Research map / Large language models / Language, safety and interpretability

Model Equality Testing: Which Model is this API Serving?

ICLR 2025 · Large language models › Language, safety and interpretability · approach: LLM unlearning and benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Formalizes auditing black-box LLM inference APIs as two-sample Model Equality Testing and shows an MMD test with a Hamming string kernel is the most sample-efficient, then uses it to flag 11 of 31 Llama endpoints from Summer 2024.

Problem

Users of black-box LLM inference APIs cannot tell whether providers have silently altered the model (quantization, watermarking, finetuning, substitution) or whether endpoints drift over time; greedy short-answer audits do not capture the full output distribution.

Approach

Frame API auditing as a two-sample hypothesis test between reference and API completion distributions, and use an MMD test with a simple prompt-conditioned Hamming kernel over completions, which is more sample-efficient than universal kernels (all-substrings, one-hot) and multinomial tests.

Key results

• The Hamming MMD test achieves a median 77.4% power across alternatives (quantization, watermarking) at an average of 10 samples per prompt over 25 prompts.
• Of 31 commercial Llama endpoints across nine providers, 11 are flagged as serving distributions different from Meta's reference weights (Perplexity fails all tests).
• Estimated MMD between Perplexity's Llama-3 8B and the fp32 null (0.03) is comparable to the gap between Llama-3 8B and GPT-3.5-Turbo (0.03), and some endpoints are further from reference than substituting a different model.

Measured effects reported in the paper

Surprising findings

• Some API endpoints deviate from reference weights by an amount comparable to substituting an entirely different language model.
• Models within the same family cluster together in MMD distance, suggesting training data matters more than scale; some GPT generations are far apart despite the same family.

Limitations

• Hamming MMD is only a pseudo-metric and may not separate all distributions; fp16 vs fp32 differences are hard to detect.
• Composite null testing with two reference precisions reduces power; API audits are snapshots from Summer 2024 and only test a few prompt distributions.
• Moderate correlation with task accuracy (R^2 = 0.392).

Experimental setup

Datasets: Wikipedia continuation prompts HumanEval UltraChat

Benchmarks: Wikipedia continuation task HumanEval UltraChat

Metrics: statistical power false positive rate MMD estimate task accuracy correlation (R^2) rejection rate per endpoint

Baselines: all-substrings kernel MMD one-hot kernel MMD L1 multinomial test chi-squared multinomial test Levenshtein MMD

Builds on: maximum mean discrepancy two-sample test all-substrings kernel multinomial two-sample tests

Closest papers by meaning

• Model Provenance Testing for Large Language Models (NeurIPS 2025 · similarity 0.86)
• Statistical Hypothesis Testing for Auditing Robustness in Language Models (ICML 2025 · similarity 0.83)
• The Silent Hyperparameter: Quantifying the Impact of Inference Backends on LLM Reproducibility (NeurIPS 2026 · similarity 0.82)
• Debiasing Algorithm through Model Adaptation (ICLR 2024 · similarity 0.82)
• Context-Aware Testing: A New Paradigm for Model Testing with Large Language Models (NeurIPS 2024 · similarity 0.82)
• Do We Truly Need So Many Samples? Multi-LLM Repeated Sampling Efficiently Scales Test-Time Compute (AAAI 2026 · similarity 0.82)