How can an enterprise verify which artificial intelligence model a cloud provider actually ran behind an API endpoint?
Anthropic is working on an open source system called FlashProve to verify which AI model produced a given output, according to a blog post published Tuesday. The architecture provides what researchers call provable inference, creating a cryptographic proof that serves as a mathematical guarantee that a specific response came from an exact model. It is designed to let users confirm that the output received really originated from the system they intended to use. This cryptographic framework directly targets the risk of unauthorized model substitution, where providers might secretly swap in a cheaper model to cut computational costs or use a more expensive model to artificially inflate benchmark performance.
Cryptographic Fingerprints and Proprietary Weights
The fundamental obstacle in enterprise AI auditing has been verifying model identity without exposing proprietary commercial assets. How can a vendor prove model provenance when the underlying neural weights remain strictly proprietary trade secrets?
To operate, FlashProve requires AI labs to publish a fingerprint of each model they release, which can subsequently be matched to specific outputs and verified cryptographically. Crucially, these fingerprints do not reveal a model's weights, the internal numbers that dictate how it behaves and which closed-model developers like Anthropic and OpenAI keep private. By isolating identity verification from internal parameters, labs can release verifiable mathematical markers while fully protecting their core intellectual property.
"A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that its business plan was given the go-ahead by an appropriate model. How can a user verify these claims?"
Researchers note that third parties frequently make performance claims, such as scanning code libraries with advanced frontier security models or validating corporate strategies, which clients currently have no technical means to verify. Similar to cryptographic email signatures that verify sender authenticity, FlashProve is built to remain robust against impostors attempting to disguise one model as another, even if the impostor is the lab that built and hosts the model itself.
Implementation Reality and Open Source Status
Beyond verification robustness, the operational cost of auditing represents a key constraint for production pipelines. FlashProve is designed to be lightweight, enabling verification to run directly on a local device without requiring secondary compute clusters. Anthropic researchers have published a detailed technical specification and functional code for various elements of the system under an open source license on GitHub.
However, a significant gap remains between open source specifications and commercial deployment across cloud infrastructure.
"This research post is meant to share intermediate progress, and not a completed research agenda. We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it."
Research into the system remains ongoing, and there are currently no plans to deploy FlashProve at Anthropic or any other commercial lab. Until model providers commit to integrating cryptographic fingerprints into production APIs, the central question of how an enterprise can independently prove which model a provider delivered remains unresolved in commercial practice.
What’s behind it
The risk of paying for a flagship AI model while quietly receiving output from a cheaper system will remain until cloud providers start cryptographically signing every inference call. The open-source FlashProve framework solves this friction mathematically by checking digital fingerprints locally without forcing vendors to expose proprietary weights. Yet a wide gap remains between experimental code on GitHub and enforceable service contracts, as providers have made no commitments to integrate these proofs into their production APIs. A neat mathematical fix for API trust is now public, though its creators have no immediate plans to deploy it across their own paid endpoints.