Anthropic Open-Sources FlashProve for Verifiable AI Model Inference
Anthropic has released FlashProve, an open-source prototype enabling cryptographic verification of AI model outputs, addressing trust and transparency concerns in hosted AI services.
Anthropic, in collaboration with researchers from EPFL, MIT, and StarkWare, has open-sourced FlashProve, a prototype system designed to generate cryptographic proofs that a specific language model produced a particular output. This initiative aims to tackle a critical trust deficit in the use of hosted AI models, where users and evaluators currently lack the ability to definitively confirm which model generated a response or if the response was tampered with.
The FlashProve repository, available under the Apache 2.0 license, contains the prover, a fast C++ verifier, and a reference verifier written in Lean, a proof assistant. The Lean verifier was used to formally prove the protocol's completeness, soundness, and zero-knowledge properties, serving as a rigorous benchmark. The C++ verifier is intended for practical, day-to-day use, offering a balance between speed and verification accuracy.
Anthropic acknowledges that discrepancies may exist between the academic paper, the formal Lean protocol, and the implemented code. The team has not guaranteed perfect alignment across all three. Manual auditing of the Lean statements is necessary for full assurance, and the repository includes an interactive visualizer to aid this process. The prover component itself lacks formal tooling and relies on traditional auditing methods for security validation.
While the model weights are not included in the release, FlashProve was tested on Meta's Llama 4 Maverick, a 400 billion parameter Mixture-of-Experts (MoE) model. Users can obtain these weights separately under Meta's license. Running the prover requires a single 80 GB GPU with approximately 290 GB of host memory, as it efficiently streams weights in layer-sized segments, only accessing the roughly 17 billion parameters active per token.
Performance benchmarks indicate that the prover can process approximately 110 tokens per second on an H100 GPU with 24 CPU cores. A proof for a 1,024-token request is about 18.78 MB and takes roughly 17 seconds to verify on 24 CPU threads. The initial offline commitment step, performed once per model, takes about 39 minutes and supports millions of subsequent requests, with each request requiring a small commitment plus a proof.
Compared to running the same model using vLLM on eight H100 GPUs in FP8 precision, FlashProve introduced an overhead of approximately 72x per GPU during general runs and up to 94x at peak load. This overhead is a trade-off for the added security and verifiability it provides, ensuring that the AI's output can be reliably attributed to the intended model.
The ability to cryptographically prove AI model outputs is crucial for building trust in AI systems, especially as they become more integrated into critical applications. FlashProve's release as an open-source prototype is a significant step towards greater transparency and accountability in the rapidly evolving field of artificial intelligence, allowing developers and users to verify the integrity of AI-generated content.