whyagents/flashprove-consumer-gpu

Anthropic's FlashProve, running on a $750 GeForce RTX 5070 Ti.
Every proof checked by the unchanged upstream verifier. Every limit written down.
## What's different here
Two other FlashProve ports existed before this one: FlashProve-L4 on an NVIDIA L4
datacenter GPU, and an Apple Silicon rewrite. What this repository adds:
A store-bought gaming card in a desktop PC. A GeForce RTX 5070 Ti (consumer Blackwell, 16 GB) that also drives the monitor,
under Windows 11 + WSL2. No datacenter GPU, no cloud.
Minimal patches, with a reason for each. 12 small prover patches (+34 / −28 lines). Zero changes to the verifier, protocol or proof format.
A strict judge. Every proof is checked by upstream's verifier built from a separate pristine checkout. Tamper tests run alongside
(69 / 69 rejected), and FlashProve-L4 is cross-checked in both directions (their proof passes our verifier; our proofs give their answer token).
Measured, not estimated. Layers at Llama 4 Maverick's full width (d = 5,120, 40 heads) commit in about 43 s and prove in 3–6 s
within 16 GB. The prover serves full batches of 64 requests (the format's maximum) with a GPU peak of 9.3 GiB. 750 of 750 proofs in
the batch study were accepted (what fits).
Limits first. What this does not show, including the open question about the hiding module, is spelled out below.
## Background
When an AI system answers, how do you know which model produced the answer?
FlashProve is Anthropic's open-source research prototype that answers this with a
zero-knowledge proof: a reply provably came from a specific, committed set of model weights. Anyone can check the proof on an
ordinary CPU. Upstream supports one prover platform: a dedicated NVIDIA H100.
We wanted to know what it takes to run it on hardware a developer can buy at a store.
> Answer: 12 small patches to the prover (none to the verifier), one consumer GPU, and careful bookkeeping of what the result
> does and does not mean.
## At a glance
| Hardware | GeForce RTX 5070 Ti (consumer Blackwell, compute capability 12.0, 16 GB), which also drives the desktop; Windows 11 + WSL2 Ubuntu 24.04 |
| Upstream | anthropics/FlashProve @ 9e2bdd8f (v0.16.0) |
| Patches | 12 files, +34 / −28 lines to the prover. 0 changes to the verifier, protocol, or proof format. A 13th patch (from FlashProve-L4) adds one small model shape. |
| Judge | Upstream's cp_verify, built separately from a pristine checkout. The binary is identical (sha256 7f9efc1e…4394) across three builds from separate clones on this one machine (same g++ 13.3). That shows reproducibility here, not across machines |
| Real model | Karpathy's TinyStories260K, in FlashProve-L4's integer conversion. Answer token 310 in every run |
| Speed (tiny models, n = 3) | about 2 s to prove, 5–25 s to commit, about 0.7 s to verify on a CPU |
## How it works
mermaid
flowchart LR
W[Model weights] --> C[cp_commit patched, on RTX 5070 Ti ]
C -->|public key + commitment ID| V
R[Request: prompt tokens] --> P[cp_prove patched, on RTX 5070 Ti ]
C -->|secret key| P
P -->|answer + proof| V[cp_verify unchanged upstream , on CPU]
V --> Y{YES / NO}
Why patching the prover doesn't weaken anything: in FlashProve, soundness is a property of the verifier. A buggy or