Ilmu Komputer & AI editorial
Auditing Anonymous AI Models: A Four-Stage Protocol for Black-Box Identity Verification
The core problem
## The Stealth-Release Problem
The 2025–2026 AI market has seen a wave of **stealth releases**: frontier models launched anonymously on developer platforms under codenames. For their users, identity determines data-handling terms, supply-chain risk, and capability expectations. Yet no validated methodology exists for black-box identity verification of anonymous models. Practitioner checklists lack accuracy evidence, and self-identification is untrustworthy by design — a model can simply claim to be whatever it is prompted to claim.
Xi frames the core research gap as follows: identity is a *forensic* question, not a *declarative* one. The paper therefore asks whether an auditor, armed only with API access and public artifacts, can produce a **graded, falsifiable hypothesis** about an anonymous model's family and version line — and, critically, whether that hypothesis can be validated prospectively against a later official reveal.
The contribution is a four-stage protocol (Stage 0 through Stage 3) plus a standard-library-only reference implementation released as supplementary material. The taxonomy of the work spans **Architecture**, **Cybersecurity**, **Network**, and **Cryptogra
Innovation
## Declaration Consistency and Prospective Validation
### Test-Set Results (10 Known-Identity Releases)
| Outcome | Count |
|---|---|
| Exact | 7 |
| Precision-differences | 2 |
| Partial | 1 |
| Counter-directional | 0 |
The **zero counter-directional** result is the headline safety property: in no case did the protocol point *against* the true identity. The two precision-differences and one partial indicate the protocol's natural output is a **graded hypothesis**, not a binary verdict.
### Prospective Flagship Case
The protocol was validated **prospectively** on a flagship case. The **2026-08-23** analysis pointed to the **GLM-5.3 version line**. The subsequent **official reveal confirmed** those **family and version-line inferences**.
Important caveats stated by the author:
- The **deployment variant was not pre-asserted**.
- **Flash was consistent post-reveal** — i.e., it was not ruled out, but it was not claimed in advance.
### Stage-0-Only Cases
On **three Stage-0-only cases**, the protocol produced a **graded hypothesis** or **declined** rather than guessed. This is the protocol's epistemic discipline: abstention is a valid output.
### Implementation
A **standard-
Why it matters
## Why the Protocol Works — and Where It Doesn't
### The Epistemic Design
The protocol's strength is that it separates **evidence classes** with different trust properties:
1. **Archived snapshots** (Stage 0) are *historical artifacts* — they cannot be influenced by the model under audit.
2. **Configuration fingerprints** (Stage 1) are *platform-catalog facts* — coarse but stable.
3. **Tokenizer differentials** (Stage 2) are *near-cryptographic*: tokenizer identity is hard to fake without actually being the model, and the cross-length requirement defeats the short-prompt collision attack.
4. **Behavioral probes** (Stage 3) are *corroborative*, not primary — appropriately weighted as such.
### The Self-Identification Trap
The paper's framing that self-identification is "untrustworthy by design" is the correct threat model. Any protocol that asks the model who it is has already lost. Xi's protocol never does.
### Limitations
- The 10-release test set measures **declaration consistency**, not end-to-end identification under anonymity.
- The flagship case confirmed **family and version line**, but the **deployment variant** was not pre-asserted — a reminder that version-line inference is not variant inference.
- Stage-0-only cases show the protocol can **decline**; abstention rates under true anonymity remain an open question.
### Implications
For **Cybersecurity** and **Network** practitioners, the protocol offers a reusable forensic pattern: reconstruct, fingerprint, differentially test, corroborate. For **Architecture** researchers, the tokenizer differential is a concrete, testable identity primitive. For **Cryptography**, the cross-length collision-rejection argument is the most transferable idea — identity claims should require agreement across a *spectrum* of probes, not a single point.
### Future Work
The obvious next step is a larger prospective trial under genuine anonymity, with pre-registered hypotheses and reported abstention rates.
Who should read this
Opening member content…