Anthropic Builds a Way to Prove Which AI Model Answered You

Anthropic has released an open-source research prototype designed to let someone verify that an AI answer came from the model the provider claims to be running. The work, published on 2 November, addresses a problem that ordinary chatbot users cannot readily see. A service could quietly substitute a cheaper model, or a compromised system could alter the response, while the text still looks plausible.

The prototype is called FlashProve. It uses a cryptographic proof alongside a model’s output so a separate verifier can check that the response is consistent with a specified set of model weights. The verifier does not need access to those weights. That matters for commercial models, whose providers generally do not want to reveal the underlying parameters merely to prove which system produced a reply.

Anthropic says its demonstration works with a 400-billion-parameter mixture-of-experts model using four-bit quantised weights. On a single H100 GPU, it reports proof generation at more than 100 tokens a second, with a proof of roughly 19 MB for a 1,024-token request. The achievement is technical rather than a new Claude setting. Those proof sizes and the reported 70-to-95-fold GPU cost compared with ordinary inference remain substantial barriers to routine use.

The distinction from an AI watermark is important. A watermark attempts to leave a detectable pattern in generated content, often to help identify whether text may have come from a model. TechBooky has explained the limits of Claude’s watermarking approach. Provable inference asks a narrower and stronger question about a specific transaction. It aims to establish that this particular output was produced by the stated model under a defined computation.

The case for such proof grows as AI is embedded in business software. A company might pay for access to a premium model but have little independent way to know whether a routing service used it on every request. An auditor could also want evidence that a system evaluated for safety was the one actually deployed. Cryptographic verification could create a check beyond a provider’s own logs and assurances.

That does not mean the prototype proves an answer is true, safe or fair. A correctly identified model can still make mistakes. Nor does it establish that every part of a complex agent’s workflow was trustworthy. The proof concerns the model computation described by the protocol. Organisations would still need to assess input data, surrounding software, permissions and the actions taken after the model responds.

Anthropic has published a technical report, protocol description, executable code, verification tools and formal proofs, inviting others to test and improve the approach. It describes the release as intermediate research rather than a completed system. That openness makes independent scrutiny possible, but the performance claims will need to be reproduced and the design stress-tested across more models and deployment settings.

If the efficiency improves, provable inference could change the relationship between AI customers and providers. Instead of taking a model label on trust, a customer might be able to check it. For now, FlashProve is evidence that the problem can be tackled, not proof that the industry has solved the cost and complexity of doing it at scale.