Anthropic Develops an Open-Source Approach to Verify AI Model Identity

Preface

Anthropic is working on an open-source system designed to establish which AI model generated a particular output. Described in a blog post published Tuesday, the project addresses a growing challenge: users may not be able to tell whether a service has actually used the model it claims to use. The system, called FlashProve, aims to provide what its researchers call “provable inference”—a cryptographic proof that links an output to a specific model. The idea is to give users a way to check the origin of an answer rather than relying solely on a provider’s word. This article explains how FlashProve is intended to work, the situations it could help address, and what its researchers have and have not announced. The project remains research in progress; Anthropic says it has no plans to deploy the system at its own lab or elsewhere.

Lazy bag

FlashProve is an open-source research system intended to verify which AI model produced a given output. It would use a cryptographic proof, supported by a published model fingerprint, to make model identity checkable—even if the provider itself is responsible for running the model. The approach could help users detect claims that do not match the model actually used, including undisclosed model substitutions or third-party claims about AI-assisted work. Its fingerprints are designed not to reveal model weights, which could allow closed-model providers to participate without exposing those private parameters. Anthropic has released a technical specification and working code, but the research is ongoing and is not scheduled for deployment.

Main Body

Anthropic is developing FlashProve as an open-source system for verifying the identity of the AI model behind a given output. The project focuses on a question that can be difficult for users to answer: when an AI service returns a response, how can they know that the response came from the model the provider said it used? FlashProve is intended to provide evidence that connects an output to a specific model, rather than asking users to accept a provider’s claim without independent verification.

The researchers describe the central idea as “provable inference.” In this context, the phrase refers to a cryptographic proof—described as a mathematical guarantee—that a particular model produced a particular output. If the system works as intended, a user could check that an answer was generated by the model associated with a claimed identity. The aim is not simply to label a response; it is to create a verifiable link between the model and its output.

The researchers compare the concept to cryptographic email signatures. A signature can help a recipient determine whether a message came from the sender it claims to come from. In a similar way, FlashProve is meant to let users confirm whether an AI output came from the model identified by the service. The comparison helps explain the intended role of the system: it is an authenticity check, not a guarantee that the answer is accurate, safe, or useful.

One motivation is the possibility of model substitution. A provider might claim that a particular model handled a request while secretly using a different one. The researchers point to two possible incentives: a company could switch to a cheaper model to reduce costs, or use a more expensive model to make performance results appear stronger. FlashProve is designed to be robust against attempts to disguise one model as another, including cases in which the party attempting the deception is the lab that built and operates the model.

This concern matters because people and organizations may make decisions based on the model they believe is involved. A user could select a service because it claims to provide a particular level of capability. If the underlying model is quietly changed, the user may not receive the service they expected. A verification mechanism could offer evidence about model identity, helping users assess whether a provider’s description matches what produced the output.

FlashProve may also help evaluate claims made by third parties about AI-assisted work. The researchers describe examples such as a developer saying that a software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company saying that an appropriate model approved its business plan. In situations like these, a user may want to verify that the stated model really performed the task. A cryptographic proof tied to the output could provide a basis for checking such claims.

For the system to work, AI labs would need to publish a “fingerprint” for each model they release. These fingerprints would later be matched to particular outputs and verified cryptographically. In broad terms, the fingerprint is intended to serve as a model-specific reference that allows an output’s origin to be checked. The researchers’ proposal therefore depends on participating labs making these references available for their models.

A key design point is that the fingerprint is not meant to expose the model’s weights. Weights are the internal numbers that help define how a model behaves. Companies that develop closed models, including Anthropic and OpenAI, keep these parameters private. According to the researchers, publishing a fingerprint would not require a lab to disclose those weights. That distinction could allow the system to work with commercial models while preserving a provider’s most valuable private asset.

The researchers also describe FlashProve as lightweight, with verification designed to be performed on a local device. Local verification could make it possible for users to check evidence without relying on a separate central service for every validation. The announcement does not claim that the system has been broadly deployed or that every practical challenge has been resolved; rather, it presents the design as ongoing research and shares materials for others to examine.

As part of the announcement, the researchers released a detailed technical specification and working code for various parts of the system. The materials are publicly available on GitHub under an open-source license. Making the design and code available gives other researchers and developers an opportunity to inspect the approach, test its components, and suggest improvements. Open access is especially relevant for a verification system, because confidence in its claims depends in part on whether its methods can be scrutinized.

Anthropic has emphasized that FlashProve is not a completed research agenda. The researchers say that the announcement shares intermediate progress and invites others to build on the work. They have no plans to deploy FlashProve at Anthropic or at any other lab. That distinction is important: the release describes a research proposal and working components, not a production service that users can currently rely on to authenticate model outputs.

More broadly, FlashProve addresses trust and accountability in AI services. If systems can provide evidence about which model generated an output, users may be better equipped to evaluate provider claims and third-party assertions. At the same time, model identity is only one part of assessing an AI result. A proof that a particular model produced an answer would not, by itself, establish that the answer is correct or that the model was appropriate for the task. FlashProve’s proposed contribution is narrower: it aims to make the identity of the model behind an output more verifiable while keeping model weights private.

Key Insights Table