19 MB proves a 400B model reply at 72x cost

Anthropic's FlashProve proves a reply came from a specific 400-billion-parameter model — without showing anyone the weights. The headline numbers are 110 tokens per second, a 19 MB proof, and a 70–95x GPU overhead. I cloned the repo and audited what those numbers actually buy, because a proof of which model answered is not a proof that the answer is right, and the gap between those two things is the whole story.

First, the honesty box: I did not run the prover. It needs a single H100, ~290 GB of host memory, and the 232 GB 4-bit Llama 4 Maverick weights. What I did run is a full shallow clone of the released repo plus a line-by-line audit of Anthropic's own November 2 post, and every number below is either from that post or arithmetic on it.

What the repo actually contains 

$ git clone --depth 1 https://github.com/anthropics/FlashProve.git 30,873 files, 716 MB on disk lean/ 29,654 files, 450 MB prover/ 7.6 MB of source verifier/ 1.9 MB of source VERSION: 0.16.0 — "A research artifact: not maintained, not accepting contributions" — Apache 2.0

The shape of the repo tells you where the work went. The Lean formalization is 29,654 of the 30,873 files and 450 of the 716 MB. The prover and verifier sources combined are under 10 MB. This is a cryptography project wearing a machine-learning costume: the artifact is mostly machine-checked proofs about the protocol, not model code. That matches the post's own framing — top-level security properties (completeness, soundness, zero knowledge) are stated in Lean, and an interactive visualizer ships to help audit the statements themselves.

One more repo fact worth stating plainly: the README says the project is not maintained and not accepting contributions. Treat it as a published result to build on, not a dependency to adopt.

The numbers, checked

From Anthropic's evaluation section, on one H100 with 24 CPU cores, proving a batch of 24 requests (each a 1,024-token window) takes about 223 seconds at 110 tokens per second, and each proof is 18.78 MB. The verifier downloads a 6.5 MB commitment once, then checks a proof in 17 seconds on 24 threads (21 seconds on one thread).

My arithmetic on those figures:

proving per request: 223 / 24 = 9.29 seconds verification: 17 s (24 threads) / 21 s (1 thread) commitment lifetime: ~16 million requests per 39-minute offline commit overhead vs vLLM: ~72x per GPU (66–77 across runs), ~94x at highest load

Two observations fall out. First, verification (17 s) takes longer than the per-request share of proving (9.29 s) — the prover wins because it batches 24 requests on a GPU, while the verifier checks one proof on a CPU. "Cheap to check" is relative: cheap compared to running a 400B model, not cheap in absolute terms. Second, the commitment economics are the opposite of the per-request economics: 39 minutes of offline work buys ~16 million requests, so the fixed cost amortizes to nothing and the 72x per-request overhead is the entire price.

Now the comparison Anthropic wants you to see, against the previous system that proved the same model. VerInf proved Llama 4 Maverick at ~0.02 tokens per second with a 93.6 GB proof that took almost a day to verify. Against that:

speed: 110 / 0.02 = 5,500x faster proof size: 93,600 MB / 18.78 MB = ~4,984x smaller verify: ~1 day → 17 seconds

That is a genuine phase change, not an incremental improvement — and it reframes the "70–95x overhead" complaint. The overhead is measured against plain inference, the cheapest possible baseline. Measured against the previous way of proving anything at this scale, FlashProve is thousands of times better on every axis. Both statements are true; which one matters depends on whether you compare against serving or against proving.

What the proof does not cover

This is where I would push back on anyone pitching FlashProve as a trust cure-all. Anthropic's own limitations section lists four gaps, and each one bites:

  1. It proves an integer model under greedy decoding. The proof asserts that each checked token is the integer model's greedy choice. A reply from a floating-point implementation, or one produced with sampling, can depart from the proved computation at some position. The post says the integer version is empirically close to floating-point inference — but "close" is not "the same computation," and adversarial prompts are explicitly not covered.

  2. The architecture is not hidden. The proof hides weights, intermediate values, and which experts ran. It does not hide that the model is a mixture-of-experts model with this structure. A provider wanting to hide architecture needs a different system.

  3. Contexts cap at 1,024 tokens. Real chat contexts run to hundreds of thousands or millions of tokens. FlashProve proves a window, not your conversation.

  4. It is post-hoc, not inline. Proofs are generated after the fact, for a subset of tokens, by recomputation. That is a deliberate design choice — inline proving would have to be ultra-fast and would trade security for speed — but it means a proof arrives with delay, and only for tokens someone chose to prove.

And the most important limitation is not technical at all: a valid proof says the committed model produced these tokens. It says nothing about whether the tokens are correct, safe, or unbiased. A faithfully proved hallucination is still a hallucination. If you are an evaluator, that distinction is the product: FlashProve lets you confirm you evaluated the model you think you evaluated, which is a real and previously unsolved problem. If you are a user hoping for a "verified true" badge on answers, this is not that.

The one-line verdict

FlashProve moves provable inference from "impossible at frontier scale" to "expensive but real": 110 tokens per second, 19 MB proofs, 17-second verification, at 72x the GPU cost of just serving. The price is the point — 72x is what integrity costs when you refuse to trust the server — and the open question is not whether the cryptography works, but whether anyone will pay 72x for it outside audits and regulated evaluations.

Sources: Anthropic, "Progress on provable inference for large language models" (November 2, 2026) — https://www.anthropic.com/research/provable-inference . Repo audit: shallow clone of github.com/anthropics/FlashProve, November 4, 2026 (HEAD 9e2bdd8, October 30). All derived figures are arithmetic on Anthropic's published numbers; I did not run the prover (see honesty box above).