You can't shake an AI model's hand. That's Anthropic's opening line, and the whole problem statement for FlashProve, an open-source system the company published Tuesday that attaches a cryptographic receipt to AI model outputs — proof that a given answer came from the model you think you're using, not one swapped in behind the scenes.

As TechCrunch reports, the system uses zero-knowledge proofs to let a provider publish a short "fingerprint" of a model's weights — revealing nothing about the weights — and then prove each response came from exactly that committed model. Verification is light enough to run locally; labs keep their most valuable asset. Think email signature, not watermark.

The fraud it kills is everywhere trust stands in for proof. A routing service could quietly serve a cheaper model while billing for the premium one. "A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model," the researchers write — "How can a user verify these claims?" Add the adversarial cases: a compromised inference server, or a more capable model substituting for the weaker one it was authorized to be, to dodge monitoring. In both, the receipt stops being a nicety.

This is more than a whitepaper because Anthropic shipped working code: five artifacts under Apache 2.0, including a protocol spec Claude wrote itself, a prover with two verifiers, and Lean formal proofs. A single H100 generates proofs at ~110 tokens per second for a 400-billion-parameter model — far faster than prior open attempts. The catch: proving still costs roughly 70 to 95 times the GPU time of running the model at all. Verification is cheap; the proof itself is expensive.

So why now? "Which model answered" is becoming a regulatory question. Anthropic names four fronts: pacing AI development (proving hardware serves inference, not secret training), tamper detection, text provenance, and enforcing that only approved-safe models get served. The proofs can't show a lab isn't also training on the side — but they close the cheapest kind of cheating: lying about who answered.

The test isn't the math. Anthropic calls it "intermediate progress," released so others will "take it, and improve it," with no deployment plans anywhere. If labs actually publish model fingerprints, this becomes the first practical answer to AI's identity crisis. If they don't, it's a very fast proof of a very expensive nobody.

— via TechCrunch