Anthropic has published research on an open-source system, FlashProve, designed to cryptographically prove which AI model produced a given output. The approach, described in a Tuesday blog post, is built around what the researchers call “provable inference”: a mathematical guarantee that an output originated from a specific model, rather than from an impostor. The stated goal is to let users confirm they are actually interacting with the model they think they are using, in a way that remains robust even against the lab that built and runs the model.

The system is compared to cryptographic email signatures, which let recipients verify a message’s claimed sender. Researchers suggest FlashProve could address a range of practical failure cases. For example, it could prevent an AI company from secretly substituting a cheaper model to cut costs, or a more expensive model to inflate reported performance. It could also support third-party verification claims, such as a developer asserting that a software library was scanned by a frontier cybersecurity model, or a company claiming that a business plan was approved by an appropriate model. The post frames this as answering a basic question: how can a user verify these claims?

To make FlashProve work, AI labs would need to publish a “fingerprint” for each released model. That fingerprint can later be matched to specific outputs and verified cryptographically. Importantly, the fingerprints do not reveal model weights, the internal numerical parameters that define model behavior and that closed-model providers such as Anthropic and OpenAI keep private. This means labs could publish fingerprints without exposing their most valuable proprietary asset, allowing the system to function with commercial, closed models as well. The researchers also describe the system as lightweight, with verification possible on a local device.

Alongside the announcement, the researchers released a technical specification and working code for various components, available publicly under an open-source license on GitHub. However, deployment is not imminent. The researchers state that the work is ongoing and there are no plans to deploy FlashProve at Anthropic or any other lab. They characterize the post as an intermediate progress report rather than a completed research agenda, explicitly sharing the work so that others can take it and improve it.