Blog
Field notes from auditing real proxies. Concrete data, no fluff.
- Apr 22, 2026
Why Your LLM Proxy Might Be Lying to You
ICLR 2025 Model Equality Testing found 11 of 31 production endpoints deviated from the reference distribution. Here is what that means for your bill.
LLM proxymodel substitutionMMDICLR 2025 - Apr 30, 2026
How Logprobs Quietly Reveal Model Identity
A 30-line tokenizer-boundary test will tell you whether your proxy is really running GPT-5 or quietly redirecting to a cheaper model.
logprobstokenizerfingerprinttiktoken - May 8, 2026
OpenAI vs Claude vs Gemini · Fingerprint Differences in 2026
Side-by-side fingerprint table for GPT-5, Claude Opus 4.7 and Gemini 3.1 Pro: tokenizers, ITT rhythm signatures, refusal templates, and how to tell them apart in one HTTP call.
GPT-5Claude Opus 4.7Gemini 3.1fingerprint comparison
Disclaimer · About Interpreting Detection Signals
- Anysingle signal cannot provemalicious behavior. Proxies may show anomalies for legitimate reasons (regional routing, A/B testing, degradation strategies, cache optimization).
- Token ratio deviation may result from ChatML wrapping, system prompt injection, or tokenizer version differences — not necessarily intentional inflation.
- Model identity judgment is based on statistical fingerprint matching, not cryptographic proof. Quantization, fine-tuning, and post-processing can all alter fingerprints.
- MMD distribution tests are sensitive to temperature, sampling parameters, and system prompts. Significant p-values mean distributional difference, not proof of substitution.
- Logprobs unavailability is increasingly common (many providers disable it by default in 2025-2026) and does not by itself indicate deception.
- ITT rhythm fingerprinting is an early-stage technique. Network jitter, TCP coalescing, and gateway buffering can produce false signals.
- This tool generates reference-grade evidence chains, not legal conclusions. Do not make definitive accusations based solely on this report.
The wording in the report refers to statistical "deviations" or "signal inconsistencies". Please do not use this to make fraud or deception claims against any service provider.