What happened
Anthropic published FlashProve (with EPFL/MIT/StarkWare collaborators) on 2026-11-02, an open-source zkSNARK-based provable-inference system. It enables a client with no knowledge of the model weights to verify that each response was produced by the specific model claimed, at ~110 tokens/second proof generation on one H100 for a 400B MoE model (~70-95x the model's own vLLM inference time), with formal Lean proofs for the top-level security claims.
Why it matters
Provable inference directly mitigates the AI-inference integrity problem: a committer can prove that responses came from the claimed model, catching model substitution by routing services, token-stream tampering, and rogue/compromised inference servers serving malicious responses or hiding weight exfiltration. For AI deployments that depend on hosted or third-party inference, this is the first practical capability for verifying model provenance and detecting inference-server compromise.
Attack vector
This is a defensive research disclosure, not a vulnerability. It addresses the threat where an attacker or rogue agent compromises an inference server to exfiltrate weights, serve users malicious responses, or substitute a different model/tamper with the token stream. FlashProve gives a user with no weights access a short zkSNARK proof that a response came from the claimed model, so any deviation fails verification.
Affected systems
LLM inference serving (model providers, routers, third-party hosting); FlashProve / zkSNARK-based provable-inference prototype for a 400B MoE model (Llama 4 Maverick)
Mitigation
No patch required — this is a released capability. Anthropic published the protocol spec, executable prover/verifier code, and Lean-verified top-level guarantees under Apache 2.0. Adopters evaluating AI deployments should consider requiring integrity/attestation of the model served.