Anthropic published an open-source system on Nov. 3 that can establish which model produced a given piece of output without disclosing the model’s weights. The system, called FlashProve, was described in a research blog post, and the team said it had tested the method on Meta’s Llama 4 Maverick, an open-weight model it did not build.
The problem it addresses is narrower than it sounds and more useful than it looks. A watermark alters the text it is applied to, and anyone who edits the wording can strip it. A signature attached to a file can be removed by copying the text into another document. Neither survives the ordinary handling that AI output receives on its way to a reader. What FlashProve proposes is a proof about the process that generated the text, which can be checked later without access to the weights that produced it.
Provable inference, as the approach is described, binds an output to a specific model and a specific computation. A verifier can then confirm the claim without the model owner handing over the model. That distinction matters for the companies building these systems, because the weights are the asset, and a provenance scheme that required publishing them would never be adopted.
The choice to test on a competitor’s model is the part that reads as a statement of intent. Llama 4 Maverick is an open-weight model from Meta, and demonstrating the method on it shows the mechanism is not tied to Anthropic’s own architecture or to a proprietary signing service. A system that only works for the company that built it is a marketing feature. A system that works across vendors is infrastructure.
The timing is tied to regulation. Several governments have moved toward requiring labels on content generated by artificial intelligence, and a label is only as good as the ability to check it. A platform that asks whether an image or a paragraph came from a model needs an answer it can verify, not an answer it has to trust. Provenance tools are the machinery that requirement implies.
Open source is the adoption strategy. Anthropic could have kept the method proprietary and sold verification as a service, and that path would have produced revenue and little use. Publishing the code lets platforms, model providers and auditors run the check themselves, which is the only way a provenance standard spreads. The company gives up control of the implementation to gain a position in the argument about what the standard should be.
The limits are worth stating plainly. A proof establishes which model generated an output, not whether the output is accurate, and a verified label on a false statement is still a false statement. The scheme also says nothing about intent: a model can be prompted to produce harmful material, and the proof will confirm the model’s identity while leaving the question of responsibility where it was.
Coverage is the other constraint. A verification layer only helps when the systems that generate text run it, and much of the output people encounter comes from models deployed without any such process. Fine-tuning complicates the claim further, since a model adapted by a customer is not the model the provider signed. Each of those cases needs an answer before a regulator can treat a proof as sufficient.
Auditors are the third party in the arrangement. A label that a platform applies to content is only useful if someone independent can test it, and the firms that examine financial statements and compliance programs have begun to look at model provenance in the same way. An open method gives them something to test against, which is a precondition for any of this appearing in a signed opinion.
Compute cost is the practical question for operators. Verification that runs on every request adds work to an inference stack that is already the largest line in the budget. Anthropic’s researchers present the method as efficient, and the test on a large open model suggests it is not confined to small systems, but the cost at the scale of a consumer product is a different measurement from a research demonstration.
There is a commercial logic underneath the policy argument. Model providers are being asked to accept liability for what their systems produce, and a mechanism that identifies the model behind a text shifts part of any dispute onto whoever deployed it. Companies that can prove their models were not the source of a piece of content have an interest in the proof being widely accepted, and so do the platforms that host the content.
The competitive picture is not settled. Other labs have published provenance work, and standards bodies are still arguing about formats. What Anthropic has done is put a working implementation, with a public test on a rival’s model, into a conversation that had been mostly about principles. That is a bid to shape the default.
The test ahead is adoption rather than technical soundness. If a platform begins checking FlashProve signatures, or a regulator cites the method in a labeling rule, the work becomes part of the plumbing. If the code sits in a repository and the tests stay in the blog post, it becomes a position paper with a compiler. The next year of labeling rules will decide which.
