Anthropic Wants to Prove Which Model Actually Answered You

Anthropic is building an open system that lets a user check which model actually produced a piece of text. The project, FlashProve, is aimed at what researchers call “provable inference”: a cryptographic guarantee that a given output came from a named model.

The idea is close to a signed email. A signature lets the recipient confirm that a message came from the address it claims. FlashProve is meant to do the same for model outputs — and, crucially, to resist a model pretending to be another, even when the company running it is the one doing the pretending.

That closes two specific loopholes. A lab could quietly route traffic to a cheaper model to save money, or to a more expensive one to make benchmark results look better. It also lets a third party check claims of the “our code was audited by a frontier security model” sort, which are otherwise taken on trust.

The mechanism relies on a fingerprint published for each model. Outputs can be matched against it and checked cryptographically. The important property is that a fingerprint does not reveal model weights — the internal parameters that closed-model developers treat as trade secrets — so a lab can publish one without giving away its most valuable asset, and the scheme works for proprietary models too.

Anthropic says the design is lightweight enough to run on a local device, and has published a technical specification along with runnable code for each component on GitHub under an open licence.

There is no deployment plan yet. The researchers describe the publication as interim progress rather than a finished programme, released so that others can inspect the work and build on it.