Anthropic Open-Sources FlashProve: Using zkSNARKs to Prove AI Response Provenance

Is the AI model really the one you claim it is? In scenarios involving model hosting, API calls, and open-weight distribution, this question has long lacked a verifiable answer. Anthropic's solution is FlashProve—an Apache 2.0 open-source zkSNARK prototype with a straightforward goal: prove that a given response truly came from a committed set of weights, without revealing the weights themselves.

What Problem Does FlashProve Solve

Large model inference has long existed in a state of "trust but cannot verify." When users call an API, they can only trust the model version and parameters the provider claims; when the open-source community distributes weights, recipients cannot confirm whether the other party's output was actually generated from those weights. Model fingerprints, watermarks, and behavioral feature comparisons are all indirect methods and cannot provide cryptographically definitive conclusions.

FlashProve takes the zero-knowledge proof approach. It transforms "this response was computed from these weights" into a verifiable mathematical proposition, and the verifier can judge its authenticity without accessing the weights. For scenarios requiring auditing of AI output provenance—such as compliance review, model tracing, and supply chain security—such primitives have foundational value.

zkSNARK stands for "Zero-Knowledge Succinct Non-Interactive Argument of Knowledge" and is a class of zero-knowledge proof constructions. It allows a prover to convince a verifier that they know some secret input satisfying a specific relation without revealing that input; the proof is small, verification is fast, and no multiple rounds of interaction between prover and verifier are required. Its "succinct" property is precisely the key to FlashProve compressing proof size to the order of 19 MB. zkSNARKs typically rely on cryptographic tools such as polynomial commitments and elliptic curve pairings; the larger the circuit scale, the higher the proof generation overhead—which is why it was previously difficult to cover large model inference workloads.

Weight commitment is a cryptographic binding mechanism: the model provider computes a short commitment value over all weights (similar to a hash digest but with hiding and binding properties) and publishes that commitment value without publishing the weights. Thereafter, any inference claiming to "use these weights" must be able to generate a proof consistent with that commitment value. The verifier only needs to hold the commitment value to confirm that the output corresponds to exactly the committed weights, without downloading or inspecting any single parameter of the weights. This shifts the trust anchor from "believing the provider's self-description" to "a mathematically verifiable commitment," and the commitment value is extremely small, making it easy to circulate in model distribution, version registration, and audit records.

Performance Data: Feasibility on a Single H100

Anthropic's published prototype metrics are noteworthy. FlashProve completes proofs for Llama 4 Maverick on a single H100 with a throughput of 110 tokens/second and a proof size of 19 MB.

The significance of these numbers is that they move zero-knowledge proofs from "theoretically feasible" into the "engineeringly usable" range. Previous verifiable inference schemes often paid huge costs in proof generation time or proof size, making it difficult to cover actual inference workloads. 110 tokens/second means proof generation speed is already approaching the output pace of some real services, and a 19 MB proof size is also within the range of being transmittable and storable. It should be noted that these are public data at the prototype stage, and there is still a distance to production-grade deployment.

Llama 4 Maverick is a mixture-of-experts (MoE) model in the Llama 4 series released by Meta, with hundreds of billions of parameters and a sparse activation architecture that invokes only a subset of experts in each forward computation. As the target model for the FlashProve prototype demonstration, it represents one of the larger and more structurally complex classes among current open weights. Choosing an MoE model as the proof target means the circuit needs to handle dynamic computation paths such as expert routing, which is more difficult than dense models; at the same time, the statement that proof is completed "on a single H100" indicates that the prototype does not rely on multi-GPU parallelism, and controlling the hardware threshold is part of its practicality narrative.

Technical Path and Open Strategy

FlashProve is released under the Apache 2.0 license, which is uncommon in Anthropic's product lineup. Choosing a permissive open-source license means researchers and enterprises can freely modify, integrate, and even commercialize it, which helps rapidly form a verifiable inference ecosystem.

From a design orientation perspective, FlashProve uses "weight commitment" as its trust anchor: the model provider first makes a cryptographic commitment to the weights, generates a proof during inference, and the verifier only needs to hold the commitment value to verify. This structure can be decoupled from existing model distribution processes and does not require changing the internal implementation of the inference engine, lowering the barrier to adoption.

The zkSNARK approach itself has inherent constraints. Proof generation incurs additional computational overhead, circuit design needs to adapt to different model architectures, and the weight commitment mechanism depends on the trade-off between trusted setup and transparent setup. As a prototype, FlashProve is more about verifying the engineering feasibility of this route than providing a complete production solution.

Trusted setup and transparent setup are two trade-offs in the initialization phase of zkSNARK systems. A trusted setup requires a group of participants to jointly generate public parameters; as long as one party is honest, security is guaranteed, but it introduces the assumption of a "one-time trust ceremony." A transparent setup requires no secrets and relies only on public randomness; its security assumptions are cleaner but usually bring larger proof size or higher verification overhead. Which one FlashProve's weight commitment mechanism specifically adopts directly determines the strength of its security model and engineering cost. This is also why the original text points out the "trade-off between trusted setup and transparent setup"; public information has not yet clarified its choice.

Impact on the Industry

FlashProve touches on the trust infrastructure of the AI supply chain. If the cost of verifiable inference continues to decline, several scenarios will benefit directly: model hosting platforms can prove to customers that they have not secretly swapped models; open-source model publishers can attach verifiable output credentials; and regulatory and audit processes gain a technical means that does not rely on provider self-description.

For Anthropic itself, open-sourcing such a cryptographic tool that does not directly conflict with its core business model can both accumulate influence in the verifiable AI field and promote industry discussion of model provenance standards. The real test lies in whether the prototype can subsequently be advanced to cover more model architectures and lower proof overhead.

Issues Still to Be Observed

FlashProve's public information is concentrated on one model and one set of performance metrics. Multi-model adaptability, proof performance under different precision settings, and the security assumptions of the commitment mechanism have not yet been fully disclosed. The bandwidth cost of a 19 MB proof size under large-scale concurrency scenarios also needs evaluation.

What is certain is that introducing cryptographic proofs into the large model inference pipeline has moved from a paper concept to a runnable prototype stage. Whether FlashProve will become a standard component is still unknown, but the question it raises—how to prove output attribution without exposing weights—will become an unavoidable foundational issue for verifiable AI.