Anthropic's FlashProve Lets Anyone Verify a Model Is Real — Without the Weights

Model-swapping has been a quiet failure mode in the AI API supply chain. A customer pays for a flagship, the request routes through a reseller, and the model actually doing the work can be a smaller one running behind a proxy. Without access to weights or the datacenter, a developer has had no way to prove what happened.

Anthropic has now open-sourced a cryptographic system, FlashProve, that changes that. Built with zero-knowledge researchers, it lets anyone run a pure-math check on a normal CPU and confirm that each token really came from the model that was committed to. Anthropic says the verification takes about 17 seconds on a consumer CPU, requires neither the model weights nor a GPU, and is backed by a formal proof in Lean 4.

How the Prove-Test-Verify Flow Works

FlashProve splits the pipeline into three stages.

• Offline fingerprint. Before a model ships, the provider spends about 39 minutes on a single H100 to encode the weights into a commitment ID and publishes it. The ID acts as a digital fingerprint of the weights: any single-parameter change makes it mismatch, but nobody can reverse-engineer the weights from it.
• Online proof. After each request, the provider's GPU emits a roughly 19MB cryptographic proof that the output was computed by the committed model.
• Client verification. Anyone holding the output runs cp_verify on a CPU and gets a yes/no verdict in about 17 seconds, with no weights and no GPU.

Under the hood it uses zkSNARKs. Each request is split into around 2,000 sumcheck sub-protocols so a verifier can spot-check like a teacher grading homework. The security assumptions rest only on the BLAKE2 hash function, not elliptic-curve algebra, which is what makes it quantum-resistant in practice. The same cryptographic approach has been battle-tested on L2 networks like Starknet.

Proving a 400-Billion-Parameter Model on One H100

The proof of concept targets Meta's Llama 4 Maverick, a 400-billion-parameter Mixture-of-Experts model that activates about 17 billion parameters per token. FlashProve exploits that: the prover's work scales only with the active parameters, cutting out over 95% of idle computation. To keep the routing decisions secret, the system hides which experts fired inside an indicator vector, and the verifier sums over all experts.

The 4-bit quantized weights weigh 232GB, well over a single H100's 80GB of memory. So the team keeps weights in host memory and streams segments into the GPU, encoding, hashing, and reducing each chunk on the fly, keeping only the small state that the next segment needs. One H100 therefore handles a 232GB model by consuming it piece by piece — roughly a 5,500x throughput gain over the naive approach.

95% of the Repository Is a Lean 4 Proof

The GitHub repo's language bar is unusual: C++ is 1.4%, Python 1.3%, CUDA 0.9% — and 95.2% (about 398MB) is Lean 4 math proofs. The 114-page protocol spec points to the reason on page 51: almost all of the engineering — the paper, the 23-page technical report, the C++ and CUDA code, and the near-400MB formal proof — was written by Claude itself. Tests, runs, comparisons, and code review were done by the model too.

Cryptographic code is the least forgiving corner of software: one flipped symbol or a missed random-mask can collapse the whole security argument. Because humans cannot review hundreds of millions of derived steps line by line, Anthropic delegated that judgment to the Lean 4 kernel, which mechanically checks every inference. The human scientists settled the top-level contract — six safety definitions — and the formal verifier enforces the rest:

• Completeness. If a provider runs the committed weights honestly, the proof passes with a false-rejection chance below one in a trillion.
• Knowledge soundness. If a provider substitutes a fake model or edits a single token, the chance of getting away with it is below 2 to the negative 100 — mathematically impossible.
• Zero knowledge. No matter how many times a client verifies, the proof never leaks the model weights.

The README is even written for agents first, opening with "built to be run by agents" and shipping with ready-made prompts and an AGENTS.md.

The Engineering Paradigm Shift

FlashProve is a concrete instance of a new pattern: AI builds the system, Lean verifies its truth. Human readers are past the point where they can audit a 400MB proof line by line, so the human role narrows to defining the boundary axioms while the model explores the reasoning and the formal verifier acts as the gatekeeper. It is the most safety-stringent contract on the road to superintelligence that either company has published so far.