Anthropic open-sources FlashProve, a prototype for *provable AI inference*

The problem: trust me, it was Claude

When you call a hosted AI API, you send a prompt and get a response back. You don't know which model actually ran, or whether the provider switched it out for a different one halfway through the conversation. The provider could say it was Claude Opus when it was something cheaper. You have to take their word for it.

It's like posting a parcel and getting a receipt that says "handled by our best courier". Maybe it was, maybe it wasn't. You paid for express, but nobody can check.

That is the problem FlashProve sets out to solve ^[1]. The prototype, released by Anthropic in early November 2026, produces a cryptographic proof for each inference. The proof shows that a specific model generated a specific response, without revealing the prompt or the response to anyone who doesn't already have them.

What FlashProve does

FlashProve builds on an idea called provable inference. Instead of just returning an answer, the system returns an answer and a proof. The proof is a cryptographic artefact tied to the model's weights and the exact computation that produced the response ^[1].

The proof works like a fingerprint that connects three things: the model, the prompt and the response. Anyone with the prompt and the response can check the proof and see that the model the provider claims to have used actually did the work.

Crucially, the proof does not expose the prompt or the response to third parties. The person checking already has both. What they didn't have before is a way to verify the provider's claim about which model ran ^[1].

The system is designed for Mixture-of-Experts models, the architecture behind some of the fastest large language models in use today ^[1]. It does not yet work with all model types, and Anthropic describes it as a research prototype, not a production-ready feature.

In short

• FlashProve produces a cryptographic proof for each AI response, showing which model generated it ^[1].
• The proof can be verified by anyone who has the prompt and the response, without exposing either to third parties ^[1].
• The system is designed for Mixture-of-Experts models and has been released as open-source research code ^[1].
• Anthropic positions it as a step toward more accountable hosted AI, not as a feature it is deploying in its API ^[1].

Why it matters

Hosted AI is a black box. Customers pay for access to a named model, but they have no way to confirm that the model they paid for is the one that answered. That matters for three reasons.

First, pricing. Bigger, better models cost more per call. If a provider quietly substitutes a cheaper model, the customer is paying for something they are not getting.

Second, compliance. Some rules are starting to name AI systems explicitly. Article 50 of the AI Act, which has applied since August 2026, requires people to be told when they are interacting with an AI system ^[2]. A regulator might want to know which AI was used. Under the current setup, the provider's word is the only evidence.

Third, trust. When an AI makes a decision that affects someone, the question of which model made it can come up later. High-risk AI systems under the AI Act must log events, including the system's version, from December 2027 for systems under Annex III ^[3]. A proof that shows which model ran would fit neatly into that requirement, though the Act does not specify how the log should be protected.

FlashProve does not solve those problems on its own. It is a research prototype, not a deployed feature, and it only works with certain model architectures. But it makes the question concrete: should hosted AI providers give customers a way to verify which model answered?

How a digital witness fits this case

FlashProve addresses part of the evidence question: proving which model generated a response. A digital witness addresses a different part: proving that a record of that response has not changed since it was created.

Here is how it would work. When an API returns a response, the system seals a record of the call: the prompt reference, the model identifier, the response and the FlashProve proof. Sealing means taking a fingerprint of that record and committing it to WitniumChain, where any later change would show.

The record itself stays with whoever made the call. The fingerprint is what gets sealed. If the record is questioned months later, anyone it is shared with can calculate the fingerprint again and check it against the sealed one. If they match, the record has not changed. Change a single character and it won't match.

What this does: it gives the customer a verifiable record of what the API returned, which model was claimed, and when. That record can be checked by auditors, regulators or, if it comes to it, a court, without anyone having to trust the customer or the provider to have kept it intact.

What it doesn't do: it does not verify that the response was correct, lawful or fit for purpose. It does not replace the FlashProve proof, which shows that the model actually did the work. And it does not show that the log is complete.

The two systems do different jobs. FlashProve proves which model ran. A digital witness proves that a record of what it returned has not been edited. Together, they answer two parts of the same question: what happened, and can you show it has not been rewritten since?

You can seal records of API calls today, through the REST API, the SDK or the MCP server. The content never leaves your systems. The first 2,000 witnesses a month are free. Read the docs.

What this means for you

If you build systems that call hosted AI APIs, three questions are worth asking now:

• Could you show which model answered a given prompt six months ago, if a regulator or an auditor asked?
• If the API provider's log and your log disagreed, whose record would hold up?
• When you archive decisions made by AI, do you keep a record of which model made them, in a form that cannot quietly be edited later?

The answers do not have to involve FlashProve or anything like it. But the questions are real, and they are starting to matter in sectors where decisions about people are regulated.

What to watch

Article 12 of the AI Act requires high-risk AI systems to log events, including the system's version, from 2 December 2027 for Annex III systems ^[3]. That deadline is fourteen months away. Whether logged events include cryptographic proofs of which model ran is not specified, but the question is now on the table.

The new Product Liability Directive, which EU countries must transpose into national law by 9 December 2026, treats software as a product ^[4]. Under certain conditions, courts can order defendants to disclose relevant evidence. A sealed log of which software version ran, and when, would be relevant evidence in many disputes.

FlashProve is a research prototype, and Anthropic has not said it will deploy the system in its API. But other providers might, and the code is open-source. The direction is clear: hosted AI is moving from "trust us" toward "check this".