Anthropic is developing an open-source tool called FlashProve that could expose AI companies secretly using Claude to generate responses while claiming the answers came from their own models. Introduced on November 2, 2026, the system uses cryptographic technology to allow users to mathematically verify which AI model produced a response.
Currently, users generally have to trust companies when they claim a particular model produced an answer. Anthropic states that an AI provider could secretly replace an expensive model with a cheaper alternative to reduce costs, or use a more powerful model during benchmark testing to make its own system appear better. FlashProve aims to prevent such misrepresentation by requiring companies to publish a unique cryptographic fingerprint for each model. When a model generates a response, the provider produces a mathematical proof linking that output to the fingerprint. Users can then verify the response, and the verification should fail if a different model generated it.
While Anthropic has not explicitly linked the project to Chinese AI companies, the tool could address practices the company has previously accused Chinese competitors of using. In September 2026, Anthropic accused Moonshot AI of secretly routing nearly 300,000 Kimi customer requests to Claude over ten days, primarily using its Opus models. Anthropic alleged that Moonshot accessed Claude through 5,380 fraudulent accounts, mostly appearing to operate from Singapore and Japan, and accused the company of saving conversations and extracting Claude’s reasoning data to improve its own models.
Earlier in February, Anthropic accused DeepSeek, Moonshot, and MiniMax of conducting large-scale model-distillation campaigns involving more than 16 million exchanges through approximately 24,000 fraudulent accounts. Model distillation involves using responses from a more capable AI system to train another model. Anthropic says unauthorized extraction of Claude’s capabilities violates its terms. In September, Anthropic also accused Alibaba, Zhipu, and Xiaomi of similar activities and alleged that DeepSeek had secretly forwarded some customer requests to Claude. Anthropic notes these remain allegations rather than independently established findings.
A major advantage of FlashProve is that companies can verify their models without revealing their internal weights, which Anthropic and OpenAI generally keep private. The system is designed to support lightweight verification on local devices, though generating the proofs requires considerably more computing power. Beyond identifying models, FlashProve could help verify claims made by companies using AI for professional tasks, such as cybersecurity scans or business plan reviews, and help researchers verify models used during benchmark testing. However, Anthropic notes that proving a model’s identity does not guarantee that its answers or conclusions are accurate.
Anthropic has demonstrated FlashProve using Meta’s Llama 4 Maverick, a 400-billion-parameter model. Using four-bit quantized weights and a single Nvidia H100 GPU, the system generated proofs at approximately 110 tokens per second. For a request containing 1,024 tokens, the proof was approximately 19MB and could be verified on a CPU within seconds. However, proof generation required approximately 70 to 95 times more GPU computation than comparable inference using vLLM, which Anthropic identifies as a major obstacle to widespread adoption.
Anthropic has released FlashProve’s technical specification, mathematical research, and working code on GitHub under an open-source license. The company states the project is still in development and has limitations involving model computations, supported output types, and the relationship between its optimized implementation and formally verified protocol. Anthropic has not announced plans to deploy FlashProve in Claude or any other commercial AI service, stating instead that researchers are making the technology available so others can study, test, and improve it. Anthropic notes that FlashProve would not independently prove unauthorized model distillation or identify the training data used to build competing AI systems.
