🤖 AI

KBF: Knowledge Boundary as Fingerprint for Language Model and Black-Box API Auditing

This paper introduces KBF, a low-cost black-box auditing protocol that uses stable numerical recall near the knowledge boundary to fingerprint language model APIs, effectively detecting economically relevant model substitutions and mixed-routing attacks across production endpoints and shadow APIs without requiring direct access to the models.

Original authors: Yijia Fang, Yiqing Feng, Bingyu Li, Mingxun Zhou

Published 2026-05-29

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yijia Fang, Yiqing Feng, Bingyu Li, Mingxun Zhou

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are buying a bottle of wine from a fancy, third-party reseller. The label says it's a rare, expensive vintage from a famous vineyard. But you can't see the bottle's contents, and the reseller won't let you taste it before you buy. You suspect they might have swapped the expensive wine for a cheap, generic brand to keep the profit margin high.

This is exactly the problem facing users of Large Language Models (LLMs) today. Many people buy access to these AI models through "relay" services or resellers. These services act as middlemen: you pay them, and they forward your request to the actual AI provider. The problem? The reseller might secretly swap the expensive, high-quality AI you paid for with a cheaper, lower-quality one, all while telling you it's the real thing.

This paper introduces a new tool called KBF (Knowledge Boundary Fingerprinting) to catch these "wine swappers" without needing to open the bottle or see inside the factory.

The Core Idea: The "Knowledge Boundary"

Most people think you can tell two AI models apart by asking them hard questions or asking them to introduce themselves. But AIs are tricky; they often lie about who they are, or they can be tricked into acting like someone else.

The researchers discovered a different way to identify an AI: look at the edge of its knowledge.

Think of an AI's knowledge like a library.

Inside the library (Common Knowledge): If you ask, "What is 2+2?", almost every AI will say "4." This doesn't help you tell them apart.
Outside the library (Too obscure): If you ask about a specific, made-up fact from a book that doesn't exist, the AI will just guess randomly. This is too noisy to be useful.
The Boundary (The Sweet Spot): This is the edge of the library. These are facts that are just on the edge of what the AI knows.
- A smart, expensive AI might know the exact answer.
- A cheaper AI might guess a slightly wrong answer.
- Crucially, even if the AI gets the answer wrong, it often gives the same wrong answer every time.

The researchers call these "stable wrong answers." They are like a unique fingerprint. If an expensive AI consistently says, "The boiling point of this obscure chemical is 106 degrees," and a cheap AI consistently says, "It's 108 degrees," that difference is a fingerprint. Even if the expensive AI is wrong, the pattern of its mistake is unique to it.

How KBF Works (The "Audit" Process)

KBF is a three-step process to catch a reseller in the act:

Fingerprinting the Real Thing (Offline):
First, the auditor talks to the official AI (the one the reseller claims to be selling). They ask it thousands of questions about obscure facts near the "knowledge boundary." They record exactly what the official AI says, even if it's wrong. They build a "fingerprint" of how this specific AI handles the edge of its knowledge.
Calibrating the Noise:
The auditor asks the official AI the same questions again to see how much it "jitters." Sometimes, even the real AI might give a slightly different answer due to random computer noise. KBF measures this natural "jitter" so it knows what a normal mistake looks like.
The Audit (Online):
Now, the auditor asks the suspect reseller the same questions.
- If the reseller is honest, their answers will match the official fingerprint (within the natural "jitter" range).
- If the reseller is cheating and using a cheap AI, the answers will drift away from the official fingerprint. The cheap AI might give a different wrong answer, or no answer at all.

KBF uses a statistical test to decide: "Is this difference just random noise, or is it proof that a different AI is being used?"

What They Found

The researchers tested KBF on 16 different real-world AI models and various reseller services. Here is what happened:

It Catches Cheaters: KBF successfully identified 155 different cases where a reseller swapped a model for a cheaper one. It did this without ever falsely accusing an honest reseller.
It's Robust: Resellers often change how they set up their AI (adding "personas," changing temperature settings, or using extra tools). KBF worked perfectly even when the setup changed. Other methods failed and accused honest people of cheating.
It Catches Partial Swaps: Sometimes, a reseller doesn't swap every request; they might swap 10% of them to save money. KBF is sensitive enough to catch this "mixed routing" even when only a small fraction of traffic is being swapped.
Real-World Results: The team used KBF to audit six shady "shadow" API platforms that advertise cheap access to top-tier models. They found that 7 out of 27 endpoints were lying about what model they were running. Interestingly, the lies were mostly concentrated on the most expensive, premium models (like Claude), because that's where the money is to be saved.

Why This Matters

Before this, if you wanted to know if a reseller was honest, you had to guess, ask the AI "Who are you?" (which it might lie about), or rely on unverified community tests.

KBF provides a low-cost, scientific way to verify what you are buying. It doesn't require the reseller to cooperate, it doesn't require special access to the AI's internal code, and it doesn't require asking the AI to do anything dangerous or weird. It simply asks the AI about obscure facts and checks if the answers match the "fingerprint" of the model you paid for.

In short, KBF is a lie detector for AI resellers, ensuring that when you pay for the "premium wine," you actually get the premium bottle, not a cheap substitute.

Technical Summary: KBF – Knowledge Boundary as Fingerprint for Language Model and Black-Box API Auditing

1. Problem Formulation

The paper addresses the "trust problem" inherent in the growing ecosystem of relay and reseller APIs for Large Language Models (LLMs). Users often access LLMs through third-party intermediaries that aggregate models, offering unified billing and switching capabilities. However, these intermediaries may silently substitute an advertised, expensive flagship model with a cheaper, less capable backend to increase margins.

The core challenge is black-box relay auditing: determining whether a suspect relay endpoint ( $O_{sus}$ ) is serving the specific model it claims ( $O_{ref}$ ) without access to:

Model weights, logits, or training data.
Server-side routing logs or hidden system prompts.
Provider cooperation (e.g., watermarks or verifiable inference).

The auditor possesses only public API access to both the official reference endpoint and the suspect endpoint. The goal is to detect full substitution (serving a different model entirely) and mixed routing (serving a mix of the claimed model and a cheaper substitute) while maintaining a low false-positive rate (avoiding false accusations against honest providers) and remaining robust to benign deployment variations (e.g., different system prompts, temperatures, or RAG wrappers).

Existing black-box methods fail to meet these requirements simultaneously. Behavioral fingerprinting (e.g., LLMmap) relies on fixed probes that are easily evaded or sensitive to wrappers. Distributional tests (e.g., MET) suffer from high variance under configuration changes. Self-identification prompts are unreliable as models often misstate their identity.

2. Methodology: Knowledge Boundary Fingerprinting (KBF)

The authors propose KBF, a protocol that leverages stable numerical recall near the knowledge boundary as a fingerprint.

Core Intuition

The authors observe that while models agree on common facts (low signal) and fail on obscure facts (unstable), they exhibit a distinct behavior near the "knowledge boundary":

Inside the boundary: Models stably recall correct numerical facts.
Just outside the boundary: Models often produce stable but factually incorrect numerical values.
These "wrong-but-stable" values act as persistent, model-specific parametric associations. A substitute model is unlikely to reproduce the exact same stable error or the specific stable correct value of the reference model.

The KBF Protocol

KBF operates in three stages:

Phase 1: Probe Generation (Offline)

Adaptive Frontier Search: The auditor queries the official reference endpoint ( $O_{ref}$ ) to propose candidate numerical facts across various domains (chemistry, astronomy, math, etc.). The search adapts to move toward increasingly obscure facts near the boundary of stable recall.
Reference-Consistency Checks: Candidates are re-queried under multiple benign configurations (e.g., varying system prompts, temperatures). Only candidates where $O_{ref}$ produces a stable, parseable numerical value (even if factually wrong) are retained.
Contrastive Screening (Optional): To improve efficiency, candidates are screened against a known cheaper substitute (e.g., a 9B parameter model). If the substitute matches the reference, the probe is discarded to ensure discriminative power.
Output: A compact set of probes $P_{ref} = \{(q_i, d_i, a_i, match_{d_i})\}$ , where $a_i$ is the reference's consensus value.

Phase 2: Self-Calibration

The auditor re-queries $O_{ref}$ with the enrolled probes under the specific audit configuration intended for the suspect.
The system counts self-discrepancies ( $k_{self}$ ) to estimate the "ordinary self-noise" of the reference endpoint.
A Clopper-Pearson (CP) upper confidence bound ( $p_0$ ) is calculated. This sets a conservative null tolerance for the number of errors expected from the reference itself.

Phase 3: Suspect Endpoint Audit (Online)

The auditor sends the enrolled probes to the suspect endpoint ( $O_{sus}$ ).
Responses are parsed and compared against the reference consensus $a_i$ using domain-specific matching rules.
A binomial statistical test is performed: If the number of discrepancies ( $k$ ) exceeds the threshold defined by $p_0$ (at significance level $\alpha = 0.05$ ), the null hypothesis ( $H_0$ : $O_{sus} \approx O_{ref}$ ) is rejected, and the endpoint is flagged as DIFFERENT.

Adaptive Routing Extension
For mixed routing (where only a fraction $\alpha$ of traffic is substituted), KBF employs a two-round audit:

Round 1: Audit all probes.
Round 2: Re-audit only the probes that mismatched in Round 1.
This concentrates queries on the most likely substituted traffic, allowing detection even when the substitution rate is low (e.g., 5–10%).

3. Key Contributions

Novel Signal Identification: The paper identifies "knowledge-boundary numerical recall" (including repeatable wrong answers) as a stable, model-distinct signal that does not rely on self-identification, style, or privileged metadata.
End-to-End Protocol (KBF): A black-box auditing protocol that transforms this signal into compact probe sets via adaptive frontier search, configuration-stability filtering, and contrastive screening.
Comprehensive Evaluation: Evaluation across 16 production LLM endpoints (8 families, 3 price tiers) demonstrating high discrimination against economically relevant substitutions.
Real-World Application: Deployment on six "shadow API" platforms, successfully flagging statistically inconsistent endpoints in a real-world setting without provider cooperation.
Open Resources: Release of code, data, and benchmark probe sets to support reproducibility.

4. Empirical Results

The authors evaluated KBF against three baselines (MET, LLMmap, ZeroPrint) and found:

High Accuracy: KBF detected all 155 economically relevant substitutions (including within-family downgrades) with 0 false positives on same-reference controls. Baselines suffered from high false-positive rates (up to 37.5% for LLMmap) or missed substitutions.
Robustness: Under six different deployment configurations (role prompts, temperature changes, RAG wrappers), KBF maintained 0 false positives and detected 100% of substitutions. Baselines either generated excessive false alarms or missed substituted models due to sensitivity to wrappers.
Mixed Routing Detection: KBF detected substitutions when only 5–10% of traffic was routed to a substitute (for Opus-based models) and up to 50% for harder cases (Sonnet-based).
Cost Efficiency:
- Enrollment Cost: ~$22 one-time cost to generate probes for a model version.
- Audit Cost: ~$0.39 total to audit all 16 models (approx. $0.02–$ 0.24 per model).
Shadow API Findings: In an audit of 27 endpoints across 6 shadow platforms:
- 7 endpoints were flagged as statistically inconsistent.
- 6 of the 7 flags were concentrated on premium Claude endpoints (Opus and Sonnet), aligning with the economic incentive to substitute expensive models.
- Tier Analysis: On platforms offering multiple pricing tiers for the same model, lower-priced tiers were significantly more likely to be flagged than higher-priced tiers, suggesting tier-dependent backend substitution.

5. Significance and Claims

The paper claims that KBF provides a practical, low-cost, and robust solution for third-party auditing of LLM relay APIs. Its significance lies in:

Operational Feasibility: It works strictly in a black-box setting, requiring no cooperation from the model provider or the relay.
Economic Relevance: It specifically targets the economic incentives of relays (substituting expensive models for cheap ones) rather than generic model identification.
Reliability: By calibrating against the specific reference endpoint's self-noise, it avoids the high false-positive rates that plague distributional or behavioral fingerprinting methods when deployment configurations vary.
Actionability: It enables users and researchers to verify service claims and identify "shadow" APIs that may be providing degraded or inconsistent services, particularly for high-value proprietary models.

The authors maintain a modest stance, noting that KBF is a statistical triage tool rather than cryptographic proof of backend identity. They acknowledge that high-stakes operational use requires further calibration (e.g., repeated audits across time and regions) and that the current binomial model assumes probe independence, which may need correction for domain-block correlations.