Model Detection Evidence

Forged backends without access to Anthropic's real signature-validation path. Faking something that looks like a thinking block is trivial; producing a signature that survives Anthropic's server-side validation is not. OAuth or subscription credential pools still call a genuine Anthropic backend, so their signatures pass and this probe cannot rule them out.

Credential pools reselling Claude Code OAuth quota as an API. These relays prepend Claude Code's prompt before ours; the model knows, and will say so if asked the right way. Three phrasings run in parallel to defeat keyword filtering — a relay can block the literal Chinese sentence, but blocking the English paraphrase and the tool-list route at the same time is much harder.

Thin wrappers that only forward text and cannot do native work. web_search is the sharpest of the three — it is Anthropic first-party only, unavailable on both Bedrock and Vertex, so a genuine execution is positive evidence of a direct Console connection.

Gateways that trim or incorrectly rebuild Anthropic SSE. Missing official events, invalid ordering, or absent input_tokens in message_start leave structural evidence. A relay that faithfully reproduces the full sequence can still pass, so this probe alone does not prove live generation.

Text-only substitute models, and gateways that transcode in the middle and drop attachments. The material is generated fresh each run, so memorizing the answer is not an option — the model has to actually see it.

Gateways that reroute Gemini requests through an OpenAI-compatible layer, fabricate only plain text, or strip native candidates, content, parts, and usageMetadata fields.

Thin wrappers that do not preserve Gemini candidate safety feedback. Missing category or probability prevents clients from auditing filtering; the optional blocked state is retained whenever returned.

Gemini relays that reject thinkingConfig, flatten thought parts into plain text, or strip thoughtSignature. A missing signature is a compatibility warning, not standalone proof of model substitution.

Routing mismatches or cheaper-model substitution where the requested model clearly differs from modelVersion. Gateways can rewrite this field, so it remains corroborating evidence only.

Intermediaries that rewrite, truncate, or filter ordinary text responses. A fresh randomized code on every run makes hard-coded handling of a fixed sample less practical.

Obvious downgrades, low-capability substitutions, or routing to a smaller model. A fixed problem checks basic combinatorial and geometric reasoning, but cannot separate peers at the same capability level and can be hard-coded around.

Gateways that silently discard or rewrite generationConfig.maxOutputTokens and stopSequences.

Cache layers that replay a complete answer verbatim even under a high-temperature open-ended request. Repetition is suspicious evidence, but templated copy can also repeat naturally.

Compatibility layers that do not support streamGenerateContent?alt=sse or reshape the response into non-Gemini data events.

Cross-protocol wrapping between the three vendors, gateways stripping fields, and error payloads dressed up as successful responses.

Gateways that omit usage, or report numbers that contradict themselves. usage is your only basis for reconciliation — if it's missing or fabricated, the bill cannot be audited.

Relays that assemble responses themselves often slip on the protocol-specific stop field by inventing an unknown value, omitting the field, or returning null.

Endpoints that reject stream=true or return the entire response in one write. We also record time-to-first-byte and inter-chunk gaps for manual review, but those values do not currently affect pass/fail and cannot detect cached answers replayed as multiple network chunks.

Not a fraud check — a link-quality readout. For the same model, a relay with several hops in front of it usually shows visibly worse time-to-first-byte.

Gateways that replay cached answers verbatim. A normal model usually varies its wording across high-temperature samples of the same open-ended prompt; a full answer repeated after whitespace normalization may not have been regenerated.

Cheaper-model substitution and routing mismatches. A wrong model field is a direct clue — you asked for Opus and something else came back.

Obvious downgrades, low-capability substitutions, or routing to a smaller model. A fixed problem checks basic combinatorial and geometric reasoning, but cannot separate peers at the same capability level and can be hard-coded around.

Gateways that silently drop or rewrite max_tokens, stop, or stop_sequences. If a randomized stop marker appears in output past the intended cutoff, the stop parameter was not honored as specified.

Relays that prepend content before our system prompt. The elegance here is that all three outcomes are informative: a model that faithfully adopts the sentinel persona tells us our system prompt really was first in line.

Cloud channels being resold as a direct Anthropic connection. This costs nothing extra — the prefix is already in every normal response, no additional request needed.

Again separating Console, Bedrock and Vertex — plus spotting intermediate reverse proxies, which the via and server headers often give away.

New-API conversion layers that wrap AWS Bedrock in an Anthropic Messages facade. They download URL images and convert them to base64 first, potentially leaking their adapter-specific error prefix on failure.