Anthropic 研究 FlashProve 系统，用密码学证明 AI 模型身份
Anthropic is working on a system to prove AI models’ identity
AI 导读
Anthropic 正在研究一套名为 FlashProve 的开源系统，用于验证某段输出究竟由哪个 AI 模型生成，研究团队将其称为“可验证推理”，即以密码学方式给出数学保证。
摘要与补充说明
系统要求 AI 实验室为每个发布的模型公开一份“指纹”，之后可与具体输出匹配并做密码学验证；指纹不会暴露模型权重，因此闭源商业模型也能适用。该设计还强调轻量，验证可在本地设备上完成。研究人员同时发布了详细技术规范和部分可运行代码，以开源许可放在 GitHub 上。研究仍在进行，Anthropic 或其他实验室均无部署计划，团队称此次分享的是阶段性进展，希望他人接手改进。
正文
Anthropic is working on an open-source system to verify which AI model produced a given output, according to a blog post published Tuesday. The system, called FlashProve, is built to provide what researchers call “provable inference” – a cryptographic proof, essentially a mathematical guarantee, that a given output came from a specific model. It’s meant to let users confirm that the answer they received really came from the model they think they’re using.
Similar to cryptographic email signatures that let recipients confirm a message really came from its claimed sender, FlashProve would be robust against impostors attempting to disguise one model as another, even when the impostor is the lab that built and runs the model. In particular, the researchers note that the system could be used to prevent an AI company from secretly swapping in a cheaper model to cut costs, or a more expensive model to inflate its performance results.
FlashProve could also be used to verify claims by third parties that a specific task was done by an advanced model. “A developer might claim that their software library was scanned for vulnerabilities by a frontier cybersecurity model, or a company might claim that its business plan was given the go-ahead by an appropriate model,” the researchers write. “How can a user verify these claims?”
To work, the system requires AI labs to publish a “fingerprint” of each model they release that can later be matched to specific outputs and verified cryptographically. Crucially, the fingerprints don’t reveal a model’s weights, the internal numbers that define how it behaves and which closed-model makers like Anthropic and OpenAI keep private. That means labs could publish the fingerprints without giving up their most valuable asset, enabling the system to work with commercial models, too. The system is also designed to be lightweight, so verification could be performed on a local device.
As part of the announcement, researchers released a detailed technical specification and working code for various elements of the system, which is publicly available under an open-source license on GitHub. Research in the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab.
“This research post is meant to share intermediate progress, and not a completed research agenda,” researchers explain in the announcement post. “We are sharing this explicitly with the goal that others look at what we have done, take it, and improve it.”
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Russell Brandom has been covering the tech industry since 2012, with a focus on platform policy and emerging technologies. He previously worked at The Verge and Rest of World, and has written for Wired, The Awl and MIT’s Technology Review. He can be reached at [email protected] or on Signal at 412-401-5489.