Anthropic is building an open-source tool that could reveal when an AI company quietly uses its Claude model to produce answers while telling customers the response came from its own system. Called FlashProve, it uses cryptographic techniques to check which model actually generated a piece of text, turning a claim users have so far had to take on trust into something that can be tested. The idea matters because modern language models often write in similar, fluent styles, so reading an answer alone rarely settles which system produced it. Anthropic has not directly tied the tool to any particular rival, but it arrives amid its accusations that several Chinese laboratories used Claude without permission. Those accusations remain Anthropic’s own claims, not independently established findings, and FlashProve itself verifies a model’s identity rather than proving how a rival model was trained.
Chinese AI Companies Accused
In a September 2026 report, Anthropic alleged that Moonshot AI secretly routed almost 300,000 requests from users of its Kimi service through Claude over ten days, presenting the answers as Kimi’s own. It said Moonshot reached Claude through 5,380 fraudulent accounts that mostly appeared to operate from Singapore and Japan, and that the company saved conversations and extracted Claude’s reasoning to improve its own models. Earlier, in February, Anthropic accused DeepSeek, Moonshot and MiniMax of large-scale model-distillation campaigns involving more than 16 million exchanges through roughly 24,000 fraudulent accounts. Distillation means using a stronger system’s responses to train another model; it has legitimate, permitted uses, but Anthropic argues that unauthorised extraction of Claude’s capabilities breaks its terms. In September it also accused Alibaba, Zhipu and Xiaomi of similar activity and alleged DeepSeek had secretly forwarded some customer requests to Claude.
How Anthropic’s FlashProve Works
Anthropic introduced FlashProve on November 2, 2026, as a system for provable inference: a provider can offer proof, alongside an answer, that a particular model produced it. At present users generally must trust a provider’s statement, since an answer carries no reliable signature of its origin. That opens the door to quiet substitution, whether a provider swaps an expensive model for a cheaper one to cut costs or uses a stronger model than advertised during benchmark testing to make its product look better. FlashProve tackles this with cryptographic verification. A company publishes a unique cryptographic fingerprint linked to each model, and when the model answers, the provider can produce a mathematical proof connecting the response to that fingerprint. Users can then check whether the answer genuinely came from the advertised model; if another model produced it, verification should fail.
AI Companies Won’t Need to Reveal Their Models
A key feature of the design is that a company can prove which model answered without revealing the model’s internal weights, the numerical values that shape how a system processes information and produces language. Leading developers such as Anthropic and OpenAI generally keep their most capable models’ weights private for commercial and safety reasons, and FlashProve lets providers publish fingerprints without exposing that proprietary information. Verification does not therefore require a company to hand over the asset it is protecting. The system is also designed for lightweight verification on local devices, so checking a proof need not demand powerful hardware, even though generating proofs takes considerably more computing power.
FlashProve Could Also Detect Misleading AI Claims
Beyond a single answer, FlashProve could verify claims by companies using AI for professional work. A developer might claim an advanced cybersecurity model scanned its software for vulnerabilities, or a firm might advertise that a powerful system reviewed its business plan, yet customers and regulators currently have little way to confirm the advertised system did the work. FlashProve could supply mathematical evidence of which model performed the task, and help researchers verify the models used in benchmark testing, making secret substitution harder. There is an important limit, however: proving a model’s identity does not guarantee its answers are correct.
Anthropic Tests FlashProve on a 400-Billion-Parameter Model
Anthropic demonstrated FlashProve using Meta’s Llama 4 Maverick, a model with 400 billion total parameters. Using four-bit quantised weights and a single Nvidia H100 graphics processor, it generated proofs at roughly 110 tokens per second. For a request of 1,024 tokens, the proof was approximately 19 megabytes and could be verified on an ordinary processor within seconds. The difficulty is generation: producing a proof required roughly 70 to 95 times more graphics-processing computation than comparable inference using vLLM, a common serving system. That extra cost is a major obstacle to widespread use.
FlashProve Is Open Source but Still Experimental
Anthropic has released FlashProve’s technical specification, mathematical research and working code on GitHub under an open-source licence, inviting researchers to study, test and improve it. The company says the project remains in development, with limitations involving model computations, supported output types and the relationship between its optimised implementation and its formally verified protocol. It has not announced plans to deploy FlashProve inside Claude or any other commercial service; instead the technology is available for critical examination by others, which suits its purpose, since a verification system gains credibility when it is open to independent scrutiny rather than controlled by one vendor. If it matures and is adopted, it could make AI companies more accountable for claims about which models power their services.
