Proving Which AI Model Actually Answered You

Your software vendor says their product is powered by a named frontier model. You pay accordingly. There is no step anywhere in that transaction where you find out whether it is true, and no system in production anywhere would tell you.

What was announced

On 2 November Anthropic published FlashProve, an open-source system for what it calls provable inference, developed by its Frontier Red Team with researchers at EPFL, MIT and StarkWare. The release is Apache 2.0 and includes a technical report, a protocol specification, working prover and verifier code, and Lean 4 proofs of the protocol security properties. That boundary matters: the proofs cover the protocol and the verifier written in Lean, while the fast C++ verifier and CUDA prover are tested against the protocol rather than proved, and Anthropic does not guarantee that the Lean specification, the paper and the fast code all agree.

The mechanism has three steps. A provider publishes a commitment, which is a fingerprint binding it to one exact set of weights without revealing them. For each response, the provider GPU produces a proof that the response is what those committed weights produce from that prompt. Anyone holding the commitment can then verify the proof on an ordinary CPU, in seconds, without access to the weights. The repository is explicit that the commitment has to come from a party you trust rather than from the server you are checking.

The threat model is specific. Anthropic names a model secretly substituted by a routing service for cost reasons, and an attacker who has tampered with the token stream. Both are cases where the customer currently has no independent way to detect what happened.

What the numbers say

The benchmarks come from Anthropic own testing on Llama 4 Maverick, a 400 billion parameter mixture-of-experts model, and have not been independently reproduced here.

The asymmetry is the interesting part. Verification is cheap and proving is enormously expensive, which means the economics only ever work if a provider has a strong reason to absorb that cost. Regulatory obligation is the most plausible one, and Anthropic says as much, framing provable inference as relevant to verifying compliance with commitments rather than to everyday consumer trust.

What it does not prove

Three limits matter more than the performance figures, because they would still apply to a fast version.

The proof identifies a commitment, not a brand name. It establishes that some specific set of weights produced the answer. Connecting that commitment to the product named on your invoice is a separate act of trust in whoever published the mapping, and no amount of cryptography removes it. The repository is blunt about the consequence: the provider chooses what it commits to, and a verification pass does not say whose weights they are or which real model they represent.

Attestation arrives after the computation. Proofs are generated once the response already exists, so an application has to tolerate the delay and keep enough request data to match responses against proofs later. It can still gate release: the vLLM integration that ships holds back the response until every proof in its batch has verified. What it cannot do is undo what already happened to your prompt.

The proof is also about an integer, fixed-point version of the model rather than the floating-point one normally served. How closely the two track each other is a measurement rather than a guarantee, and Anthropic reports one measurement in which the top token differed at 6.81% of positions.

And the guarantee covers the computation, not the surroundings. It tells you the committed weights produced that output from that prompt. It says nothing about what happened to your prompt before it arrived, how your data is retained, or who at the provider can read it, which remain contractual questions of the kind set out in what AI terms of service actually say.

The part that applies to you now

Strip away the cryptography and a plain commercial point remains. A serious lab spent significant research effort on the problem of not being able to tell which model answered, which is a reasonable signal that the gap is real and that the people closest to the infrastructure consider it worth closing.

Most Canadian businesses do not buy from a frontier lab directly. They buy a SaaS product with AI inside it, and that product buys through an aggregator or a router. Each hop is somewhere a cheaper model can be substituted without anybody lying, because the contract never specified which model.

That is fixable with ordinary contract language rather than new technology. Name the model and version. Require notice before it changes. Say what happens if the change degrades the output you are paying for. These belong in the same conversation as the rest of your service level terms, and vendors who intend to route freely will tell you so when asked directly.

Then build the test. A small set of representative prompts with answers you have already checked and explicit scoring criteria, re-run regularly by a person. Be clear about what that buys you. It flags quality drift whatever the cause, and it does not establish which model ran, because Anthropic own framing of the problem is that judging identity from output alone is unreliable even when the output is good. Building the set is the same exercise as a proof of concept done properly, and the set you already have can be reused.

Frequently Asked Questions