Anthropic releases FlashProve for provable LLM inference using zkSNARKs

Anthropic released FlashProve, an open-source prototype using zkSNARKs to cryptographically verify that a specific LLM generated a response, addressing model substitution and tampering risks.
On Llama 4 Maverick (400B-parameter MoE, 4-bit quantization), the prover runs on a single H100 GPU and 24 CPU cores, achieving 110 tokens/second with a proof size of 18.78 MB per 1,024-token request.
Verification requires no GPU, taking 17 seconds on 24 CPU threads or 21 seconds on a single thread, with a 6.5 MB commitment file.
The system provides formal security guarantees via Lean, including completeness, soundness, and zero-knowledge properties, though it does not hide model architecture or detect concurrent training.

Performance and Overhead

Proving overhead is 70-95 times the GPU time of standard vLLM inference for the same batch size.
The offline commitment generation takes approximately 39 minutes and remains valid for up to 16 million requests.
Efficiency is optimized by leveraging MoE structure, where prover work scales with active experts (~17B parameters) rather than the full 400B model.

Uses post-hoc proving rather than in-line, prioritizing security over real-time latency.
Compiles Interactive Oracle Proofs (IOP) into cryptographic proofs using hash functions for post-quantum security.
Supports only integer weights and greedy decoding; floating-point implementations and sampling decoding are not covered.

Context length is limited to 1,024 tokens, significantly shorter than frontier model windows.
Side-channel attacks via timing analysis are out of scope for this release.
Model architecture is not hidden, and the system cannot prove that hardware is not simultaneously used for training.