Methodology

A model's tokenizer is unusually useful for family attribution because it is fixed at training time. A name, a system prompt, a price or a model card can change overnight; the vocabulary a model reads with cannot change without retraining.

Each model is sent 50 adversarial strings: CJK, Korean, Hebrew, Thai and Arabic text, emoji with skin tones, ZWJ sequences and flags, combining marks, astral-plane characters, whitespace runs, digit strings, code, base64 and URLs, chosen to maximise disagreement between tokenizers. The reply is discarded; only the reported prompt-token count is read. The model's fixed overhead (its chat template, any hidden system prompt) is measured with a single-token baseline and subtracted, leaving the marginal token cost of each string under that model's tokenizer. Those 50 numbers are the fingerprint.

Two models sharing a tokenizer agree on every string. Two models with different tokenizers diverge on the high-information strings within a handful of samples. Because each model is measured once and compared offline, cost scales with the number of models rather than the number of pairs.

Prompt caching. A provider whose token accounting is disturbed by caching reports marginals that are negative or impossibly large. Every row outside the plausible window is marked corrupt and excluded; a model with eight or more corrupt rows is declared unmeasurable rather than published wrong.

Variable overhead. The baseline is measured before and after the string set. If the two disagree, the subtraction is invalid and the run is discarded.

Provider routing. The same named model can be served by providers whose chat templates differ. Calls are pinned to the first provider observed; when routing moves anyway, a separate baseline is measured for the new provider before any of its counts are used, and every observation records which providers served it.

Template boundary shifts. A serving template that glues the test string to an adjacent character shifts affected rows by exactly one token. Two signatures that differ by a uniform single-token shift are treated as one tokenizer behind two templates, and the link is recorded rather than silently merged.

Routers and aliases. A router is not one stable model and is excluded. An alias entry points at its target's record. A serving variant inherits its base model's measurement instead of spending its own.

The endpoint is not the weights. When a fingerprint contradicts a label, the model's own published tokenizer, where one exists, is downloaded and run over the same fifty strings offline. That separates what the MODEL reads with from what the SERVING layer counts with: an endpoint whose accounting disagrees with its own model's repository is a serving-layer finding, and is recorded as such on the model's page.

A fingerprinting system must publish how much it can actually distinguish. Of 152 models with complete clean fingerprints, the corpus currently holds 46 distinct signatures in 35 tokenizer groups. Tokenizer evidence separates groups, never individual releases within a group: that is what the claims hierarchy is for.

Four claims, in rising order of strength, each needing strictly more evidence:

1. Observed fact. Two models returned the same measured vector.
2. Relationship inference. The models likely share tokenizer lineage.
3. Family attribution. The unknown model is consistent with a named family.
4. Exact model attribution. This endpoint is a specific release. The measurements on this site never make this claim on fingerprint evidence alone.

Confidence is rule-based rather than numeric: very high needs an exact fingerprint match plus an independent second signal with nothing contradictory; high needs one very strong signal; moderate and low record weaker evidence. Percentages would imply calibration the system does not yet have, so it does not print them.

Measurements are taken against public endpoints whose operator invites queries, at published prices, within provider rate limits, with no user data involved. The tooling is not for pointing at anything the operator is not entitled to query.

Known limits: a tokenizer can be reused across a lab's generations and can in principle be adopted by another organisation, so a shared fingerprint is lineage evidence rather than identification. Reported token counts depend on provider accounting, which is why the controls exist and why unmeasurable is an honest verdict. Behavioural signals change with prompts and configuration, so they are treated as supporting evidence only, and the current dataset does not use them at all.

The measurement harness, the frozen catalogue snapshots and every raw observation are committed to the YFarmX repository, so any published figure can be reproduced against its dated source. Method version: v1-50, 50 strings.