Anthropic open-sources FlashProve, a cryptographic way to prove which AI model made an output

Anthropic open-sources FlashProve for provable inference

Anthropic has released an open-source research system called FlashProve, designed to cryptographically verify which AI model produced a given output. According to TechCrunch, the company announced the project in a blog post on Tuesday, framing it as a step toward what its researchers call provable inference: a mathematical proof that a specific response came from a specific model, rather than from something posing as that model.

The problem it targets is straightforward. When you query an AI service, you generally have to take the provider's word that the answer came from the model you chose. FlashProve is built to remove that trust requirement. TechCrunch compares the idea to cryptographic email signatures, which let a recipient confirm a message genuinely came from its claimed sender. Here, the design is intended to hold up even against the lab that built and runs the model — meaning it could, in principle, catch an AI company secretly substituting a cheaper model to cut costs, or swapping in a more expensive one to inflate its performance results.

Fingerprints without exposing weights

The mechanism depends on model publishers committing to a cryptographic "fingerprint" for each model they release. Outputs can later be matched against that fingerprint and verified cryptographically. Crucially, the fingerprint does not expose the model's weights — the internal parameters that define how a model behaves, and which closed-model providers such as Anthropic and OpenAI treat as their most valuable asset. Because the fingerprint reveals nothing about those weights, commercial labs could publish fingerprints without giving up proprietary information, keeping the scheme viable for closed models and not just open ones. The system is also designed to be lightweight, so verification can run on a local device.

Alongside the announcement, TechCrunch reports, the researchers published a detailed technical specification and working code for various elements of the system on GitHub under an open-source license.

Verifying third-party claims

Beyond catching model swaps, the researchers point to third-party attestations as a use case. A developer might claim that a software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim its business plan was given the green light by an appropriate model. As the researchers ask, quoted by TechCrunch: "How can a user verify these claims?" FlashProve is meant to give statements like these a checkable foundation rather than leaving them as marketing assertions.

Explicitly unfinished research

The project is at an early stage. There are no plans to deploy FlashProve at Anthropic or any other lab, and the announcement describes the post as sharing intermediate progress rather than a completed research agenda. "We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it," the researchers write. Releasing the specification and working code under an open-source license fits that goal — an invitation for outside cryptographers and engineers to probe and extend the design.

Why it matters

Trust in AI services currently rests largely on reputation and contracts. As model outputs get embedded in security reviews, compliance decisions and automated workflows, the question of which model actually did the work becomes materially important. FlashProve sketches a technical answer that does not require labs to open their weights: publish a fingerprint, let anyone verify outputs against it. If fingerprinting became a standard part of model releases, model identity would shift from an assumption to a checkable property. The obstacles are just as clear — the scheme only works if labs voluntarily publish fingerprints, the cryptography needs sustained public scrutiny, and Anthropic itself labels this unfinished work. Still, as an open-source proposal from a major lab, it turns the provenance question into something concrete and testable.