Detection dimensions
TrueLLMs aggregates 12 independent signals into a single weighted verdict. Each dimension is a pure TypeScript function with documented thresholds and a known failure mode. Click any row for the deep write-up.
- 01Logprobs Fingerprintweight 17%
- 02Tokenizer Boundary Probeweight 15%
- 03LLMmap Active Probingweight 15%
- 04Model Equality Testing (MMD)weight 12%
- 05Inter-Token Rhythm Fingerprintweight 8%
- 06Cache Hit Detectionweight 8%
- 07Canary Prompt Behaviorweight 7%
- 08Context Window Probeweight 6%
- 09Sparse-Token Stress Testweight 5%
- 10Stylometric Analysisweight 3%
- 11Latency Distributionweight 2%
- 12Self-Identification Probeweight 1%
- 13Refusal Boundaryweight 1%
Disclaimer · About Interpreting Detection Signals
- Anysingle signal cannot provemalicious behavior. Proxies may show anomalies for legitimate reasons (regional routing, A/B testing, degradation strategies, cache optimization).
- Token ratio deviation may result from ChatML wrapping, system prompt injection, or tokenizer version differences — not necessarily intentional inflation.
- Model identity judgment is based on statistical fingerprint matching, not cryptographic proof. Quantization, fine-tuning, and post-processing can all alter fingerprints.
- MMD distribution tests are sensitive to temperature, sampling parameters, and system prompts. Significant p-values mean distributional difference, not proof of substitution.
- Logprobs unavailability is increasingly common (many providers disable it by default in 2025-2026) and does not by itself indicate deception.
- ITT rhythm fingerprinting is an early-stage technique. Network jitter, TCP coalescing, and gateway buffering can produce false signals.
- This tool generates reference-grade evidence chains, not legal conclusions. Do not make definitive accusations based solely on this report.
The wording in the report refers to statistical "deviations" or "signal inconsistencies". Please do not use this to make fraud or deception claims against any service provider.