Anthropic published "Progress on provable inference for large language models" on November 2, and its X announcement came on November 3 at 11:54 AM PT. The post introduces FlashProve, an open-source prototype that lets a model provider attach a cryptographic proof to a response, so a user can check that a specific set of committed weights produced it. By about 1:30 AM PT on November 5, the Hacker News thread had 218 points and 101 comments. Anthropic's own X post showed 487 likes, 32 reposts and 90 replies, and a post by Steve Weis, who shared the release about 15 hours before Anthropic's own account did, showed 742 likes. This roundup collects what people said on Hacker News and X and checks the main objections against Anthropic's write-up. Reddit cannot be read from our tools, so it is not covered.
What Anthropic says it built
The figures below come from Anthropic's post, which also links the code in the FlashProve repository. The test model was Llama 4 Maverick, a 400 billion parameter mixture of experts model from Meta, in a third party's public 4-bit conversion. On one H100 GPU, the prover produced proofs at about 110 tokens per second, and each proof was about 18.78 MB. Checking a proof took 17 seconds on 24 CPU threads and 21 seconds on one thread, with no GPU and no access to the weights.
Anthropic is direct about the cost. It reports that proving a batch of 24 requests took about 72 times longer per GPU than vLLM, a common open-source inference engine, takes for the same requests, and about 94 times longer when vLLM runs at the highest load it tried. It also lists limits: the proof covers an integer version of the published weights, assumes greedy decoding, handles contexts of up to 1,024 tokens, and is built for mixture of experts models. Anthropic calls the release a research prototype and says Claude produced improvements to the proof system, with the top-level security statements written in the Lean proof language so people can audit them.
What Anthropic and the early X posts said
Steve Weis posted first: "Anthropic is releasing an open source library, FlashProve, for provable inference. It was measured on Llama 4 Maverick, a 400B-parameter mixture of experts model." Asked what it is for, Weis replied that "Example use cases might be routers, 3rd party inference providers, or future models capable of editing their own weights." Anthropic's own post opened with "New Anthropic research: progress on provable inference for large language models" and said FlashProve "allows developers to verify whether a given response came from a given AI model."
scaling01 offered a policy reading: "Anthropic is preparing to pace the frontier with provable inference." That fits Anthropic's text, which lists pacing and regulation as one of four use cases. The others it names are tamper detection, proving how much effort went into a piece of text, and checking that only approved models are served.
Hacker News: who needs this
One early argument was about whether the problem matters. ajb wrote, "I mean it tells you that you're not being stiffed by Anthropic using a cheaper model and that they haven't literally been MiTMd, but that's kind of table stakes." velcrovan disagreed in a reply: "That's literally the most common gripe I see from Anthropic users", adding that there is no existing way for users to verify it. grey-area called it "the trivial problem of 'proving' which model is being used" and argued in the same comment that "if you don't trust the provider of your models, it's game over really."
Other commenters listed situations where the check helps. porridgeraisin wrote that it is useful "when there are content-level proxies between the client and anthropic's API server, of which there are many these days." skybrian pointed to resellers that "promise to provide access to Claude (which isn't officially available in China) and defraud users by substituting something else." aetherspawn asked what the point of a top model is if, three weeks later, "it’s dumber than the previous generation at launch." Anthropic's post describes the same gap: users cannot currently confirm that the model they chose produced the response. A separate paper, which we covered as API-TAIL, tries to catch hidden model swaps from the returned text alone.
On quantization, vintagedave asked, "What would stop a host using true weights for generating the signature, while running on quantized versions?" l9o answered that open-weight models can be committed to from the public files, but added that "it only works for greedy decoding and short contexts for now." That matches the limits section of Anthropic's post.
Hacker News: the cost and the alternatives
Cost came up repeatedly. PeterisP wrote, "I don't see a usecase where the benefits of this proof would be worth 70x or even 7x increase in cost." vessenes welcomed the work as "a significant improvement on prior zk results", but noted that for an open model provider "you can get a probabilistic proof much more cheaply out of four independent inference providers running the same non-batched prompt than this 90-100x compute hit."
Hardware attestation was the other recurring answer. Anthropic describes trusted execution environments, or TEEs, as hardware-based tools that provide privacy and attestation and rely on the manufacturer producing tamper-resistant hardware. lrvick wrote, "Provable privacy via remote attestation effectively gives you provable inference for free." Anthropic's post says trusted hardware and cryptography are complementary, with different guarantees and tradeoffs. EliKarasik wrote that their team works on a competing system at Attestable and argued that FlashProve "supports only a fully integer model with a small context length". Anthropic's post itself cites Attestable's reported 53 to 77 tokens per second on a dense 31 billion parameter model and says no open-source library has been released for it.
Hacker News: the regulation worry and the credit dispute
Two comments took up the regulation angle. ex-aws-dude quoted the passage about forcing providers to devote hardware to inference and wrote, "Sounds like Anthropic's dream scenario." arcwhite wrote, "I wager regulatory capture lies this way." Anthropic's post describes the pacing use case as a possible tool for verifying compliance, and it notes that the proof shows hardware is serving inference but does not show it is not also training.
The largest reply thread in the discussion, 25 replies by our count, sat under a comment from neuwirth, who wrote, "This is built on VerInf, work that I did as a MARS fellow. They ripped everything down to the choice of 400B Maverick from us with very little attribution." Others pushed back. keeda said the post at least mentions VerInf, while unsure that was sufficient attribution, and remcob called the claim "an exaggeration", listing differences in the commitment scheme and matrix multiplication checks. Anthropic's post does cite VerInf as the earlier proof of the same model, at about 0.02 tokens per second and 14.3 hours for 1,000 tokens. We cannot judge the technical overlap from the outside, and we found no response from Anthropic on this point in the thread.
X: cost, correctness and what the proof does not cover
The X replies were thinner than the Hacker News thread, and many accounts were small. The cost question repeated. dearcuong wrote, "70 to 95x the gpu time of vllm is a lot to pay for a receipt. who eats that?" ContextWindowed guessed that "spot audits come way before receipts on every call." ohpreis said FlashProve is "still expensive" and that "a 19 MB proof isn’t exactly carry-on luggage," but added that for high-stakes work, proving which model answered "could be worth the overhead." Two accounts argued about what that cost means. arthurcolle said it is "new code on existing fleets of GPUs that costs 100x more flops to perform compared to inference," while bydylanlamb said the comparison confuses inference cost with "cost of an entirely separate, optional verification process." Anthropic's own figure is 70 to 95 times the GPU time.
Several people stressed what the proof does not cover. YokushObiwan wrote, "Provable inference answers which model produced this token. It does not answer whether the token is right." whichaiwon put it more briefly: "proof that the right model answered still isn't proof that the answer is true." 1a1n1d1y pointed to "an unverified gap between its lean verifier and cuda/cpp code", which Anthropic states in its limits section when it says it does not guarantee that the Lean version, the paper and the fast code all match.
Some posts were promotional. bittingthembits used the 72 times figure to argue for sampling-based verification on Bittensor subnets, and the post ends with a not-financial-advice disclaimer. Krouxzz gave a plain summary and added a caveat: "for text provenance, you'd need the proof alongside the text. a pasted paragraph alone wouldn't be enough."
A poster with a background in zero-knowledge proofs, rami_decodes, wrote "In 2023-24 I was deep in ZK", said Giza, EZKL and Modulus "showed this was possible early", and added "Great to see a frontier lab take it further and open source it."
What to take from it
Nobody we found disputed that the numbers are real, and nobody claimed the proof checks that an answer is correct. The disagreement is over value. Supporters see an answer to the common suspicion that a provider quietly swapped in a cheaper model, plus a building block for auditors and regulators. Skeptics see a prototype that costs 70 to 95 times the GPU time, covers 1,024 tokens of greedy decoding, and competes with hardware attestation and simple re-running.
Anthropic's text frames it as intermediate progress, and it adds context readers can use. It says it met its public goal of a provable inference prototype by September 30 through a separate project that signs its inference traffic and recomputes it on a trusted server, and that it now prefers the term "inference verification". For how Anthropic ties capability thresholds to safeguards, see our explainer on its Responsible Scaling Policy. For a different way Anthropic is marking Claude output, see our post on the Claude text watermark reaching older models.
These counts and likes are from the early morning of November 5 and will move.
Sources
- Anthropic, Progress on provable inference for large language models
- FlashProve repository
- Hacker News thread
- Anthropic on X
- Steve Weis on X
- scaling01 on X
- Steve Weis on X (reply on use cases)
- dearcuong on X
- ContextWindowed on X
- ohpreis on X
- arthurcolle on X
- bydylanlamb on X
- YokushObiwan on X
- whichaiwon on X
- 1a1n1d1y on X
- bittingthembits on X
- Krouxzz on X
- rami_decodes on X
- Attestable, Proving LLMs at scale
