Anthropic has published a blog post detailing work on FlashProve, an open-source system designed to verify which AI model generated a specific output.
The tool provides a cryptographic proof, or mathematical guarantee, that confirms an answer came from a particular model. Users would be able to check if the response they received actually originated from the system they believe they are using.
Like digital signatures on email, FlashProve is built to stop impostors from disguising one model as another. This protection applies even if the lab building and running the model attempts the deception. Researchers note the system could stop a company from secretly swapping a premium model for a cheaper one to save money, or from using a more expensive model to fake better performance results.
It could also verify claims made by third parties about specific tasks. A developer might state their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim its business plan received approval from an appropriate model. The researchers ask how a user can verify these assertions.
How it works
The system requires AI labs to publish a fingerprint for each model they release. This fingerprint can be matched to specific outputs and verified cryptographically later.
These fingerprints do not reveal a model’s weights, the internal numbers defining its behaviour. Closed-model makers like Anthropic and OpenAI keep these private. Labs can publish the fingerprints without handing over their most valuable asset, allowing the system to work with commercial models too.
The design is lightweight enough for verification on a local device.
Alongside the announcement, researchers released detailed technical specifications and working code for various elements of the system. This code is publicly available under an open-source license on GitHub.
Research into the system is ongoing. There are no plans to deploy it at Anthropic or any other lab.
“This research post is meant to share intermediate progress, and not a completed research agenda,” the researchers explain in the announcement post. “We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it.”
What it means
Developers and users will have a way to audit claims made about AI usage. If a service provider says a complex task was handled by a specific high-end model, a fingerprint could confirm that claim without the provider needing to expose the model’s internal workings.
