Anthropic released FlashProve on November 2, a research prototype for checking whether an AI response matches a specific model's computation without exposing its weights. The announcement addresses a practical trust problem for customers buying access through model providers or routers. The release offers code to study, with substantial limits on the computation it can certify.
The repository labels version 0.16.0 an Apache 2.0 research artifact that is not maintained and is not accepting contributions. This is documentation-based reporting. MrKeyoor has not built the verifier or reproduced the GPU results.
The fingerprint needs a trusted source
The provider first publishes a cryptographic commitment that binds it to particular weights. It then produces a proof for a response, which a user can check without downloading those weights. The repository's verification instructions add an essential condition: obtain the commitment ID from a trusted party, rather than the server being checked or the files accompanying its proof.
That condition gives developers a concrete integration question: who supplies the identity against which the answer is checked? Accepting a fingerprint from the same untrusted server would leave that identity unresolved. The repository also distinguishes its stored example, which uses synthetic weights, from evidence about an actual served model.
Proof generation still carries a large bill
On the performance page, the authors compare proving a batch of 24 requests with FP8 Llama 4 Maverick running through vLLM on eight H100 GPUs. Normalized per GPU, proving took about 71 times as long as the corresponding prefill computation, and about 93 times as long at the highest vLLM load tested. These are the project's reported figures, not MrKeyoor benchmarks. The page says its run records are absent from the repository and the cost ratios cannot be reproduced from the supplied files.
The announcement describes proving after inference rather than during it. Developers would still need to budget for the separate computation alongside the inference they already buy.
What an accepted proof means
Anthropic's limitations narrow the guarantee to an integer version of the model under greedy decoding, which chooses the highest-scoring next token. Floating-point execution or sampled output can diverge from that computation. The supported context is only 1,024 tokens. The company also says the fast executable code has no formal guarantee of matching its Lean specification.
For developers assessing the release, the next useful evidence is a reproduced run with the exact model and decoding rules they intend to serve. Longer contexts and audited agreement between the executable code and formal protocol would address limits Anthropic itself identifies. Until then, an accepted proof answers a tightly specified computation question; it cannot establish that the answer is factually correct.