通过四阶段审计协议，可验证匿名AI模型的真实身份。
Auditing Anonymous AI Models: A Four-Stage Protocol for Black-Box Identity Verification
- 分四阶段分析模型配置、输出特征与行为模式，逆向推断身份。
- 在10个已知模型上验证准确率高，一旗舰案例成功预判GLM-5.3版本线。
- 无需源码，仅用API接口即可操作，适合安全审计与合规审查者。
2025–2026年，前沿模型以匿名方式在开发者平台悄然发布，使用代号上线。对用户而言，模型身份决定数据处理规则、供应链风险和功能预期。目前尚无可靠的黑盒身份验证方法：实践检查清单缺乏准确性证据，而自我声明本就不可信。本文提出一种针对API服务模型的四阶段法医审计协议。第0阶段从互联网档案馆的存档快照中重建发布时配置，揭示预览与生产版本间的漂移。第1阶段将配置特征（上下文长度、输出上限、推理能力、模态）与平台目录比对。第2阶段利用跨长度差异测试验证分词器身份，排除短提示冲突。第3阶段通过行为探测进行交叉验证。在10个已知身份模型上测试，7个完全匹配，2个精度差异，1个部分匹配，0个方向相反。在一次旗舰案例中，2026年8月23日分析指向GLM-5.3版本线，官方发布证实该家族与版本线推断正确（部署变体未预先声明；Flash版本在披露后一致）。另三个仅依赖第0阶段的案例生成分级假设或拒绝猜测。附录提供仅依赖标准库的实现。
原文摘要 · Abstract (English)
The 2025--2026 AI market has seen a wave of stealth releases: frontier models launched anonymously on developer platforms under codenames. For their users, identity determines data-handling terms, supply-chain risk, and capability expectations. No validated methodology exists for black-box identity verification of anonymous models: practitioner checklists lack accuracy evidence, and self-identification is untrustworthy by design. We propose a four-stage forensic audit protocol for API-served models. Stage 0 reconstructs launch-time configuration from archived platform snapshots (Internet Archive), exposing preview--production drift. Stage 1 fingerprints configuration (context, output ceiling, reasoning, modality) against the platform catalog. Stage 2 tests tokenizer identity with a cross-length differential that rejects short-prompt collisions. Stage 3 corroborates with behavioral probes. We test declaration consistency on 10 known-identity releases (7 exact, 2 precision-differences, 1 partial, 0 counter-directional), not end-to-end identification under anonymity. Identification is validated prospectively on a flagship case whose 2026-08-23 analysis pointed to the GLM-5.3 version line and whose official reveal confirmed those family and version-line inferences (deployment variant was not pre-asserted; Flash was consistent post-reveal), and on three Stage-0-only cases where the protocol produced a graded hypothesis or declined rather than guessed. A standard-library-only implementation is provided as supplementary material.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。