Right now, when you call an AI API, you take the vendor’s word for which model answered. Anthropic wants to change that. According to TechCrunch, the company is working on an open source system called FlashProve that would let anyone verify that an output came from a specific model.
The researchers call the goal “provable inference.” The idea is a cryptographic proof, essentially a mathematical guarantee, tying an output to a particular model. Think of an email signature that confirms the sender. The difference is that the guarantee has to hold even against the lab running the model. That is the hard part, and the interesting one.
The researchers point to two obvious abuses it would catch: a provider quietly swapping in a cheaper model to save money, or a pricier one to pad benchmark results. Anyone paying per token for a premium model, whether through Anthropic, OpenAI, Google, or a reseller, has wondered about the first. Third-party claims matter too. A developer might say a frontier security model scanned their library, or a company might say a model approved its business plan. As the researchers ask, “How can a user verify these claims?”
The mechanism relies on labs publishing a “fingerprint” for each released model. Outputs can later be matched to that fingerprint and checked cryptographically. Crucially, the fingerprint doesn’t reveal the model’s weights, which closed-model makers guard closely. So a commercial lab could participate without handing over its most valuable asset. The system is also built to be lightweight enough that verification can run on a local device.
Anthropic released a detailed technical specification and working code for several components on GitHub under an open source license. But don’t expect to use it soon. Research is ongoing, and there are no plans to deploy it at Anthropic or any other lab. The researchers call the post “intermediate progress, and not a completed research agenda,” and say they want others to “take it, and improve it.”
So is this noise? Not entirely, but it’s early. Verifiable inference has been explored in crypto and academic circles, mostly with heavy zero-knowledge approaches that are too slow for large models. A lightweight scheme that works with closed weights would be a real step if it holds up under outside scrutiny. That’s the open question.
The bigger point is the trend. As models get routed, distilled, and resold through layers of middlemen, model identity is becoming a procurement and compliance issue, not a curiosity. Enterprises and regulators will eventually ask for proof, not promises. For now, developers should watch the repo, not rewrite their stack. Adoption by other labs would be the signal that this matters.
