Anthropic is working on a system to prove AI models’ identity

Right now, when you call a model through an API or a reseller, you take it on trust that the model you asked for is the one that answered. A provider could quietly swap in something cheaper, and judging by output quality alone is unreliable.

Anthropic is publishing an open-source research prototype called FlashProve that aims to change that with "provable inference": a cryptographic proof that a specific output came from a specific, committed set of weights, without revealing those weights. According to TechCrunch, the design is meant to hold even when the party trying to cheat is the lab running the model.

This is research, not a product. Anthropic says there are no plans yet to deploy it at Anthropic or anywhere else. But it moves a long-theoretical idea much closer to practical.

We think this is one of the more quietly important things a frontier lab has shipped in a while, precisely because it's aimed at the lab's own trustworthiness. Most AI accountability tools ask users to trust the company's word. This one is built so you don't have to.

The practical case is strong. Developers routing calls through third parties can't verify what they're paying for. The researchers point to claims a developer or company might make, for instance that a library was scanned for vulnerabilities by a frontier security model, which today no one can check. Regulators who want to enforce rules about which models get served have no technical way to check. A proof that verifies on an ordinary CPU, as MarkTechPost reports, is the kind of thing that could plug into all of those.

Now the honest costs. MarkTechPost, working from the repository's performance guide, reports proving runs roughly 70 to 95 times the GPU time of plain inference, with context capped at 1,024 tokens and support limited to greedy decoding and mixture-of-experts models for now. Proofs are around 18.78 MB and take about 17 seconds to verify. That's a huge leap over earlier open zkML systems, and still far too expensive to wrap around everyday chat traffic.

So the near-term use is spot checks and high-stakes claims, not every reply. I'm fine with that. Auditing doesn't need to be universal to change behavior; it needs to be possible. If a provider knows any response might be challenged, swapping models quietly gets riskier.

The downside to watch is the other direction this can scale. The same machinery that lets a user check a provider also lets a regulator confirm what hardware is serving which approved models. MarkTechPost lists that among Anthropic's stated use cases. That can be good governance. It can also become a licensing chokepoint. Anthropic sharing this openly, and inviting others to improve it, is the right way to start that conversation.

FlashProve comes from Anthropic's Frontier Red Team and uses a zkSNARK, a type of zero-knowledge proof. A lab publishes a fingerprint, or commitment, for a model's weights, and each response can then be proven to come from that committed model. Anthropic released a specification and code under an open-source license and formalized the protocol's security properties in the Lean proof assistant. The benchmarks reported were run on the public Llama 4 Maverick weights, not an Anthropic model.