Stop guessing which model you are using — This method can verify!

You pay for GPT-5. But is GPT-5 actually the thing answering you? For a growing slice of the market, the honest answer is: maybe not—and until recently, there was no easy way to check.

The swap nobody can see

A booming layer of the AI economy is the relay service: a middleman that resells access to frontier models, often cheaper than going direct. The catch is simple: you pay for Claude Opus 4.8 and get a reply back, but whether it came from Opus 4.8 or was quietly swapped for GLM-5.2 or something cheaper can be difficult to check.

This is not hypothetical. In March 2026, researchers at Germany's CISPA Helmholtz Center for Information Security audited 17 relay API providers using capability tests, statistics, and a fingerprinting technique called LLMmap. They found endpoints sold as GPT-5 that fingerprinted closer to GLM-4 or DeepSeek-V3, as well as endpoints sold as DeepSeek Reasoner that appeared to be running plain DeepSeek Chat.

A silly question no model can dodge

The fix came from a trivial place. Tomáš Bruckner, a researcher at the Prague University of Economics and Business, published a paper called "One Token Is Enough" on arXiv in July 2026. His method: ask a model the same simple question repeatedly—"Give me a random number between 1 and 100"—30 times per model across 165 models, then chart the distribution.

The results were striking. GPT-4o leaned hard on 42, 37, and 57. Claude Sonnet 5 answered 47 unusually often. Llama 3.3 mostly said 53. Qwen3-Max answered 42 in all 30 runs. Bruckner repeated the test across ten task types, four languages, and 326,000 requests. The conclusion held: models have strong, repeatable preferences instead of true randomness.

Turning a quirk into an ID card

Researchers already knew that LLMs cannot produce true random numbers. What earlier work treated as a curiosity, Bruckner turned into a tool: stack enough of a model's consistent quirks together and you get an identity card. He called it a behavioral fingerprint, and unlike a full technical audit, it needs the model to output just a single token.

The protocol works like biometric verification: collect a reference fingerprint from a trusted official API, collect the same probes from the endpoint you want to check, and measure the distance between the two distributions using Jensen-Shannon divergence. The full 40-probe battery brings the error rate to 7.3%; a lightweight version of about 120 requests holds it to roughly 10.6%.

The method caught a live example: an OpenRouter endpoint sold as a proprietary flagship called "Palmyra X5" had a fingerprint distance of just 0.141 from the open-source Qwen3-235B, nearly identical to the 0.140 variance expected between two genuine deployments of the same model.

Why nothing—human or machine—can fake random

A truly uniform pick across 1–100 carries 6.64 bits of entropy; the median across all 165 models measured only 1.0 bit. The reason is training data: every weight encodes patterns distilled from human text. Asked to be random, a model reaches for whatever in its training looked most like a random answer.

Humans share the blind spot. Classic experiments show people avoid repeats and lean toward odd numbers, so far more than 10% pick 7 when asked for a number from 1 to 10. Models mirror this: 42, 37, 47, and 53 seem random to us precisely because they are choices everyone reaches for.

Einstein said God does not play dice. Neither does AI—every time it thinks it's rolling one, what comes up is just itself.

Sources

• Tomáš Bruckner — "One Token Is Enough" (arXiv, July 2026)
• Zenodo — public dataset and code for the behavioral fingerprint protocol
• WeChat tech blog — relay-service model substitution and fingerprinting