Forty questions expose hidden model identities across API endpoints
Source published ·Modelwire updated
Original coverage: arXiv cs.CL ↗·How Modelwire adds context
The development
Researchers have demonstrated a fingerprinting vulnerability affecting deployed language models: a panel of 40 carefully chosen questions can identify which model is running behind an API with 92.5% accuracy. The technique works by building statistical profiles of how each model responds to open-ended prompts like 'Name a sound', then matching new answers to the most likely source. Testing across OpenRouter endpoints revealed that four of 96 deployed instances misidentify themselves, including one serving Gemma 4 under a false Llama label. System prompts degrade but don't eliminate the attack. This finding exposes a gap between claimed and actual model deployments, raising questions about transparency in the API marketplace and the feasibility of model obfuscation at scale.
Modelwire’s AI-generated summary of coverage from arXiv cs.CL.
Modelwire analysis
Analyst takeOur AI-generated reading of the wider context and the next developments to watch.
The fingerprinting technique itself isn't novel (Modelwire covered multi-resolution LLM fingerprinting the same day), but the finding that four of 96 deployed instances actively misidentify themselves is the real story: this suggests either deliberate obfuscation failure or systematic labeling errors in production, not just theoretical vulnerability.
This directly extends the October 20 fingerprinting work showing that behavioral traces survive obfuscation attempts. The deployed misidentifications confirm that theory has immediate operational consequences. It also connects to the October 20 'Speak vs. Know' finding about gaps between claimed and actual model behavior, except here the gap is at the infrastructure layer rather than the reasoning layer. For API marketplaces, this creates a credibility problem: if customers can't trust endpoint labels without running forensic tests, pricing and SLA negotiations become adversarial.
If OpenRouter or DeepInfra publish corrected deployment manifests within 30 days and implement cryptographic attestation for model identity, that signals the market is treating this as a solvable infrastructure problem. If neither platform responds publicly within 60 days, watch whether customers begin requiring fingerprinting audits as part of API contracts, which would impose real operational friction on providers.
This interpretation is generated from the summary above and the archive coverage cited below. Our methodology · Report an error
Coverage behind this analysis
These archive entries ground the connection in our analysis. They are ordered by source publication date, with links to our coverage and the original sources.
·arXiv cs.CL
Model fingerprints survive distillation and fine-tuning, study finds
Researchers have demonstrated that language models retain distinctive fingerprints in their outputs even after aggressive obfuscation, fine-tuning, and adaptation. The work systematically tests whether model-specific traces survive paraphrasing, parameter reduction via distillation, and LoRA modifications, finding that behavioral and semantic signals persist across these transformations. This has immediate implications for model attribution, watermarking robustness, and…
MentionsOpenRouter · DeepInfra · Gemma · Llama
How this coverage is produced
Modelwire uses AI to generate summaries and context from source headlines, snippets, and selected archive coverage. Automated checks do not verify every claim, and items are not routinely reviewed by a person before publication. Zacaria Solis operates the site. Read the linked source for the full evidence and report errors through our corrections process.
Modelwire summarizes, we don’t republish. arXiv cs.CL originally reported this story as “Forty Questions: Identifying a Language Model from One-Word Answers”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.