AI-generated, and Anthropic says it did NOT review it in detail.
Posted by @choblin29 on 3 November. The account says Anthropic unveiled FlashProve, a zero-knowledge system that proves an AI response came from the model weights claimed without revealing them, and that on Llama 4 Maverick one H100 proves 110 tokens a second with proofs of about 19MB that anyone can verify in seconds on a CPU. The post compares that with an earlier proof of the same model that, it says, took 14.3 hours for 1,000 tokens and produced a 93.6GB proof.
The Numbers in the Release
Anthropic measured the system on Llama 4 Maverick, a 400B-parameter mixture-of-experts model, using its public 4-bit weights. The prover runs on one H100 with 24 CPU cores. On a batch of 24 requests of 1,024 tokens, the online phase takes about 223 seconds, “which is 110 tokens per second”, and each proof is 18.78 MB.
Checking a proof needs no GPU. The post says it “takes 17 seconds on 24 threads”, after a one-time download of the commitment of about 6.5 MB. Committing to the weights runs once per model and takes about 39 minutes.
The protocol paper breaks the overhead down. Per GPU, proving takes 71.4 times the GPU time of stock vLLM for prefill of 24 windows at once, 93.0 times at the highest load tried and 20.1 times against decoding at 512 streams. The paper says the multiples “omit committing and the serving that exact match requires” and “could be higher”.
Who Pays for Proof
At the post’s measured rate of 223 seconds for 24 requests, one H100 spends about 9.3 seconds proving each 1,024-token request, by our arithmetic. The commitment is “good for about 16 million requests”.
Proving that many requests would take about 41,000 H100-hours and produce about 300 terabytes of proof files at 18.78 MB each, by the same arithmetic. That work sits with the prover.
As we read it, the checking side is light by design. The verifier “needs no GPU”, which is what lets an evaluator or regulator check a claim without the provider’s hardware. The system also proves “after-the-fact, for a subset of tokens”, rather than in line with serving, and the paper says each proof “checks one output token”.
The Router Problem
The post’s first example is commercial. A user today cannot check that responses came from the model a developer claims, “as opposed to one secretly substituted in by a routing service for cost reasons”.
It adds: “Clients who use a model through a third-party routing service want assurance that the tokens came from the model they paid for”. Evaluators have the same gap: “independent evaluators who test AI models before and after release need to know that the model they are evaluating is the model being served”.
The Pacing Hook
The executive summary names a policy use: such proofs “could contribute to a toolkit for verifying compliance with AI pacing requirements”. The post’s example is a provider required to “devote its hardware to inference” rather than training; a regulator could ask for certificates covering the requests served in a given period.
It states the limit plainly: “although this verifies that the hardware is serving inference, it does not establish that the hardware is not, e.g., training on the side”.
Anthropic’s Frontier Safety Roadmap set a goal to “develop a prototype by September 30, 2026 of provable inference”. The post says Anthropic met it through “a separate but related project, which signs our inference traffic and recomputes inference on a trusted server”, and that FlashProve pursues the same objective by a different method.
As we read the post, the release turns a trust question into a compute budget: the prover pays for proofs in GPU time, and the checker needs a CPU and a commitment of about 6.5 MB.
As we read the paper, the 70-95x range is a lower bound on the overhead rather than a production quote: the authors say the multiples omit committing and serving and could be higher.
Anthropic, Progress on provable inference for large language models
“Cryptographic proofs of inference solve this problem: they let a model provider commit to a model and then prove that each response was produced by that model”
Three Implications
FOR ROUTING SERVICES The post names a model “secretly substituted in by a routing service for cost reasons” as a case such proofs address, and says clients of third-party routing services want assurance that the tokens came from the model they paid for.
FOR EVALUATORS AND REGULATORS The post says a regulator could ask for certificates covering the requests served in a period and check them without the provider’s hardware; it also says this does not establish that the hardware is not training on the side.
FOR THE COST OF TRUST At the measured rate, proving one commitment’s 16 million requests would take about 41,000 H100-hours and about 300 terabytes of proof files, by our arithmetic; the post describes proving after the fact, for a subset of tokens.
The framework reads: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”
As we read it, FlashProve is a tool for that layer: a way for a provider to show evaluators, customers or regulators which committed model served a request without revealing the weights. The framework was published in June 2026 and does not discuss FlashProve.
The post describes a research prototype measured on Llama 4 Maverick’s public weights. It does not describe proofs attached to Claude responses, or a price for proofs.
The proof covers “an integer model under greedy decoding”, and the system proves “contexts of up to 1,024 tokens”. Our 41,000-hour figure assumes the measured batch rate holds for every request.
The paper is direct about review: “Under human direction, AI systems wrote this paper”, and “as far as we know, no person has checked any of these”. It lists earlier systems’ results “without ratios, because the machines, models and proved statements differ”.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Anthropic’s FlashProve proves a 400B-parameter model’s output at about 110 tokens per second on one H100, at about 70-95 times the GPU time of serving it. For one commitment’s 16 million requests, that is about 41,000 H100-hours of proving, by our arithmetic, while each check runs on a CPU in seconds.
95,000+ executives read Business Engineer for the AI strategy frameworks cited by ChatGPT, Claude, and Perplexity.
A note on sourcing. Quotations and measurements are from Anthropic’s research post of 2 November 2026 and the FlashProve protocol paper in the project’s GitHub repository. Per-request proving time, total H100-hours and proof storage are our arithmetic from the post’s figures.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
