据周二发布的一篇博客文章称，Anthropic 正在开发一个开源系统，用于验证给定输出是由哪个 AI 模型生成的。该系统名为 FlashProve，旨在提供研究人员所谓的“可证明推理”——本质上是一种数学保证，即加密证明，证明给定输出来自特定模型。其目的是让用户确认他们收到的回答确实来自他们以为正在使用的模型。
Anthropic is working on an open-source system to verify which AI model produced a given output, according to a blog post published Tuesday. The system, called FlashProve, is built to provide what researchers call “provable inference” – a cryptographic proof, essentially a mathematical guarantee, that a given output came from a specific model. It’s meant to let users confirm that the answer they received really came from the model they think they’re using.
类似于加密电子邮件签名让收件人能够确认消息确实来自其声称的发件人，FlashProve 能够抵御冒充者试图将一种模型伪装成另一种模型的行为，即使冒充者是构建并运行该模型的实验室。研究人员特别指出，该系统可用于防止 AI 公司秘密替换为更便宜的模型以降低成本，或替换为更昂贵的模型以夸大其性能结果。
Similar to cryptographic email signatures that let recipients confirm a message really came from its claimed sender, FlashProve would be robust against impostors attempting to disguise one model as another, even when the impostor is the lab that built and runs the model. In particular, the researchers note that the system could be used to prevent an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive model to inflate its performance results.
FlashProve 还可用于验证第三方关于特定任务由先进模型完成的声明。研究人员写道：“开发者可能声称其软件库是由前沿网络安全模型扫描漏洞的，或者公司可能声称其商业计划已获得合适模型的批准。用户如何验证这些声明？” 要使该系统发挥作用，需要 AI 实验室发布其发布的每个模型的“指纹”，该指纹稍后可与特定输出匹配并通过加密方式验证。
FlashProve could also be used to verify claims by third parties that a specific task was done by an advanced model. “A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that its business plan was given the go-ahead by an appropriate model,” the researchers write. “How can a user verify these claims?”To work, the system requires AI labs to publish a “fingerprint” of each model they release that can later be matched to specific outputs and verified cryptographically.
关键在于，这些指纹不会泄露模型的权重——即定义模型行为的内部数字，Anthropic 和 OpenAI 等闭源模型制造商将其保密。这意味着实验室可以在不放弃其最宝贵资产的情况下发布指纹，从而使该系统也能适用于商业模型。该系统还设计为轻量级，以便验证可在本地设备上执行。
Crucially, the fingerprints don’t reveal a model’s weights, the internal numbers that define how it behaves and which closed-model makers like Anthropic and OpenAI keep private. That means labs could publish the fingerprints without giving up their most valuable asset, enabling the system to work with commercial models, too. The system is also designed to be lightweight, so verification could be performed on a local device.
作为该公告的一部分，研究人员发布了该系统各要素的详细技术规范和工作代码，这些内容在 GitHub 上以开源许可证公开可用。该系统的研究正在进行中，Anthropic 或任何其他实验室均无部署计划。
As part of the announcement, researchers released a detailed technical specification and working code for various elements of the system, which is publicly available under an open-source license on GitHub. Research in the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab.
研究人员在公告帖子中解释道：“这篇研究帖子旨在分享阶段性进展，而非已完成的研究议程。我们明确分享此内容，目的是让其他人审视我们的工作，加以采纳并加以改进。”
“This research post is meant to share intermediate progress, and not a completed research agenda,” researchers explain in the announcement post. “We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it.”