When someone says an AI answer came from a particular model, how could a user check that claim? Anthropic researchers are working on FlashProve, an open-source system intended to provide a cryptographic proof of which model produced an output. The research is still in progress, and there are no plans to deploy the system at Anthropic or another lab.
A way to verify a model’s identity
FlashProve is designed to establish what the researchers call “provable inference”: a mathematical guarantee that a particular output came from a specific model. The goal is to let people confirm that the model behind an answer is the one they believe they are using.
The idea has a parallel in cryptographic email signatures. A signature can help a recipient check that a message came from its claimed sender. FlashProve aims to offer a similar check for AI outputs, including cases where someone might try to present one model as another.
According to the researchers, the approach is intended to withstand impostors even when the party misrepresenting the model is the lab that built and operates it. That possibility matters because the lab itself controls which model handles a request.
Why the distinction could matter
A verified model identity could make it harder to secretly substitute a different model. The researchers point to two possible reasons a company might make such a swap: using a cheaper model to reduce costs, or using a more expensive model to make performance results appear stronger.
FlashProve could also help people assess claims made by third parties about AI-assisted work. A software library might be described as having been scanned for vulnerabilities by a frontier cybersecurity model. A company might say its business plan received approval from an appropriate model. In each case, the claim raises a practical question: how can the user check which model actually did the work?
The system is meant to make that question verifiable. It would not, by itself, establish that a model’s answer was correct or that the work was done well. Its stated purpose is narrower: to connect an output to the identity of the model that produced it.
Fingerprints without exposing model weights
For the system to work, AI labs would need to publish a fingerprint for each model they release. FlashProve could then match that fingerprint to outputs and verify the match cryptographically.
The researchers say the fingerprints would not reveal model weights: the internal numbers that define how a model behaves. That distinction could allow labs to participate without disclosing those private components. The article notes that closed-model makers such as Anthropic and OpenAI keep weights private, while the fingerprint approach is designed to work with commercial models too.
Verification is also intended to be lightweight enough to run on a local device. If that design works as intended, a user could check a model’s identity without relying on a lab to confirm its own claim. The source does not describe a finished deployment or say that local verification is already available.
Research shared for others to improve
Alongside the announcement, the researchers released a detailed technical specification and working code for various parts of the system. The material is publicly available under an open-source license on GitHub, giving others a chance to examine and build on the approach.
Anthropic describes the work as intermediate progress rather than a completed research agenda. The researchers say they are sharing it so others can review what they have done, use it, and improve it. They also say research is ongoing, with no current plan to deploy FlashProve at Anthropic or any other lab.
For now, FlashProve is a proposal for making model identity easier to check, not a service users can rely on in production. Its usefulness will depend on continued research and on labs publishing fingerprints for their models. The announcement lays out the intended mechanism and possible applications, while leaving deployment for the future.