Has your model been swapped? Anthropic wants to prove it to you with cryptography

Anthropic has announced FlashProve on X, with the code open-sourced at the same time. The problem it aims to solve is very specific: when you call a certain model, how do you prove that the returned result really came from that model, rather than being swapped by an intermediary for a cheaper version?

FlashProve is based on existing cryptographic techniques and lets developers verify whether a response was generated by a specified model. Anthropic says it is much more efficient than previously open-sourced methods, though the tweet does not give a specific multiplier. The related paper and explanation are here, and the code is on GitHub.

The pain point here is very real. Model services often go through third-party hosting, API resale, and evaluation platforms. When you pay to call a certain model, it is hard for an ordinary caller to detect whether an intermediary has secretly swapped it. Relying on service providers to police themselves is unreliable; cryptography can at least leave evidence.

Anthropic lists two types of applications. First, making chat hijacking harder: if an attacker tampers with a response, the proof can reveal that the response did not come from the target model. Second, safety evaluation: whether the model tested by evaluators is the same one customers actually call. Anthropic believes that future progress in verifiable inference will directly affect trust in AI deployment.

A cold shower first: FlashProve proves provenance, not correctness. The answer can still be wrong, and the model can still make things up. It addresses model swapping and blame-shifting, not fact-checking.

The limitations also need to be made clear. Some replies pointed out that FlashProve is still a research prototype and currently only supports greedy decoding. Another issue is how independent evaluators can confirm that the submitted weights are exactly the published model; this layer of trust has not been fully eliminated.

In the replies, Wayne L. said the evaluation scenario concerns him most: people choose models based on evals, and then can only trust that the model served by an endpoint is the same one. He also wants a video version, to prove that a clip really came from the avatar model it claims to come from.

Among community reactions, some value the third-party hosting scenario most. When an open model is placed on a third-party host, currently you can only trust that the host is running the model it claims to be running. Others put it bluntly: the answer can still be wrong, but now you can't blame it on a cheaper model. Open source is another point repeatedly mentioned; other teams can try to break or improve this proof system.

The original post is here.