Streaming cadence can expose inference-stack behavior, but TrueLLMs currently treats it as diagnostic only. The measured value is inter-SSE-chunk arrival time, not true internal inter-token time.
Algorithm
Collect chunk timestamps from streamed responses, compute gaps, mean, variance, skew, fast-gap fraction, and simple frequency features, then classify the rhythm into coarse labels such as autoregressive, speculative, cached, or steady.
Thresholds
Condition
Verdict contribution
Streaming timestamps present
Display diagnostic rhythm class and features
No streaming timestamps
Unavailable diagnostic
Any result
Score contribution remains 0
Limitations
Network jitter, gateway buffering, SSE flush cadence, TCP coalescing, and timestamp resolution dominate at small sample sizes. The current reference library is not a measured production-grade fingerprint set.
References
Alhazbi et al. LLMs Have Rhythm: Fingerprinting Large Language Models Using Inter-Token Times and Network Traffic Analysis. 2025. arXiv:2502.20589
Anysingle signal cannot provemalicious behavior. Proxies may show anomalies for legitimate reasons (regional routing, A/B testing, degradation strategies, cache optimization).
Token ratio deviation may result from ChatML wrapping, system prompt injection, or tokenizer version differences — not necessarily intentional inflation.
Model identity judgment is based on statistical fingerprint matching, not cryptographic proof. Quantization, fine-tuning, and post-processing can all alter fingerprints.
MMD distribution tests are sensitive to temperature, sampling parameters, and system prompts. Significant p-values mean distributional difference, not proof of substitution.
Logprobs unavailability is increasingly common (many providers disable it by default in 2025-2026) and does not by itself indicate deception.
ITT rhythm fingerprinting is an early-stage technique. Network jitter, TCP coalescing, and gateway buffering can produce false signals.
This tool generates reference-grade evidence chains, not legal conclusions. Do not make definitive accusations based solely on this report.
The wording in the report refers to statistical "deviations" or "signal inconsistencies". Please do not use this to make fraud or deception claims against any service provider.