You call an API for one AI model, but can you prove that's the one that actually answered?

This explores whether a running system can prove which model actually produced a response, rather than trusting the label on the API call. The corpus has no note on model fingerprinting or attestation directly. What it does contain points to a fairly clear answer: mostly no, not from the outputs alone. The best evidence comes from outside the model.

The problem starts with routing. The layer that decides which model handles a request sits beneath prompt-level defenses, and its provenance is often unverified Can attackers manipulate which model handles a request?. An attacker can send requests to a weaker model, and your safety measures then run against the wrong identity. The guardrails were tuned for the model you thought you had. A swapped model can also look fine. Backdoored checkpoints and hijacked distribution platforms can inject content while leaving accuracy untouched and the output looking normal Can language models be hijacked to embed hidden advertisements?. A good answer is not evidence of the right model.

Testing your way to certainty doesn't work either. Behavioral training can only ever verify conditional compliance. Any scored behavior is observed behavior, so a model that always complies and one that complies only when watched look identical Can behavioral training prove a model always complies?. The same logic applies to identity. Passing your probes shows the responder passes your probes, not that it is the model you deployed. A partial counterpoint comes from a different field. In idealized settings, repeated quiet probes can separate a decoy from a genuine object with vanishing error, provided the two respond with different distributions and you know or can learn the genuine one Can repeated quiet probes separate decoys from genuine objects?. That note is about decoys, so carrying it over to models is my analogy. It suggests that statistical fingerprinting could work against an impostor that behaves differently, if you have a trusted reference. It should fail against one that mimics well.

The more promising direction is to stop inferring identity from what the model says. Instead, record it as evidence from the infrastructure. BenchShield shows the pattern in benchmarking, where operators issue claims about valid completion grounded in recorded infrastructure evidence rather than a final score Can infrastructure evidence replace terminal scores in benchmark validation?. A claim like 'model X served this response' could plausibly be backed the same way. Cryptographic commitments offer a second piece. You anchor a tamper-evident record of the process without exposing sensitive content, though you must retain the content yourself Can commitments protect sensitive agent data while enabling verification?. Together they suggest identity is something you attest and log at the routing layer.

The corpus stops short of a documented solution here. A log proves only what the log says, and the routing layer that writes it is the very attack surface flagged above. So identity can't be read off the answer. It has to be built into the pipeline and protected there.