Can You Prove Which Model Answered?

When a chatbot answers a question, users generally have no way to confirm which model actually generated the text. Anthropic says it is building a system to close that gap: an open-source method for proving, cryptographically, that a given output came from a specific model. According to a blog post published Tuesday, the project is called FlashProve, and it is framed as research in progress rather than a finished product.

A signature for model output

The core idea, as described by Anthropic, is what researchers call “provable inference” — essentially a mathematical guarantee tying an output to the model that produced it. The company compares the concept to cryptographic email signatures, which let a recipient confirm that a message really came from its claimed sender.

Applied to AI, the analogy means a user could check that the answer they received came from the model they believe they are using, rather than something posing as it. Anthropic positions the design as robust against impostors attempting to disguise one model as another — including, the researchers say, the lab that built and operates the model itself.

The swap problem, named directly

Anthropic is specific about the scenarios FlashProve is meant to address. The researchers note the system could prevent an AI company from secretly substituting a cheaper model to cut costs, or a more expensive one to inflate its performance results.

Those are claims about conduct by model providers, and in this framing the adversary is not an outside attacker but the operator of the service. The same mechanism is described as a way to check third-party assertions that a particular task was handled by an advanced model.

“A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that its business plan was given the go-ahead by an appropriate model,” the researchers write. “How can a user verify these claims?”

— Anthropic researchers, in the announcement post

Fingerprints that keep weights private

For the system to work, Anthropic says AI labs would have to publish a “fingerprint” of each model they release. That fingerprint could later be matched to specific outputs and checked cryptographically.

The critical design detail is what the fingerprint does not contain. According to Anthropic, it does not reveal a model’s weights — the internal numbers that define how it behaves, and which closed-model makers such as Anthropic and OpenAI keep private. Because the fingerprint can be published without exposing that asset, the company says the approach could extend to commercial models, not just open ones.

Anthropic also describes the system as lightweight by design, so that verification could be performed on a local device rather than requiring a heavyweight external service.

Code out, deployment off

Alongside the announcement, the researchers released a detailed technical specification and working code for various elements of the system, under an open-source license on GitHub. Anthropic states plainly that research is ongoing and that there are no plans to deploy the system at Anthropic or at any other lab.

The framing is deliberately provisional. The company describes the work as sharing intermediate progress rather than a completed research agenda, and says it is publishing now so that others can examine the approach, adopt it, and improve on it.

“This research post is meant to share intermediate progress, and not a completed research agenda,” researchers explain in the announcement post. “We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it.”

— Anthropic researchers, in the announcement post

What would have to change

The system as described depends on model developers volunteering fingerprints for each release. Anthropic does not say in the post how such a practice would be enforced, nor does it describe any lab currently committing to publish fingerprints.

Verification also assumes a user or tool has a reference fingerprint to compare against. The researchers’ examples — a software library said to have been scanned by a frontier security model, a business plan said to have been approved by an appropriate model — are both cases where the party making the claim is the one being checked.

Because the code and specification are public, outside researchers can examine the construction directly. Anthropic says nothing in the announcement about timelines, review processes, or adoption targets beyond the open-source release.

Why it matters

For anyone buying AI capability as a service, the gap FlashProve targets is a practical one: the model behind an API or app is generally taken on trust. If fingerprint publishing became common, buyers could in principle check that a vendor's stated model is the one actually answering — a form of assurance that does not exist today in the way Anthropic describes. This suggests the value would sit less with end users and more with procurement, auditors, and developers evaluating claims made by others. It also cuts both ways for labs: the same mechanism that lets a customer verify a model is the one advertised would let anyone check a lab's own claims. Until fingerprints are actually published and verified at scale, though, FlashProve remains a published design with working components and no deployment — which means the trust gap it describes is still open.