You can fingerprint which model an API is actually serving from its tool-call distribution, at 100% detection

arXiv 2609.00052·medium signalXBlueskyLinkedInCopy link

Text-channel audits of commercial LLM APIs break down for agentic use because serving stacks discard text and expose only structured actions when the model calls a tool, and provider-injected system prompts distort text distributions enough to falsely accuse honest providers. AgentProv fingerprints a deployed model through its categorical tool-call distribution and decides identity with an MMD permutation test, catching every substituted model across 630 checkpoint pairs while holding the false-positive rate under system-prompt injection at 7%, against 67% and 53% for two text-channel baselines. This is a practical check for anyone routing agent traffic through a third-party gateway.