Ask the model what it is and you learn nothing: endpoint identity belongs in the eval gate

Self-report fails for a structural reason, not a moral one. The sentence a model emits about its own identity sits downstream of every editable thing in the path, including system prompts, fine-tunes, wrappers and style instructions, according to the dev.to guide on model fingerprinting ^[5][14]. Provider metadata is no safer, because a proxy in the path can strip it ^[2]. Remove both and what is left is behaviour the serving stack cannot help producing: token counts, chat-template overhead, validation errors, context limits, stream behaviour, tool-call formatting, latency profiles ^[6][1].

That is a narrower claim than it first looks. The guide's strongest single signal is the tokenizer: send fixed strings, compare the token usage that comes back, and different model families split text differently ^[10]. But those usage numbers arrive through the same request path the probe exists to audit, and that path is the one described as containing proxies that alter metadata ^[2][2]. A probe is evidence about the reporting layer's consistency first and the model second; it catches change well, and proves identity less well than the framing suggests.

The design constraints also pull against each other. Probes are meant to use tiny prompts so verification costs less than the workflow it protects, and they are meant to combine several signals because one signal can lie ^[9]. Both cannot be maximised on every route ^[3], so the practical unit is a per-route signal budget: the full combination on paths carrying tool calls, cost controls or compliance promises ^[15], one tokenizer probe on the rest.

The part worth stealing is the separation of questions. Evals ask whether the answer is good; fingerprinting asks whether the thing evaluated and the thing serving are the same ^[7]. Those have different owners and different failure modes, and a benchmark that passed on one model while production quietly serves another is a comfort blanket rather than evidence ^[8]. Run the check before production traffic is routed ^[16] and the eval suite gains a precondition it currently assumes: the endpoint under test is the endpoint under load.

Scope stays small, to the guide's credit. It does not claim to identify every model in existence ^[17]. It asks whether the gateway hit the expected family, whether an alias moved underneath you, whether a fallback fired, whether a proxy injected a hidden template, whether a self-hosted endpoint switched runtimes ^[11]. That is a smoke test for infrastructure ^[12], aimed at solo developers and small teams running routers across several providers ^[13]. At that price, not running it is a decision someone made.