Anthropic has unveiled an open-source system called FlashProve that uses cryptographic proofs to confirm a given output genuinely originated from a specific model—so even vendors swapping models would be exposed, and the fingerprint doesn't leak model weights. For now, only specifications and code exist, with no deployment plans.

On November 3, Anthropic announced in a blog post a system called FlashProve, which performs "verifiable inference": given a model output, it uses cryptographic methods to prove the output truly came from a specific model. The technical specification has been released, and the code for related components is published on GitHub under an open-source license. Anthropic itself states plainly in the post that this is only an interim update, not a complete research agenda, and that there are no plans to deploy it on any model.

What It Aims to Prevent: "Who Is Answering on Your Behalf"

The scenario is very concrete. You call an API labeled with a flagship model—is the returned answer really generated by that model? Anthropic researchers offered several examples: an AI company might, to cut costs, quietly swap an expensive model for a cheap one; or, to game the leaderboards, swap a cheap one for an expensive one to inflate benchmark scores. Going one layer further, third parties can also fake it: a developer says "my codebase was scanned by a frontier safety model," a company says "this business plan was reviewed by an appropriate model"—on what basis should users believe them?

What FlashProve aims to do is make such claims independently verifiable, rather than relying on the other party's self-attestation. The analogy is email's DKIM signature, where the recipient can confirm an email truly came from the domain it claims. The difference lies in the threat model: DKIM guards against impersonators, whereas FlashProve also guards against the vendor running the model itself—the party most capable of cheating and most motivated to cheat.

Fingerprints Don't Reveal Weights—the Prerequisite for Commercial Viability

Image source: TechCrunch

The implementation path is that model vendors publish a "fingerprint" for each released model, after which specific outputs can be matched against the fingerprint and cryptographically verified. The most critical point is that the fingerprint does not expose model weights. Weights are the most valuable asset of closed-source vendors; both Anthropic and OpenAI depend on them. If verification can be done without leaking weights, commercial models might adopt this system; otherwise, it's just a toy for open-source models. The design also requires it to be lightweight enough that verification can run locally on-device, without sending outputs to third-party servers.

If this design holds up, the beneficiaries won't just be end users. Bidding, auditing, and model-source verification on content platforms could all shift from "vendor claims" to "checkable credentials." Conversely, it would also make model pricing more transparent: if users can verify which tier of model they're getting, the room to sell high prices through vague model naming would be compressed.

An Unsolved Problem: Who Issues the Fingerprints

The limitations are equally obvious. The system's premise is that vendors voluntarily publish fingerprints. Without publication, verification is impossible; only with publication does a constraint form—and there is no enforcement mechanism in between. Compared with the C2PA standard in content provenance, which addresses "what device or software generated this image or video," FlashProve addresses "which model is behind this text." The two are complementary, but neither solves the same problem: whether the faker is willing to cooperate.

Anthropic's own wording also leaves room, saying it published this in the hope that others will take it and improve it. In other words, it's more like a public methodology draft than a product that can be integrated today. The technical specification still has a pile of engineering questions to fill in: how fingerprints correspond to batching, quantization, and distilled versions of inference services; how old fingerprints expire after model iterations—none of which a single research blog post can resolve.

China's Perspective: Labeling Measures Have Already Been Running for a Year

China hasn't been late on this track, but the direction differs. The "Measures for Labeling AI-Generated Synthetic Content," effective September 1, 2025, require service providers to add explicit and implicit labels to AI-generated text, images, audio, and video—the former being prompts users can see, the latter written into file metadata. This is the administrative regulatory path: first define obligations, then require verifiability.

Anthropic takes the technical path: it doesn't mandate who must label, but makes "proving who I am" a computable matter. The shortcomings of both paths are clear. The administrative path relies on platform enforcement and spot checks; once content crosses platforms or borders, it basically fails. The technical path relies on vendor voluntariness, lacks enforceability, and still needs industry standards to unify fingerprint formats.

The real intersection lies one step ahead. If someday regulators require generated content to carry verifiable credentials, then who provides this cryptographic infrastructure will turn from a research topic into an industry issue, dragging in chips, cloud services, and standards bodies. If Chinese large-model vendors go overseas, they will face the EU AI Act's transparency provisions and content moderation on major platforms, all asking the same question: how do you prove this output was generated by your model? Answering that question won't rely on PR statements.

Today's Quote

“The administrative path demands 'you must label'; the technical path enables 'I can prove.' The former relies on enforcement, the latter on voluntariness. The trust problem of AI content will ultimately land at the intersection of the two paths.”

Follow [DeGaoxing Zhixinglang], three hardcore tech interpretations a day, to understand the industry and national fortunes behind technology.

Long-press to recognize the QR code and follow [DeGaoxing Zhixinglang]