anthropics/FlashProve

What it claims

FlashProve (version 0.16.0, Apache 2.0, unmaintained and closed to contributions) lets an AI provider prove which committed model produced a reply, without revealing the weights. It runs Llama 4 Maverick at full size with a 1,024-token context on one NVIDIA H100 80 GB. The prover reaches about 110 tokens/second of prefill at 24 requests per batch. Soundness is proved in Lean 4: a cheating provider escapes detection with probability about q/2^124 + 2^-101 after q hash queries. The theorem and instructions for checking it are in lean/THEOREM.md.

How it works

The provider publishes a commitment ID that binds it to one set of weights. Every published value that depends on the weights is masked, except for a declared list. For each reply, the provider's GPU produces a proof that the reply is the committed model's output. Anyone can check the proof on a CPU in seconds with cp_verify.

The security of a check depends on where each input to cp_verify comes from. The commitment ID must come from a party the user trusts, never from the server being checked or from files sent with the proof. The verifier builds the request file itself.

flowchart LR
  T[Trusted party] -->|commitment ID| V[cp_verify on CPU]
  U[Verifier builds request file] --> V
  P[Provider GPU] -->|reply tokens + proof| V
  P -.->|ID from server: not trusted| X[Do not use]
  V -->|exit 0| A[Accepted]
  V -->|exit 1| R[Rejected]
  V -->|exit 5, 14, 2-4, 15| N[No verdict]

How to use it

The README defines four routes:

• Verify a stored proof. Needs Linux, bash, g++ 13+ and under 2 GB RAM. The build takes 1 to 2 minutes and the check under 2 seconds.
• Toy proofs on CPU. Adds make and python3, about 1 minute.
• Small model. An 8-layer synthetic model on the GPU stack with 10 GB RAM. The build takes about 29 minutes and a run takes 23 to 30 seconds. The full-size synthetic variant (Maverick's shape, 1,001 tokens) needs 280 GB RAM and takes about 42 minutes.
• Real Maverick weights. Needs 330 GB RAM, 245 GB disk, Python 3.13 and a calibration set the user makes first. It downloads a 232 GB public 4-bit conversion and proves one token in hours.

The GPU stack is the only supported prover platform. It requires x86-64 Linux 4.14+ on a CPU with SHA extensions, one dedicated H100 80 GB, CUDA 13.2 Update 2 (nvcc 13.2.86) exactly, gcc/g++ 13 first on PATH, and local disks.

On minimal Ubuntu 24.04, route 1 runs as follows:

apt-get update && apt-get install -y --no-install-recommends g++ make python3 unzip
verifier/build.sh
bin/cp_verify examples/accepted-proof/config examples/accepted-proof/ivk examples/accepted-proof/example.req examples/accepted-proof/example.y examples/accepted-proof/example.proof -id "$(cat examples/accepted-proof/ID.txt)"

A successful build prints a line starting THE VERIFIER IS BUILT:. A successful check ends with YES and exit code 0. The general call is:

bin/cp_verify CONFIG_DIR PUBLIC_KEY_DIR REQUEST_FILE TOKEN_FILE PROOF_FILE -id COMMITMENT_ID

Results must be read from the exit code and the last line together:

• Exit 0 with YES means accepted under exact match. Exit 0 with WITHIN LIMITS: … means accepted within a clipped gap.
• Exit 1 (NO: <name>) means rejected, or a local fault.
• Exit 5 (NOT CHECKED) means no verdict.
• Exit 14 (NOT-A-VERIFICATION) means the call was invalid.

integrations/check_proof.py wraps the call and its comparisons. The GPU quickstart is examples/quickstart-gpu.sh. It can be silent for over 15 minutes and succeeds with a line starting quickstart-gpu: all steps ended as expected. CPU tests run with ./run_suite.py cpu "$D/work". Exit 3 from the suite means a false input was accepted, which should be reported under SECURITY.md.

The README is written to be run by a coding agent. It forbids running as root and forbids working around errors with sudo, chmod, rm or source edits.

Limits

The stored example uses a small model with synthetic weights. It shows only that the verifier works, not anything about a served model. Weight hiding is partial: values on the declared list are published unmasked. Before committing to secret weights, the README requires reading the Serving and provider-duties pages. A newer nvcc than 13.2.86 still builds but is unsupported. The prover runs only on a single dedicated H100. Known limits are listed in docs/limits.md, docs/limits-further.md and lean/LIMITS.md.