Anthropic releases FlashProve, an open system to prove which model answered

Anthropic published a blog post on November 3 describing FlashProve, an open source system meant to prove which AI model generated a specific response. The company calls the underlying idea “provable inference”: a cryptographic proof, a mathematical guarantee that is checked rather than trusted, showing that a given output came from a particular model rather than a substitute.

The researchers compare the system to cryptographic signatures on email, which let a recipient confirm a message truly came from its claimed sender. FlashProve is designed to work even when the party trying to disguise one model as another is the lab that built and runs it. Anthropic’s researchers write that this matters because a company could be tempted to quietly swap in a cheaper model to cut costs, or a more expensive one to inflate benchmark results, without customers knowing which model actually answered their query.

The system is also aimed at a broader verification problem: checking claims made by third parties about which model did a piece of work. The researchers give two examples. A software developer might say a code library was scanned for vulnerabilities by an advanced cybersecurity model, or a company might say its business plan was reviewed and approved by a particular model. Anthropic’s post asks, in effect, how an outside user is supposed to verify either claim without a tool like this.

How the fingerprint works

For FlashProve to function, an AI lab has to publish a “fingerprint” for each model it releases. That fingerprint can later be matched against specific outputs and checked cryptographically. The researchers say the fingerprint does not expose a model’s weights, the internal numbers that determine how it behaves and that closed-model developers such as Anthropic and OpenAI treat as proprietary. Because the fingerprint keeps weights private, labs could adopt the system without giving up what the researchers describe as their most valuable asset, which would let it apply to commercial, closed models as well as open ones. Anthropic also says the verification step is lightweight enough to run on a local device rather than requiring a connection back to the lab’s servers.

Alongside the announcement, Anthropic released a detailed technical specification and working code covering parts of the system, publicly available on GitHub under an open source license. The company frames the release as unfinished work rather than a finished product. “This research post is meant to share intermediate progress, and not a completed research agenda,” the researchers write, adding that they are sharing it so others can take the work and improve it. Anthropic says there are currently no plans to deploy FlashProve at the company or at any other AI lab, leaving open how, or whether, the industry adopts a shared standard for proving a model’s identity.