# Model provenance and trust — reference note

NC · 21 September 2026 · a standing reference for the Model Identification studies and for Poetix attribution · written so the next study inherits this rather than rediscovering it · figures from the requested-vs-served fields logged across MI-02 (200 calls) and MI-03 (360 calls).

## The one fact to carry: we always got the model we asked for

Across all 560 logged calls, exactly one seat ever returns a string different from the request, and it is not a substitution:

| seat | requested | served (runner-recorded) | relationship |
|---|---|---|---|
| Claude | `claude-sonnet-5` | `claude-sonnet-5` | exact |
| GPT | `gpt-5.4-mini` | `gpt-5.4-mini-2026-03-17` | **alias → dated snapshot** |
| Gemini | `gemini-2.5-flash` | `gemini-2.5-flash` | exact |
| Grok | `grok-4.3` | `grok-4.3` | exact |
| Qwen | `qwen-plus` | `qwen-plus` | exact |

- **No family or capability substitution has ever occurred** in our data. We have never asked for one model and been served another.
- **Only OpenAI returns a different string, 100% of its calls**, and it is *alias resolution* — the provider expanding our alias to the dated build it points at. That is more specific than we asked, not different.

## What `model_served` is, and is not

`model_served` (a.k.a. `reported_model`) is the `model` field the provider's **server** stamps on the response — set by serving infrastructure, not generated token-by-token. That makes it far stronger than the model's in-band self-report (which the MI studies showed is useless for version: 0 self-reports across ~1,750 asks). It is the right reference, and it is what every MI and Poetix result is scored against.

It is **not** independently verifiable ground truth about the weights. It is the provider's **attestation**. The trust chain ends at the provider; no API exposes weight-level identity, so this is provider trust all the way down.

## The stability crux — alias vs pinned build

This is the part that bites, and it splits our five seats:

- **A dated snapshot** (OpenAI's `…-2026-03-17`) is a **pinned, version-stable label**: request it later and, if it still exists, you get the same weights.
- **A bare alias** (`claude-sonnet-5`, `gemini-2.5-flash`, `grok-4.3`, `qwen-plus`) is a **moving pointer**: the provider can re-point it to a patched or updated build **without the string changing**. For four of five seats, `model_served` therefore guarantees the *label*, not stable weights over time.
- **Within a run** it is stable — constant across all 560 calls — so for attribution *inside a study* it is reliable. **Across time or between studies**, only the dated snapshot is safe.

## Can we trust the runner? Yes for what it is for, no for more

- **Trust it for attribution and within-run reproducibility.** It is deterministic, infrastructure-set, constant across our calls, and it is our **only substitution detector** — a family swap would show here, and never has.
- **Do not treat it as verified truth about the weights.** For four of five seats it is a moving alias, not a pinned build.
- **The version finding, re-read in this light.** The MI studies found that no call ever *produced* or *selected* its served version. Part of that is real (models don't have reliable version self-knowledge). Part is that, for a bare-alias deployment, **a stable served version barely exists as an object** — there is no pinned build string exposed to name. The models can't name a thing the API doesn't really pin either.

## Practice (cheap, inherited by the next study)

- **Log requested AND served on every call.** We do. That pair is the substitution detector; never drop it.
- **Request the dated snapshot where a provider offers one**, so the reference is reproducible across studies. Today only OpenAI pins; for the other four, **the run date is the only version coordinate we have — record it.**
- **Write it as "provider-attested served model, as of <run date>," not "the model."** Same discipline the MI-03 vocabulary finding taught: do not overstate a label's certainty.
- **When a result turns on an exact string** (e.g. the MI-03 recognition ballot), use the exact `model_served`, not the requested alias — that mismatch is precisely what compromised GPT's ballot.

© Randall Hoyt 2026