Anthropic's open source FlashProve can prove which model wrote a response. It is a prototype, so check your AI provider yourself for now

You pay for a specific model. Today you have no proof that model is the one answering.

What happened

Anthropic published research on provable inference and released FlashProve, an open source prototype under the Apache 2.0 license. The idea: a model provider publishes a commitment to its weights, a short fingerprint that pins down the exact model while keeping the weights hidden. Each response can then come with a proof that the committed model produced exactly those tokens from that prompt. Anyone with the commitment, prompt and reply can check it without the weights.

Anthropic names the problem directly: a user cannot check that a response came from the model a developer claims, as opposed to one secretly substituted by a routing service for cost reasons, or by an attacker tampering with the token stream.

It is not cheap yet. For Llama 4 Maverick, a 400B parameter mixture of experts model in 4 bit weights, a single H100 GPU generates proofs at around 110 tokens per second, with proofs of about 19 MB per 1,024 token request. That is roughly 70 to 95 times the GPU time of running the model on vLLM. TechCrunch reports there are no plans to deploy it at Anthropic or any other lab, and Anthropic calls it intermediate progress.

My take

This is research, not a feature you can switch on. But the problem it targets is real for anyone running client workflows through third party routers or resellers.

Until something like this ships, I treat model identity as something to monitor, not assume:

1. Log the model name the API returns on every call, next to the model you requested, and alert on any mismatch.
2. Keep a small fixed test set for each AI step, 10 to 20 real examples, and run it on a schedule. A sudden drop in quality is your signal something changed.
3. For high stakes steps like pricing, legal text or customer replies, call the model provider directly rather than through a router you cannot audit.

None of this proves anything cryptographically. It does mean a silent model swap shows up in a dashboard within days instead of in a client complaint.