As artificial intelligence models become more powerful and widely used, a new challenge has emerged: how can users and regulators verify the true identity of AI systems when their creators choose to remain anonymous? This question matters because knowing who built an AI model affects trust, data privacy, and understanding the model’s capabilities. A newly published research paper proposes a novel four-stage auditing method designed to verify the identity of AI models even when they are offered as “black boxes” — systems accessed only through an API without revealing their inner workings or developer details.
Key Takeaways
- The research introduces a four-stage forensic protocol to audit AI models served through APIs, aiming to confirm their developer identity despite anonymity.
- Stage 0 uses archived web snapshots to reconstruct the model’s launch configuration, helping detect changes from preview to production versions.
- Subsequent stages fingerprint technical features such as model configuration, tokenizer behavior, and response patterns to differentiate models reliably.
- The protocol was tested on 10 known AI models, accurately matching or closely approximating their declared identities, and successfully predicted the identity of a recently revealed flagship model.
In recent years, some AI developers have released cutting-edge models under codenames or anonymously on developer platforms, making it difficult for users to verify who actually built the system they are interacting with. This anonymity raises concerns because the identity of the developer informs users about how their data is handled, potential risks in the model’s supply chain, and what capabilities or limitations the model may have.
The new study addresses this gap by proposing a structured audit process that treats the AI model as a “black box”—meaning the auditor cannot look inside the model or access its code but can only send inputs and observe outputs through an API. The four-stage protocol starts by examining archived online records to piece together the model’s initial public profile and configuration at launch. This helps auditors spot any differences between early previews and the final deployed model, which could affect identification.
Next, the protocol fingerprints the model’s configuration by analyzing its context parameters, output limits, reasoning style, and supported data types (modalities). This creates a unique signature that can be compared against known models catalogued on the platform. The third stage tests the model’s tokenizer—the component that breaks down text into understandable chunks—using a method that avoids false matches caused by short sample inputs. Finally, the fourth stage probes the model’s behavior with targeted tests that reveal characteristic response patterns, helping confirm or refute the identity hypothesis.
To validate their approach, the researchers applied the protocol to ten AI models with known developer identities. The method correctly matched seven models exactly, closely approximated two others, partially identified one, and never produced misleading counter-identifications. In a high-profile case, the protocol’s analysis predicted the identity of a flagship model before its official reveal, demonstrating its practical potential. The researchers have also made a standard-library-only implementation of their protocol available, encouraging wider adoption and further testing.
This new auditing protocol offers a promising step toward greater transparency and trust in the rapidly evolving AI landscape. By enabling users and regulators to verify the provenance of AI models without needing access to proprietary code, it helps address concerns about data governance and supply-chain risks. Looking ahead, refining these techniques and integrating them into AI marketplaces and regulatory frameworks could make anonymous AI releases more accountable, benefiting both developers and end users.
Based on research published on arXiv by Yisen Xi.