anthropics/FlashProve

What it is

FlashProve is a research artifact for zero-knowledge proofs of AI inference: an AI provider commits to a set of secret weights, produces a per-reply proof on a GPU, and anyone can verify that proof on an ordinary CPU in seconds with cp_verify, without seeing the weights What it is. The commitment ID is the anchor for the check, and everything that depends on the weights is masked except a declared list what is not hidden.

It runs Llama 4 Maverick at full size with a 1,024-token context on a single NVIDIA H100, reaching roughly 110 tokens/second of prefill at 24 requests per batch What model it runs Performance. Protocol soundness is proved in Lean 4: a provider passing off a different model's output is caught except with probability about q/2^124 + 2^-101 after q hash queries What is proved THEOREM.md.

This is for people studying the protocol, checking the proof artifact, or building verification into a workflow, not for production serving.

Quick start

Route 1 is the smallest complete path: build the verifier and check the stored example proof.

Requirements: Linux with bash, g++ 13+, and under 2 GB RAM. On minimal Ubuntu 24.04 the dependencies are installed as root with apt-get update && apt-get install -y --no-install-recommends g++ make python3 unzip Hardware and software. Run everything from the repository root as an ordinary user, never as root or under sudo For agents.

verifier/build.sh

The build is silent for 1–2 minutes, then prints a line starting THE VERIFIER IS BUILT: and exits 0 Build the verifier. A line starting build.sh: note: is a warning to quote in your report README lines 79–81.

Then check the stored proof:

bin/cp_verify examples/accepted-proof/config examples/accepted-proof/ivk examples/accepted-proof/example.req examples/accepted-proof/example.y examples/accepted-proof/example.proof -id "$(cat examples/accepted-proof/ID.txt)"

Expect YES as the last line and exit code 0. The example uses a small model with synthetic weights, so it shows only that the verifier works, not that a served model was actually the committed one README lines 94–96.

To verify a real proof, pass a config directory, public key directory, request file built yourself, token file, proof file, and the commitment ID; obtain that ID from a party you trust, never from the server being checked or from files shipped with the proof Verifying a real proof Verify a proof. Read the exit code together with the last line.

Running the prover

The prover needs an x86-64 Linux 4.14+ CPU with SHA extensions, one otherwise-idle NVIDIA H100 80 GB, CUDA 13.2 Update 2 (nvcc 13.2.86) on PATH, gcc/g++ 13 first on PATH, and local-disk repository and work directories Hardware and software. The pip lines to install the compiler are in the prover build notes prover build.

examples/quickstart-gpu.sh builds cp_verify, cp_commit and cp_prove, then commits, proves one 64-token request and verifies it Prove on a GPU. It can stay silent for over 15 minutes and logs to quickstart-gpu.log. Success is exit code 0 and a line starting quickstart-gpu: all steps ended as expected; every Compiled by line should end in release 13.2, V13.2.86, and newer nvcc is unsupported README lines 113–115.

Constraints and limits

• The repository is a research artifact, not maintained and not accepting contributions README lines 1–4.
• The prover supports only the GPU stack above; the verifier needs just Linux, bash and g++ 13+.
• Full-size Maverick runs use 280 GB RAM for synthetic weights, and the real-weights route downloads a 232 GB 4-bit conversion and needs a calibration set plus 330 GB RAM and 245 GB disk; expect hours Hardware and software route 4.
• The stored example proves nothing about a served model; it only exercises the verifier.
• The verification exit code and last line must be read together; codes 2, 3, 4 and 15 mean no verdict, and NOT CHECKED may warrant a single retry only for specific internal failures verifier exit codes.
• Before serving secret weights, read the serving guide and the operator duties Serving operator duties.
• The CPU test suite overwrites bin/cp_verify and bin/weight_sums; exit 3 means a false acceptance and should be reported per SECURITY.md Tests SECURITY.md.
• Licensed under Apache 2.0; bundled third-party material keeps its own license.

HotRepo's take

HotRepo's only snapshot for FlashProve is the 2026-11-03 new-projects list, where it recorded 142 stars and 8 forks, with 27 stars and 2 forks gained over a roughly one-hour window starting 11:45 UTC. It has no best all-language daily rank on record, and the single snapshot does not support any trend or popularity claim. What stands out from the technical material is the split between a cheap public role and an expensive private one: verification is a sub-two-second CPU check against a trusted commitment ID, while proving needs a dedicated H100 and, at full Maverick size, hundreds of gigabytes of RAM. That makes the repository most useful as a verification and protocol-study artifact rather than a component to deploy casually.