Anthropic explores cryptographic proofs for AI model identity

FlashProve aims to make model provenance verifiable

Anthropic is developing FlashProve, an open-source approach intended to establish verifiable provenance for AI-generated responses. The research focuses on a question that becomes more important as models are deployed through products, APIs and third-party services: can a user independently confirm that a result was produced by the model named by the provider?

The proposed answer is what the researchers call provable inference. Rather than asking users to trust an operator’s statement about the system behind an answer, FlashProve would attach a cryptographic basis for checking the model source. Its role is comparable in principle to a signed message: the verification process is meant to distinguish a genuine claimed source from an entity presenting itself as that source.

That distinction could matter even when the party operating a service is also the party that developed the model. Anthropic’s researchers identify two opposing risks: a provider could substitute a lower-cost system while representing its output as coming from a more capable model, or it could present a costlier model as the source to strengthen claims about performance. A mechanism that verifies model identity is designed to make those substitutions detectable.

The concept also extends beyond direct model access. Organisations may make claims that important work was assessed or completed using a particular advanced system. Examples raised in the research include a software library said to have been checked for security weaknesses by a frontier cybersecurity model, or a business plan said to have received approval from an appropriate model. FlashProve is intended to give users a way to evaluate such assertions rather than simply accept them.

For the approach to function, model developers would publish a fingerprint for every released model. That fingerprint could subsequently be compared with an output and checked through cryptographic methods. The design is notable for what it does not require: disclosure of the model weights. Since those internal values are closely held by providers of closed models, avoiding their exposure could allow commercial model makers to participate without revealing that core asset.

Anthropic also describes verification as lightweight enough to run on a local device. This would place checking capability nearer to the user, instead of making verification dependent on remote infrastructure controlled by a model provider.

The work remains research rather than a product rollout. Anthropic has published a technical specification and working code for components of the system under an open-source licence on GitHub, while stating that there are no plans to deploy FlashProve at Anthropic or another lab. The researchers frame the release as interim progress and invite others to inspect, adapt and improve it.