FlashProve: Anthropic's proof system lets a provider prove which model answered

When you call a model through an API relay, nothing proves the answer came from the official weights — a relay can silently swap in a cheaper model. FlashProve, open-sourced by Anthropic on October 30, 2026 (Apache-2.0, 771 stars as of November 4), gives that question a cryptographic answer: the provider publishes a commitment ID binding it to one set of weights (which stay secret), its GPU produces a proof for each reply, and anyone verifies with cp_verify on an ordinary CPU in seconds that the reply really came from the committed model. The protocol’s soundness is formally proved in Lean 4 — a cheater is caught except with probability about q/2^124 + 2^-101 after q hash queries, theorem and checking steps in lean/THEOREM.md. Chinese coverage put it more bluntly: relay services that swap models just lost their hiding place.

Core features

• Commit–Prove–Verify: a commitment binds the provider to weights → per-request proofs → verification needs no weights and no GPU.
• Demonstrated at scale: full Llama 4 Maverick with a 1,024-token context on a single NVIDIA H100, roughly 110 tokens/second of prefill at 24-request batches.
• Lean 4 formalization: soundness is a machine-checked theorem, not a paper argument, with the exception probability explicit at the 2^-101 scale.
• Masked by default: every published value depending on the weights is masked, except a declared list in docs/what-is-not-hidden.md.
• Built for agents: building, running and checking are deliberately shaped for a coding agent, with the repo describing exactly how to hand it over.

Typical use cases

• Trusted API relays and gateways: a third-party forwarder proves to customers it serves the committed model, not a downgraded swap.
• Model procurement audits: enterprises can demand proofs from vendors; verification costs one ordinary CPU.
• Open-weights ecosystems: fine-tuners prove their service actually runs the declared fine-tuned weights.

Quick start

The repo is a research artifact (v0.16.0, explicitly not maintained and not accepting contributions) aimed at a single-H100 environment; building and running are best handed to a coding agent per the README. Verification has no barrier — cp_verify runs on any plain CPU in seconds, no weights required.

Summary

FlashProve fits model relays, enterprises buying model services, and researchers working on inference trust; everyday end users gain nothing directly — it changes the trust structure on the provider side. Facts and limits: Apache-2.0, a Lean + Rust stack, and an explicit research-artifact status (no maintenance, no PRs), so productionization is up to the ecosystem; it demonstrates one model, Llama 4 Maverick, and a 1,024-token context far below commercial needs. The significance is directional: when proving “you’re running the real model” costs one CPU verification, the model-resale market loses its information asymmetry.