What do the sources establish?
| Platform / Source | Core Stance / Quote | Engagement Metric | Timestamp |
|---|---|---|---|
| Anthropic is working on a system to prove AI models' identity | Reported context: [object Object] [object Object] [object Object] [object Object] | Not recorded | |
| Anthropic open-sources FlashProve, its provable inference prototype for MoE models | Reported context: [object Object] [object Object] [object Object] [object Object] | Not recorded |
THE SHORT VERSION
- Anthropic published FlashProve, an open-source system that produces a cryptographic proof that a given output came from a specific model.Anthropic 公布了 FlashProve：一套开源系统，能生成“某段输出确实来自某个模型”的密码学证明。
- It requires labs to publish per-model fingerprints that do not reveal weights, and the work was done with researchers at EPFL, MIT and StarkWare.它要求模型厂商公开每个模型的指纹，而指纹不会泄露权重；这项工作由 Anthropic 前沿红队与 EPFL、MIT 和 StarkWare 的研究者合作完成。
- Anthropic says there are no plans to deploy it, the prototype was tested on an open-weight Llama model, and the overhead against a standard serving stack is large.Anthropic 表示目前没有部署计划，原型是在开放的 Llama 模型上测试的，相对标准服务栈的开销也相当大。
What Anthropic is buildingAnthropic 在做什么
Anthropic is working on an open source system that would let anyone verify which AI model produced a given output. TechCrunch reported that the company described the project, called FlashProve, in a blog post published on Tuesday, and that it is built to provide what the researchers call provable inference: a cryptographic proof that an output came from a specific model.Anthropic 正在开发一套开源系统，让任何人都能核实某段输出究竟出自哪个 AI 模型。TechCrunch 报道，公司在周二发布的博客文章中介绍了名为 FlashProve 的项目，它要提供研究者所说的“可证明推理”：一份能证明输出确实来自某个特定模型的密码学证明。
The company released a detailed technical specification and working code for several elements of the system under an open source licence on GitHub. According to TechCrunch, the research is ongoing and there are no plans to deploy it at Anthropic or at any other lab. The post is presented as a progress report rather than a finished product.公司同时公开了详细的技术规范，以及系统中若干组件的可运行代码，采用开源许可放在 GitHub 上。据 TechCrunch 报道，相关研究仍在进行，Anthropic 或其他任何实验室都没有部署计划。这篇公告被定位为阶段性进展，而不是一份已完成的研究议程。
The problem it is meant to solve它要解决的问题
The problem it addresses is mundane and hard to check. When you send a prompt to a hosted API, you cannot confirm which model answered it. A provider could route the request to something cheaper, or someone with access to the inference server could tamper with the token stream, and the reply would still read like a competent answer.它面对的问题平淡，却很难核实。当你把提示词发给一个托管的 API 时，你无法确认究竟是哪个模型回答了它。服务方可以把请求转给更便宜的模型，能接触推理服务器的人也可以篡改 token 流，而回复读起来依然像一段合格的回答。
Outside evaluators face the same problem in reverse: there is no way to confirm that the model they tested is the model being served. Help Net Security, which reported on the release, frames FlashProve as a way for a checker to find out. The guarantee is meant to hold even when the impostor is the lab that built and runs the model.外部评测者面对的是同一个问题的反面：没有办法确认自己测试的模型，就是对外提供服务的那个模型。最先报道这次发布的 Help Net Security 把 FlashProve 描述为让核查者找出答案的工具。这套保证要在冒充者就是模型所属实验室本身时依然成立。
How the proof works证明是怎么做出来的
The mechanism rests on fingerprints. TechCrunch reported that the system requires AI labs to publish a fingerprint of each model they release, which can later be matched to specific outputs and verified cryptographically. Crucially, the fingerprints do not reveal a model's weights, the internal numbers that define how it behaves and that closed-model makers keep private.机制的核心是指纹。TechCrunch 报道，该系统要求 AI 实验室为每个发布的模型公开一份指纹，之后可以把指纹与具体输出匹配，并用密码学方式验证。关键在于，指纹不会泄露模型权重——那是决定模型行为的内部数字，也是闭源厂商严守的秘密。
That design choice is what makes the scheme usable commercially. Closed-model makers such as Anthropic and OpenAI keep their weights private, so a verification scheme that required publishing them would never be adopted. Because the fingerprints are small, the system is also designed to be lightweight, so that verification could be performed on a local device rather than in a data centre.正是这个设计让它具备商业上的可用性。Anthropic 与 OpenAI 这类闭源厂商不会公开权重，因此任何要求公开权重的验证方案都不可能被采用。由于指纹体积很小，系统也被设计得足够轻量，验证可以在本地设备上完成，而不必放在数据中心里跑。
Who built the verifiers验证器是谁写的
The work comes from Anthropic's Frontier Red Team, working with collaborators at EPFL, MIT and StarkWare, according to Help Net Security. The repository holds three executables: the prover, a fast verifier written in C++, and a second verifier written in Lean, the proof assistant the team used to state the protocol's completeness, soundness and zero-knowledge properties.这项工作来自 Anthropic 的前沿红队，合作方包括 EPFL、MIT 与 StarkWare 的研究者，据 Help Net Security 报道。代码仓库里有三个可执行程序：证明器、一个用 C++ 写的快速验证器，以及第二个用 Lean 写的验证器——Lean 是团队用来陈述协议完备性、可靠性与零知识性质的证明助手，属于形式化工具链。
The Lean verifier is a reference rather than a working tool. It runs slowly, and Help Net Security reported that its job is to establish that the C++ verifier accepts only the statements a soundness theorem covers; on every test proof, the two agreed. The release is under the Apache 2.0 licence, with the weights left out of it.Lean 版本是参照物，而不是日常工具。它跑得很慢，Help Net Security 报道说，它的职责是确认 C++ 验证器只接受可靠性定理所覆盖的陈述；在每一个测试证明上，两者结果一致。发布采用 Apache 2.0 许可，权重并不包含在内，团队也没有承诺论文、协议与代码三个版本完全一致，复核仍需人工完成。
What the numbers say数字说明了什么
The performance figures decide whether any of this is practical. Help Net Security reported that on one H100 with 24 CPU cores the prover moves about 110 tokens per second, and that a proof for a 1,024-token request runs about 18.78 MB and takes about 17 seconds to check on 24 CPU threads, or about 21 seconds on a single one.性能数字决定了这套东西是否实用，也是外界最难忽略的部分。Help Net Security 报道，在单张 H100、24 个 CPU 核心的配置下，证明器每秒处理约 110 个 token；一次 1,024 token 请求的证明约 18.78 MB，在 24 线程上校验约需 17 秒，单线程则约需 21 秒，这意味着校验本身并不需要专用硬件，普通服务器即可完成。
The offline step is heavier but rarer. The prover commits to the weights once per model in about 39 minutes, and that commitment then covers roughly 16 million requests, so a client downloads a 6.5 MB commitment plus one proof per request. Measured against vLLM running the same model in FP8 on eight H100s, the overhead came to about 72 times per GPU.离线步骤更重，但只做一次。证明器为每个模型对权重做一次承诺，耗时约 39 分钟，此后这份承诺可覆盖约 1,600 万次请求，因此客户端只需下载一份 6.5 MB 的承诺，外加每次请求一份证明。与在八张 H100 上以 FP8 运行同一模型的 vLLM 相比，开销约为每 GPU 72 倍。
Why model identity matters模型身份为什么重要
The use cases are less exotic than the cryptography. TechCrunch reported that the system could prevent an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive model to inflate its performance results. It could also be used to verify third-party claims that a specific task was done by an advanced model.它的用途没有密码学本身那么陌生。TechCrunch 报道，这套系统可以阻止一家 AI 公司偷偷换成更便宜的模型来削减成本，或换成更贵的模型来抬高自己的性能成绩。它也可以用来核实第三方的说法，比如某项任务确实是由某个前沿模型完成的。
Verification of that kind is becoming a procurement question rather than a research one. This site has covered Anthropic's revenue disclosure ahead of its IPO and the difficulty of telling machine writing from human writing, both of which turn on claims that an outsider cannot easily check. Warnings about AI vendor diligence make the same point from the buyer's side.这类核实正在从研究问题变成采购问题。本站报道过Anthropic 在 IPO 前披露的收入与区分机器写作与人类写作的困难，两者都依赖外部难以核查的说法，而这正是身份证明想要补上的缺口。关于 AI 供应商尽职调查的警告从买方角度提出了同一点。
What is established, and what is not哪些已确定，哪些还没有
Established: Anthropic published FlashProve with a specification and code under an open source licence; the Frontier Red Team worked with EPFL, MIT and StarkWare; the verifiers include a C++ build and a Lean reference; Anthropic says there are no plans to deploy it. The prototype was tested on Llama 4 Maverick, a 400 billion parameter mixture-of-experts model. Not established: whether any lab will publish fingerprints, or how it performs on closed models.已确定：Anthropic 以开源许可发布了 FlashProve 的规范与代码；前沿红队与 EPFL、MIT、StarkWare 合作；验证器包括 C++ 版本与 Lean 参照版本；原型在 Llama 4 Maverick 上测试，这是一个 4000 亿参数的混合专家模型；Anthropic 表示没有部署计划。未确定：是否有任何实验室愿意公开指纹，以及它在闭源模型上的表现。
The open question is adoption, not mathematics. A proof system only helps if model providers publish fingerprints, and the prototype was tested on an open-weight model that anyone can download, not on a closed one. Help Net Security noted that three versions of the system exist and that the team does not promise all three say the same thing, which is why independent review matters more than the announcement.未解的问题是采用，而不是数学。只有模型厂商愿意公开指纹，证明系统才有意义，而原型测试的是一个任何人都能下载的开放权重模型，而不是闭源模型。Help Net Security 指出，这套系统存在三个版本，团队并不保证三者说法完全一致，这也是为什么独立复核比公告本身更重要。
Sources & reporting limits来源与核查范围
Follow Policy & safety to find related stories on your next visit.关注政策与安全，下次访问时阅读相关文章。