The mechanism is what researchers call “provable inference” — a cryptographic proof tying an output to a specific model. Anthropic said labs would publish a model “fingerprint” that can later be checked against responses. The company also said those fingerprints would not disclose the model’s weights, the internal parameters that closed-model providers guard closely.
That last detail matters more than the research poetry around trust. If verification required exposing a model’s weights, most major labs would never do it. Anthropic is trying to design around that obstacle, which is the difference between an academic exercise and something a commercial provider might eventually tolerate.
The company framed one use case with unusual bluntness: stopping an AI lab from quietly swapping in a cheaper model to cut costs, or a different model to flatter benchmark results. That is not paranoia dressed as engineering. It is an admission that, in a market built on opaque infrastructure and subscription pricing, the buyer often cannot tell whether the promised service and the delivered service are the same thing.
FlashProve could also let third parties verify narrower claims, Anthropic said, such as whether a piece of software was scanned by a particular cybersecurity model or whether a document was reviewed by a specified system. In other words, it is less about making AI smarter than making AI claims harder to fake.
There are limits. Anthropic said the work is incomplete, released technical specifications and code under an open-source license on GitHub, and added that there are no plans to deploy FlashProve at Anthropic or any other lab. So this is not evidence that model authentication is about to become standard. It is evidence that Anthropic thinks the trust problem is real enough to warrant cryptography.
For an industry fond of asking users to believe first and inspect never, that is a fairly candid place to stop.
Isla Camilleri 
Dua Mifsud 
Harvey Jr. 
Sophia Borg