Anthropic describes FlashProve, an open source way to prove which AI model wrote an output
Anthropic is working on an open source system to verify which AI model produced a given output, according to a blog post published Tuesday and reported by TechCrunch. The system is called FlashProve. It is built to provide what the researchers call "provable inference": a cryptographic proof, essentially a mathematical guarantee, that a given output came from a specific model. The aim is to let users confirm that the answer they received really came from the model they think they are using.
TechCrunch compares the idea to cryptographic email signatures, which let a recipient confirm a message came from its claimed sender. FlashProve would be robust against impostors trying to disguise one model as another, even when the impostor is the lab that built and runs the model. The researchers note that the system could be used to prevent an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive model to inflate its performance results.
It could also be used to check claims by third parties that a specific task was done by an advanced model. The researchers write: "A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that its business plan was given the go-ahead by an appropriate model. How can a user verify these claims?"
To work, the system requires AI labs to publish a "fingerprint" of each model they release. The fingerprint can later be matched to specific outputs and verified cryptographically. The fingerprints do not reveal a model's weights, the internal numbers that define how the model behaves and which closed-model makers such as Anthropic and OpenAI keep private. So labs could publish fingerprints without giving up their most valuable asset, which lets the system work with commercial models too. It is also designed to be lightweight, so verification could be done on a local device.
With the announcement, the researchers released a detailed technical specification and working code for various elements of the system, publicly available under an open source license on GitHub. Research is ongoing, and there are no plans to deploy FlashProve at Anthropic or any other lab. The researchers describe the post as meant to share intermediate progress rather than a completed research agenda, and say they want others to look at the work, take it, and improve it.
Key facts
- FlashProve is an open source system from Anthropic researchers meant to give a cryptographic proof that an output came from a specific AI model, which the researchers call "provable inference".
- It is designed to resist impostors, including the lab that runs the model, and could catch a secret swap to a cheaper model or to a more expensive one used to inflate results.
- Labs would publish a "fingerprint" of each model that can be matched to outputs and verified cryptographically; fingerprints do not reveal model weights, so commercial models can be covered.
- The system is designed to be lightweight enough for verification on a local device.
- A technical specification and working code for various elements are on GitHub under an open source license, but there are no plans to deploy it at Anthropic or any other lab.
Why it matters
Today a user of an AI service has to trust that the model named on the label is the one answering. FlashProve is an attempt to replace that trust with a mathematical check. The researchers point to two cases: a provider quietly swapping in a cheaper model to save money, or a pricier one to make benchmark results look better; and third parties who claim a task was done by a frontier model, such as a vulnerability scan or a sign-off on a business plan.
Who it affects
Users of hosted AI models, who could confirm which model gave them an answer. AI labs, which would have to publish a fingerprint of each model they release. Developers and companies that cite a specific model's work as evidence, since their claims could be checked by others. The design is meant to work for closed commercial models too, because fingerprints do not expose weights.
How to use it
Nothing is deployable today. The researchers released a detailed technical specification and working code for various elements of the system on GitHub under an open source license, and invite others to take it and improve it. There are no plans to run it at Anthropic or any other lab, so end users cannot yet verify anything with it.
How solid is it
The account comes from TechCrunch's report on Anthropic's blog post. The researchers themselves call the post intermediate progress, not a completed research agenda. The source does not explain the cryptographic mechanism or how a fingerprint is constructed or matched, gives no performance figures such as verification cost or latency, and does not say which Anthropic models, if any, the system has been tested on. No reactions from other labs or outside experts are reported.
Risks and caveats
The scheme depends on labs choosing to publish a fingerprint for each model they release, and there are no plans for any lab to deploy it. Because the work is early and ongoing, claims about robustness against impostors, including the lab itself, are the stated design goal rather than something shown in the source. The lightweight, local-device verification is likewise described as a design aim.
“We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it.”
— Anthropic researchers, in the FlashProve announcement post