Anthropic develops FlashProve to cryptographically verify AI outputs

The concept of proven inference

Anthropic is developing an open system called FlashProve to address a growing need for transparency in artificial intelligence. The system is designed to provide users with mathematical confirmation that a specific AI model produced a particular response. This approach, which the researchers call "proven inference," seeks to establish a clear chain of custody for digital content.

The goal is to create a verification process that functions similarly to a cryptographic signature on an email. Just as a signature confirms the sender of a message, FlashProve would allow a user to verify that a response truly came from the claimed model. This prevents a situation where a different model might be impersonating the one the user intended to use.

By providing this level of certainty, the system aims to build trust in AI-generated outputs. It ensures that the performance a user experiences is actually tied to the specific technology they are paying for or relying on. This moves the industry toward a standard where the identity of the underlying model is verifiable rather than just assumed.

Preventing model substitution

One of the primary problems FlashProve intends to solve is the potential for developers to secretly substitute models behind an interface. A company might covertly use a cheaper model to reduce its operational costs while still charging users for a high-end experience. Conversely, a developer could use a more expensive model than advertised to artificially inflate its performance metrics.

FlashProve acts as a safeguard against these types of deceptive practices. If a system is cryptographically verified, a laboratory cannot swap out the underlying engine without breaking the verification. This creates a layer of accountability for the laboratories that develop and host these large-scale models.

The researchers suggest that this verification could also be used for third-party claims. For instance, a developer could prove that a software library was scanned for vulnerabilities by a specific advanced cybersecurity model. A business could also confirm that a specific plan was reviewed and approved by a designated AI model.

Fingerprints and private weights

To make FlashProve functional, laboratories would need to publish a digital fingerprint for every model they release. These fingerprints act as unique identifiers that can be matched against specific responses to verify their origin. However, the system is designed to protect the intellectual property of the model developers.

Crucially, these fingerprints do not disclose a model's weights. Weights are the internal numerical parameters that determine how a model behaves and what it knows. Because these are usually kept private in commercial developments, the fingerprint provides a way to verify the model without exposing its secret architecture.

By separating the verification of the model's identity from its internal data, FlashProve offers a middle ground for the industry. It allows for public accountability while maintaining the competitive advantages that companies seek when building proprietary AI. This balance is essential for the widespread adoption of verifiable AI systems.

Open source and future steps

The researchers have already taken steps to make this technology accessible by publishing a technical specification. They have also released working code for individual components of FlashProve on GitHub under an open license. This allows other developers and researchers to examine the logic and begin building upon the framework.

While the code is available, Anthropic has stated that work on the system is still ongoing. There are currently no plans to implement FlashProve at Anthropic or any other laboratories immediately. The project currently serves as a foundational framework for how cryptographic verification might work in the future.

The development of FlashProve represents a move toward a more structured and verifiable AI ecosystem. As the technology matures, it may become a standard tool for auditing AI outputs. For now, it remains a technical proposal that highlights the growing importance of provenance in the age of generative models.