Provable inference explained: how Anthropic's FlashProve checks which AI model answered

When you send a prompt to an AI service, you trust that the reply came from the model you chose. Nothing today lets you prove it. Anthropic's FlashProve, an open-source research prototype described in a post dated November 2, 2026, tries to change that with a cryptographic proof: a short certificate that a specific, committed model produced a given set of output tokens, without revealing the model's weights. This explainer covers what that means, how it works in plain terms, and why it is not yet something you can use.

What is provable inference?

Provable inference means attaching a mathematical proof to an AI answer so a third party can check that it came from a particular model. Anthropic's post frames the problem directly: users "cannot check that the responses came from the specific model" they selected.

Two risks are named. Routing substitution is when a service quietly sends your request to a cheaper model than the one you are paying for. Token-stream tampering is when output is altered between the model and you. Anthropic also lists uses beyond fraud: regulators confirming which approved models run on which chips, independent evaluators confirming they are testing the served model rather than a special version, and text provenance.

How FlashProve works

The idea has three steps. First, the provider publishes a commitment, a fingerprint of the model weights. Making the commitment is a one-time cost, about 39 minutes per model in Anthropic's tests, and it remains valid for roughly 16 million requests. Second, for each reply the provider generates a proof that the committed weights produced those tokens. Third, the user checks the proof, which reveals nothing about the weights themselves.

The proof system is a zkSNARK, a kind of zero-knowledge proof that is short to check even when it was expensive to make. A client downloads about 6.5 MB for the commitment, plus one proof per request.

Anthropic wrote the key security guarantees as top-level theorems in Lean, a proof assistant, and released an executable Lean verifier. The code, proofs and documentation are Apache 2.0. Weights are not included; the test model is Meta's Llama 4 Maverick, a 400 billion parameter mixture-of-experts model with about 17 billion active parameters, which must be obtained under Meta's own license.

The numbers

Anthropic reports these figures for the prototype:

• Proving speed: about 110 tokens per second on one Nvidia H100.
• Proof size: about 18.78 MB per proof, described as about 19 MB for a 1,024-token request.
• Verification: 17 seconds on 24 threads, 21 seconds on one thread, with no GPU.
• Overhead: roughly 72 times the GPU time of the standard vLLM serving stack for a 24-request batch, and about 94 times at the highest load, cited as 70 to 95 times.
• Prior work: VerInf took 14.3 hours for 1,000 tokens on a DGX Spark, with a proof of 93.6 GB. zkLLM managed about 2.5 tokens per second on a 13B model.

Put plainly, the speedup against earlier open work is enormous, but proving still costs many times what serving does.

What it cannot do yet

Anthropic is direct about the limits.

• Greedy decoding only. The proofs cover an integer version of the weights and deterministic output. Sampled or floating-point outputs may diverge.
• Short context. Up to 1,024 tokens.
• One architecture. It assumes a mixture-of-experts design, which is visible. The weights are hidden; the architecture is not.
• After the fact. Proofs are generated for batches afterwards, not inline.
• Side channels. Attacks that read timing are out of scope.
• No formal tie between fast code and the proof. There is no formal guarantee that the optimized code matches the Lean protocol or the paper.

According to TechCrunch, as relayed by The Next Web, Anthropic has no plans to deploy it at Anthropic or other labs. Anthropic says a separate project, which signs traffic and rechecks it on a trusted server, met its own goal on verifying outputs. The company calls the post "intermediate progress, and not a completed research agenda."

Why it matters for the race

A recurring weakness in AI oversight is that outsiders must trust the lab about what was tested and what is served. We have covered that gap in evaluations, including METR's review of Anthropic's reports in our piece on METR's August review. If a proof system became cheap enough, an evaluator could demonstrate that a model they tested is the model customers use, and a regulator could check that a licensed model is the one on a given chip.

Much of the safety regime now being built assumes that kind of verification will exist. Anthropic's own roadmap, quoted in the post, said "We will develop a prototype by September 30, 2026 of provable inference," and an update on October 19 renamed the goal "inference verification." FlashProve is that prototype.

Our take

It is real cryptography on a real problem, with honest limits and open code, and it was built partly with Claude. It is also far from useful today: you cannot buy it, run it on a frontier model or use it on a chat answer. The numbers to watch are the overhead multiple and support for sampled output. Until those fall, the practical answer to "which model answered?" remains "trust the provider." The next steps worth watching are a lower overhead, a second lab implementing the same idea, and a regulator naming it in a rule.