Anthropic released FlashProve on November 4, 2026, a research prototype that uses zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs) to generate a cryptographic proof that a specific AI model produced a given response. The offline phase commits to model weights in approximately 39 minutes on a single H100 GPU. The online phase proves each request batch, with verification taking about 17 seconds on a 24-thread CPU. All code and Lean formal proofs are released under Apache 2.0.
What FlashProve does
The system works in two stages. In the offline phase, the model's weights are committed to a verifiable structure. During the online phase, every inference generates a proof that the same committed model processed the input and produced the output. A verifier with the proof and the model commitment can confirm authenticity without re-running inference.
The demo uses Meta's Llama 4 Maverick. The practical result: a user or regulator can confirm that a specific, unmodified model served a request. A tampered model, a model substituted mid-operation, or a service routing requests to a different model than advertised would fail verification.
Why this matters for AI security
Model substitution attacks are an underappreciated threat vector. A service that claims to run a safety-tested model but routes sensitive queries to an uncensored or adversarially modified variant is currently undetectable without FlashProve-style attestation. Organizations deploying AI in regulated workflows (healthcare, legal, financial) have no current mechanism to audit which model processed a transaction. FlashProve provides a foundation for that audit trail.
The Apache 2.0 release means defenders and auditors can build on the protocol immediately. The 1,024-token context cap and approximately 70x proving overhead over raw inference are significant barriers to production deployment at scale. These are not reasons to dismiss the work: they are the starting point for optimization, and the cryptographic foundation is in place.
What to watch
Three developments will signal when FlashProve transitions from research to production-ready: context window expansion beyond 1,024 tokens, proving overhead reduction to under 10x, and adoption by at least one major AI API provider as an optional attestation mode. Watch for follow-on work from Anthropic's safety team and from the academic zkML community.
Action items
- Review the FlashProve paper and Apache 2.0 codebase at the Anthropic research page (anthropic.com/research/provable-inference) if your organization operates AI in regulated or auditable workflows.
- Track the zkML field. The overhead will drop. When it does, procurement teams and compliance officers will want to know whether AI vendors can offer proof of model identity.
- If you are building AI tooling, include model version and attestation metadata in your audit logs now, even without zkSNARK proof. FlashProve will make those logs verifiable when overhead is acceptable.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss AI attestation strategy or integrating provable inference into regulated workflows.