Anthropic Researchers Outline a Way to Verify Which AI Model Answered

Prepared with input from our partners

Anthropic researchers have shared early work on checking which AI model really produced an answer. There are no plans to deploy it at Anthropic or any other lab.

Early research, public code

The system is called FlashProve and is open source. It was announced in a blog post. Alongside the post, the team put out a specification and working code covering parts of the system. Both sit on GitHub under an open source license.

Research on the system is ongoing. The authors call the post a share of "intermediate progress, and not a completed research agenda", and say they want others to take the work and improve it.

Catching a quiet model swap

The researchers name two abuses it could prevent. An AI company could secretly swap in a cheaper model to cut costs. Or it could swap in a more expensive one to inflate its performance results.

That protection is meant to hold even if the lab behind the model is the one faking it.

Third parties could use it too. The researchers write that a developer might say a frontier cybersecurity model checked their library for vulnerabilities, or a company might say a suitable model signed off on its business plan. "How can a user verify these claims?" they ask.

How a proof would work

The goal is "provable inference". That is a cryptographic proof, in effect a mathematical guarantee, tying an output to one specific model. It resembles a cryptographic email signature, which lets a recipient confirm the claimed sender.

Labs would have to publish a "fingerprint" of each model they release. Anyone can then check, cryptographically, that a given output matches that fingerprint.

Fingerprints do not reveal a model's weights. Those are the internal numbers that govern a model's behavior, which closed-model makers such as Anthropic and OpenAI keep private. Labs could therefore publish fingerprints and still protect their most valuable asset, and the system could work with commercial models. It is also designed to be light enough for verification on a local device.

Our Take

Everything hinges on a step that only labs can take: publishing a fingerprint for each release. Nothing in the announcement says any lab has agreed to do so, including Anthropic. Adoption by a second lab, or a third-party check of the published code, would show whether the idea can move beyond a research post.

Source: TechCrunch