Anthropic Open-Sources FlashProve to Verify Which Model Answered

Anthropic this week published FlashProve, an open-source system for what it calls provable inference: a way for users to verify mathematically which AI model actually produced a response, instead of taking a provider's word for it.

The mechanism is simple in outline. A provider publishes a unique cryptographic fingerprint for each model. When that model generates an answer, the provider can produce a mathematical proof linking the output to the published fingerprint; a user checks the proof, and if a different model generated the text, verification should fail. The report likens the approach to cryptographic signatures on email.

The important design choice is that verification does not require revealing model weights. Anthropic, OpenAI and others keep the weights of their leading models private, and FlashProve asks providers only to publish fingerprints that do not expose those parameters. The system is also built to allow lightweight verification on local devices, although generating the proofs takes far more compute.

Anthropic demonstrated it with Meta's Llama 4 Maverick, a model with 400 billion total parameters, using four-bit quantized weights on a single Nvidia H100. Proofs were produced at roughly 110 tokens per second, and a 1,024-token request yielded a proof of about 19MB that a CPU could verify in seconds.

The catch is cost. Proof generation required roughly 70 to 95 times more GPU computation than comparable inference with vLLM, a gap the report identifies as a major obstacle to adoption. That arithmetic alone makes FlashProve more plausible as a research protocol than as a default feature switched on for every request.

There is also a sharp limit to what the tool proves. FlashProve verifies which model generated an output, not whether another model was trained on Claude's responses. It cannot independently establish unauthorized distillation or identify training data, which is precisely the conduct Anthropic has been alleging.

That context matters. Anthropic's September 2026 report accused Moonshot AI of quietly forwarding nearly 300,000 Kimi customer requests to Claude over ten days, largely through its Opus models and 5,380 fraudulent accounts. In February it accused DeepSeek, Moonshot and MiniMax of distillation campaigns spanning more than 16 million exchanges via about 24,000 fraudulent accounts. The report notes that these remain Anthropic's allegations rather than independently established findings.

On release, Anthropic put the technical specification, the mathematical research and working code on GitHub under an open-source license. It says the project is still in development, with limitations around model computations, supported output types, and the relationship between its optimized implementation and the formally verified protocol. The company has not announced plans to deploy FlashProve inside Claude or any commercial service.

If adopted, FlashProve would make claims like "this answer came from model X" checkable, whether for a developer asserting that a cybersecurity model scanned its code or for researchers confirming which model ran in a benchmark. But identity is not accuracy, and it says nothing about training data; the open question is whether any major provider will publish fingerprints and absorb the proof-generation cost.