Anthropic's FlashProve Wants to Cryptographically Prove Which AI You're Talking To

Anthropic has released an open-source system called FlashProve that can cryptographically prove which AI model produced a given output, according to a blog post published Tuesday. The company calls the technique "provable inference" — a mathematical guarantee that a specific answer came from a specific model, not an impostor wearing its name.

The problem FlashProve targets is simple and increasingly urgent. When you query an AI through an app or API, you have to trust the provider that the response came from the model you paid for. Nothing in the output itself proves its origin. As AI models take on higher-stakes work — code audits, business decisions, security reviews — that trust gap becomes a real liability, and FlashProve is an attempt to close it with cryptography rather than promises.

How does FlashProve actually work?

The mechanism resembles cryptographic email signatures, the kind that let a recipient confirm a message really came from its claimed sender. Instead of a signature on an email, FlashProve produces a proof attached to a model's output that can be checked mathematically.

There's a catch, and Anthropic's design handles it directly. For the system to work, AI labs must publish a "fingerprint" of each model they release. That fingerprint can later be matched to specific outputs and verified cryptographically.

The crucial design choice: the fingerprints don't reveal a model's weights. Weights are the internal numbers that define how a model behaves, and for closed-model makers like Anthropic and OpenAI they're the most valuable asset on the balance sheet. Because the fingerprint exposes nothing about those weights, labs could participate without giving away the crown jewels. That's what makes the system viable for commercial models, not just open ones.

Verification is also designed to be lightweight. It can run on a local device, which means users wouldn't need to send anything back to the lab to check a proof.

What could it prevent?

The researchers outline scenarios where model identity fraud has real costs. FlashProve would be robust against impostors attempting to disguise one model as another — even when the impostor is the lab that built and runs the model.

The two headline risks the researchers name:

• Cost-cutting swaps. An AI company could quietly substitute a cheaper model while charging customers for the expensive one.
• Inflated performance results. A lab could secretly route benchmark queries to a more powerful model to make its published numbers look better than the product customers actually receive.

Both scenarios matter for the AI market right now. Pricing tiers are built on model identity, and benchmarks drive purchasing decisions and investment. If neither can be independently verified, buyers are working on faith.

How does it verify third-party claims?

FlashProve also addresses a second, subtler trust problem: claims made by third parties about what a model did for them.

"A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that its business plan was given the go-ahead by an appropriate model," the researchers write. "How can a user verify these claims?"

The question is becoming common. AI-assisted audits, reviews and approvals are increasingly cited as evidence of diligence in software supply chains and business processes. Without a way to verify which model did the work, those claims are marketing copy. With a cryptographic proof, they'd be checkable facts.

What has actually shipped?

This is not a product launch. Anthropic's announcement is research output, and the researchers are explicit about that.

Alongside the blog post, the team released:

• a detailed technical specification for the system
• working code for various elements of FlashProve
• everything publicly available under an open-source license on GitHub

Research on the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab. That last detail matters: adoption would require the very labs that could benefit from quiet model-swapping to voluntarily publish fingerprints and attach proofs to their outputs.

The researchers frame the release as an invitation. "This research post is meant to share intermediate progress, and not a completed research agenda," they explain in the announcement post. "We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it."

Why does this matter now?

The timing reflects where the AI industry has moved. Model identity used to be a niche concern; now it sits at the intersection of procurement, benchmarking and regulatory scrutiny. Customers paying premium rates for frontier models have no technical way to confirm they got what they paid for, and enterprises wiring AI outputs into compliance workflows have no way to verify the provenance of those outputs.

FlashProve offers a template for fixing that without forcing open the black box of model weights. The open-source release means the template is now in the hands of security researchers, standards bodies and competitors alike — anyone can inspect it, attack it and improve it.

The open question is adoption. A verification system only works if the labs participate, and participation means accepting external accountability for which model served which output. Whether Anthropic or its rivals ever commit to that is a business decision, not a technical one — the technical groundwork is now public on GitHub, waiting.