Anthropic Develops FlashProve to Expose AI Models Secretly Using Claude

Anthropic is developing an open-source technology called FlashProve that could make it easier to verify which artificial intelligence model actually generated a response.

The project addresses a growing transparency problem in the AI industry. Companies increasingly advertise their own AI models, but users often have no independent way to confirm whether the advertised system produced an answer or whether another model handled the request behind the scenes.

FlashProve aims to address this problem through cryptographic verification. Instead of simply trusting an AI provider’s claim, users could check mathematical proof linking a response to a particular model.

The development comes amid Anthropic’s allegations that several Chinese AI companies have used Claude in ways that violate its service terms. These allegations include secretly routing requests through Claude and extracting its capabilities to improve competing AI systems.

However, there is an important distinction: FlashProve is designed to verify model identity during inference. It does not independently establish whether a competing AI model was trained using Claude’s responses.

What Is Anthropic’s FlashProve?

FlashProve is an experimental technology developed by Anthropic to make AI model identity verifiable.

Currently, most people cannot independently establish which model generated an answer when interacting with an AI application.

For example, a company might advertise a service as being powered by its own advanced language model. However, the company could potentially route some requests to a different provider without informing users.

This creates a transparency problem for customers, businesses and researchers.

FlashProve aims to provide cryptographic evidence that a particular model generated a specific output.

The technology uses a mathematical verification process to connect an AI response with a published cryptographic fingerprint associated with the model.

If the response was generated by the advertised model and the verification process is implemented correctly, the proof should validate.

If another model generated the response, the verification should fail.

This could make it harder for AI providers to misrepresent which systems are powering their services.

Why Is Anthropic Developing This Technology?

The development comes during growing competition between major AI companies.

Leading AI laboratories invest heavily in model training, computing infrastructure, research and specialised talent. Their most capable systems can require substantial resources to develop and operate.

This creates incentives for competitors to find alternative ways to access advanced AI capabilities.

One approach is model distillation.

Distillation involves using the outputs of a more capable AI system to help train another model. A developer can collect responses to carefully designed prompts and use them as training examples for a different model.

The technique is not inherently improper. It is widely used in legitimate machine-learning research and commercial development.

However, problems can arise when companies obtain outputs through unauthorised access, fraudulent accounts or methods that violate a provider’s terms of service.

Anthropic has accused several Chinese AI laboratories of engaging in large-scale activities involving Claude.

FlashProve addresses a related but different problem: verifying which model generated an individual response.

Anthropic’s Allegations Against Chinese AI Companies

Anthropic has previously published reports alleging that Chinese AI companies attempted to extract capabilities from Claude through large-scale interactions.

In February 2026, Anthropic accused DeepSeek, Moonshot AI and MiniMax of conducting model-distillation campaigns.

The company reported more than 16 million exchanges involving approximately 24,000 fraudulent accounts.

According to Anthropic, the campaigns used large numbers of requests to collect Claude’s outputs and reasoning-related information.

In September 2026, Anthropic published another report detailing alleged activities involving several China-based AI laboratories.

The report included allegations involving Alibaba, Moonshot AI and DeepSeek, among others.

Allegations involving Moonshot AI

One particularly significant allegation concerned Moonshot AI, the company behind the Kimi AI assistant.

Anthropic alleged that Moonshot secretly routed nearly 300,000 customer requests through Claude over a period of ten days.

According to Anthropic, the activity involved approximately 5,380 fraudulent accounts, with much of the activity appearing to originate from Singapore and Japan.

Anthropic also alleged that conversations and model outputs were collected to help improve Moonshot’s own AI systems.

These claims have not been independently established simply because Anthropic published them. They should therefore be understood as allegations made by the company.

Nevertheless, the reports illustrate why AI providers are increasingly concerned about unauthorised access to their models.

How FlashProve Works

FlashProve uses cryptographic techniques to establish a verifiable connection between an AI model and its generated output.

The process can be understood through several stages.

1. The AI model receives a unique fingerprint

An AI provider publishes a cryptographic fingerprint associated with a particular model.

This fingerprint acts as a reference that can be used during verification.

It does not require the company to publish the model’s complete internal weights.

2. The model generates a response

A user submits a prompt to an AI service.

The selected model processes the request and generates an answer.

In a conventional AI service, the user generally has to trust the provider’s statement about which model handled the request.

3. The system generates cryptographic proof

FlashProve is designed to produce mathematical evidence connecting the generated output to the model’s published fingerprint.

This proof is intended to establish that the claimed model performed the computation.

4. The proof is independently verified

A user or another verification system can check the proof.

If the mathematical verification succeeds, it provides evidence that the output was generated by the model associated with the fingerprint.

If the response came from a different model, the verification should not validate.

The key advantage is that verification does not have to rely entirely on the AI provider’s word.

AI Companies Can Protect Their Proprietary Model Weights

One of the important features of FlashProve is its potential to support verification without publicly revealing proprietary model weights.

Model weights are numerical parameters that determine how a neural network processes information and produces outputs.

They are among the most valuable assets of major AI laboratories.

Companies such as Anthropic generally do not publish the complete weights of their leading commercial models.

If proving model identity required companies to reveal these weights, many commercial AI providers would be unlikely to participate.

FlashProve is designed to avoid that requirement.

A provider can publish the necessary cryptographic information while keeping its underlying model weights private.

This could make the approach more attractive to companies that want to demonstrate transparency without giving competitors access to their intellectual property.

However, successful adoption would depend on providers implementing the system correctly and making the necessary verification information available.

FlashProve Could Help Prevent AI Benchmark Manipulation

The potential applications extend beyond identifying which model generated a chatbot response.

AI companies regularly compare their systems through benchmarks and performance evaluations.

These tests help researchers and customers understand how different models perform in areas such as mathematics, coding, reasoning and general knowledge.

However, benchmark results are only useful when the tested system is accurately identified.

Imagine a company claiming that its own AI model achieved a particular benchmark result.

If the company secretly used a more capable external model during testing, the published result could create a misleading impression of its actual capabilities.

FlashProve could help address this problem by providing evidence of which model performed the computation.

It could also be useful in enterprise environments.

For example, a company might require proof that a particular approved AI model handled a sensitive business task.

Similarly, developers could use model verification when evaluating AI-powered software.

The technology could therefore become useful wherever model identity matters.

Anthropic Demonstrates FlashProve Using Meta’s Llama 4 Maverick

Anthropic has demonstrated FlashProve using Meta’s Llama 4 Maverick model.

The demonstration used a model containing 400 billion total parameters.

According to the reported technical results, the system generated proofs at approximately 110 tokens per second using four-bit quantized weights and a single Nvidia H100 GPU.

The reported proof for a response containing 1,024 tokens was approximately 19MB.

Verification could be completed on a CPU within seconds.

These figures demonstrate the potential of the approach, but they also reveal a significant technical challenge.

Proof generation reportedly required approximately 70 to 95 times more GPU computation than comparable inference using vLLM.

That additional computing requirement could make large-scale commercial deployment expensive.

AI companies would need to consider whether the benefits of independent verification justify the extra computing resources.

The demonstration is therefore an important technical step, but it does not mean FlashProve is already ready for widespread commercial use.

What FlashProve Cannot Prove

Although the project could improve transparency, it is important not to overstate its capabilities.

FlashProve is primarily concerned with proving which model generated an output.

It does not automatically establish how that model was trained.

For example, suppose an AI company trains its own model using millions of responses collected from another provider.

FlashProve could potentially verify that the company’s own model generated a particular response during normal operation.

It would not, by itself, reveal whether the model had previously been trained using unauthorised outputs from Claude.

This distinction matters because model distillation and model identity are two different technical questions.

• Model identity: Which AI model generated this particular response?
• Model distillation: Was another model trained using outputs from an existing AI system?
• Data provenance: Where did the training data originate?
• Authorised access: Did the company obtain the information in accordance with the provider’s terms?

FlashProve primarily addresses the first question.

Additional technical methods, access controls, account monitoring and investigations would still be needed to address the others.

Is FlashProve Open Source?

Anthropic has released FlashProve as an open-source research project.

Its technical specification, research material and working implementation have been made available for examination by researchers and developers.

This is important because cryptographic verification systems benefit from independent scrutiny.

Security researchers can examine the mathematical approach, identify weaknesses and assess whether the implementation delivers the promised guarantees.

Open-source development may also help other AI companies experiment with the technology.

However, making the code publicly available does not automatically mean that every AI provider will adopt it.

Companies would need to integrate the system into their inference infrastructure and generate the required proofs.

Anthropic has also described the project as experimental, with limitations involving supported computations, output types and the relationship between its optimised implementation and formally verified protocol.

There is no basis to assume that every Claude response or every commercial AI service is already protected by FlashProve.

What Does This Mean for the Future of AI?

The development highlights a growing challenge for the artificial intelligence industry: proving what happens behind the interface.

Consumers generally see a prompt box and a generated response. They may not know which model handled their request, whether an external service was involved or whether the provider switched models to reduce costs.

For businesses, these questions can become even more important.

An organisation using AI for legal research, software development, financial analysis or customer support may want assurance that its approved model actually performed the task.

Model verification could eventually become part of enterprise AI governance and compliance systems.

It could also help researchers produce more reliable benchmark comparisons.

Nevertheless, adoption will depend on technical performance, verification costs and industry cooperation.

If proof generation remains significantly more expensive than ordinary inference, some providers may be reluctant to use it for every request.

Conclusion

Anthropic’s FlashProve project could introduce a new level of transparency into the AI industry by making model identity independently verifiable.

The technology is particularly relevant as AI companies compete to develop increasingly capable systems and protect their intellectual property.

Anthropic has accused several Chinese AI laboratories of unauthorised activities involving Claude, including alleged model-distillation campaigns and the routing of requests through its services.

FlashProve could help establish which model generated a particular response, reducing the opportunity for providers to misrepresent their AI systems.

However, it is not a complete solution to model theft or unauthorised training. It does not independently reveal whether a competing model learned from Claude’s outputs.

For now, the project remains experimental. Its long-term importance will depend on whether other AI providers adopt the technology and whether its verification costs can be reduced.