Anthropic is working on a system to prove AI models’ identity
Anthropic is working on an open source system to verify which AI model produced a given output, according to a blog post published Tuesday. The system, called FlashProve, is built to provide what researchers call “provable inference” — a cryptographic proof, essentially a mathematical guarantee, that a given output came from a specific model. It’s meant to let users confirm that the answer they received really came from the model they think they’re using.
根据周二发布的一篇博客文章，Anthropic 正在开发一个开源系统，用于验证特定的 AI 模型是否生成了给定的输出。该系统名为 FlashProve，旨在提供研究人员所称的“可证明推理”——即一种加密证明，本质上是一种数学保证，确保给定的输出确实来自特定的模型。其目的是让用户确认他们收到的答案确实来自他们认为正在使用的模型。
Similar to cryptographic email signatures that let recipients confirm a message really came from its claimed sender, FlashProve would be robust against impostors attempting to disguise one model as another, even when the impostor is the lab that built and runs the model. In particular, the researchers note that the system could be used to prevent an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive model to inflate its performance results.
类似于让收件人确认邮件确实来自声称的发件人的加密电子邮件签名，FlashProve 能够抵御试图将一个模型伪装成另一个模型的冒充者，即使冒充者是构建并运行该模型的实验室本身。研究人员特别指出，该系统可用于防止 AI 公司为了削减成本而秘密更换为更廉价的模型，或者为了夸大性能结果而更换为更昂贵的模型。
FlashProve could also be used to verify claims by third parties that a specific task was done by an advanced model. “A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that its business plan was given the go-ahead by an appropriate model,” the researchers write. “How can a user verify these claims?”
FlashProve 还可以用于验证第三方声称某项特定任务是由先进模型完成的说法。研究人员写道：“开发人员可能会声称他们的软件库是由前沿网络安全模型扫描漏洞的，或者一家公司可能会声称其商业计划书是由合适的模型批准的。用户该如何验证这些说法呢？”
To work, the system requires AI labs to publish a “fingerprint” of each model they release that can later be matched to specific outputs and verified cryptographically. Crucially, the fingerprints don’t reveal a model’s weights, the internal numbers that define how it behaves and which closed-model makers like Anthropic and OpenAI keep private. That means labs could publish the fingerprints without giving up their most valuable asset, enabling the system to work with commercial models, too.
为了实现这一功能，该系统要求 AI 实验室发布其发布的每个模型的“指纹”，以便后续与特定输出进行匹配并进行加密验证。至关重要的是，这些指纹不会泄露模型的权重，即定义模型行为的内部数字，而像 Anthropic 和 OpenAI 这样的闭源模型制造商会将这些数据保密。这意味着实验室可以在不放弃其最宝贵资产的情况下发布指纹，从而使该系统也能适用于商业模型。
The system is also designed to be lightweight, so verification could be performed on a local device. As part of the announcement, researchers released a detailed technical specification and working code for various elements of the system, which is publicly available under an open source license on GitHub.
该系统还被设计为轻量级，因此可以在本地设备上进行验证。作为公告的一部分，研究人员发布了该系统各个要素的详细技术规范和可运行代码，这些内容已在 GitHub 上以开源许可证形式公开提供。
Research in the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab. “This research post is meant to share intermediate progress, and not a completed research agenda,” researchers explain in the announcement post. “We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it.”
关于该系统的研究仍在进行中，目前没有计划在 Anthropic 或任何其他实验室部署它。研究人员在公告中解释道：“这篇研究文章旨在分享阶段性进展，而非完成的研究议程。我们明确分享这一点，目标是让其他人审视我们的工作，并在此基础上进行改进。”