Anthropic is working on a system to prove AI models’ identity

The researchers compare the mechanism to cryptographic email signatures, which let recipients confirm a message came from its claimed sender. They argue it would hold up against impostors passing one model off as another, including the lab that builds and operates the model. Two concrete misuse cases are called out: a provider secretly substituting a cheaper model to cut costs, or swapping in a more expensive one to inflate reported performance.

FlashProve could also back third-party verification claims. The researchers offer examples: a developer asserting that a library was scanned by a frontier cybersecurity model, or a company claiming a business plan was approved by an appropriate model. In both cases, the system is designed to let a user check the claim independently.

Mechanically, the system depends on AI labs publishing a "fingerprint" for each model they release, which can later be matched against specific outputs and verified cryptographically. Critically, the researchers state these fingerprints do not reveal a model's weights — the internal numbers that define a model's behavior and that closed-model makers like Anthropic and OpenAI keep private. Because the fingerprint and weights are decoupled, labs could publish fingerprints while retaining their most valuable asset, making the system workable for commercial models. The design is also meant to be lightweight enough that verification could run on a local device.

Alongside the announcement, researchers released a detailed technical specification and working code for various elements of the system, available publicly under an open-source license on GitHub. But the work is explicitly unfinished. Research is ongoing, and there are no plans to deploy FlashProve at Anthropic or any other lab. "This research post is meant to share intermediate progress, and not a completed research agenda," the researchers write, adding that they released it with the goal that others "take it, and improve it."

What to watch next turns on adoption rather than code: whether competing labs will publish fingerprints at all, given that verification only works if providers opt in, and whether any deployment — inside Anthropic or elsewhere — follows the current research-only status. Open questions also include how quickly the spec hardens into something stable enough for third parties to rely on, and whether external auditors or customers begin demanding model-identity proofs as a condition of trust.

FlashProve sits alongside a broader industry push toward verifiable AI outputs. Anthropic's announcement frames it as an early, shareable step rather than a shipped feature, signaling the company wants outside scrutiny and contributors before any production commitment.