Model Equality Testing: Which Model is this API Serving?
Authors: Irena Gao
Percy Liang
Carlos Guestrin
Venue: ICLR 2025 Poster (2025)
Keywords: API monitoring
model shift
two-sample testing
Primary area: foundation or frontier models, including LLMs
TL;DR: We formalize black-box API monitoring as a two-sample testing problem and show tests based on string kernels are powerful for this task.

Abstract: Users often interact with large language models through black-box inference APIs, both for closed- and open-weight models (e.g., Llama models are popularly accessed via Amazon Bedrock and Azure AI Studio). In order to cut costs or add functionality, API providers may quantize, watermark, or finetune the underlying model, changing the output distribution --- possibly without notifying users. We formalize detecting such distortions as Model Equality Testing, a two-sample testing problem, where the user collects samples from the API and a reference distribution and conducts a statistical test to see if the two distributions are the same. We find that tests based on the Maximum Mean Discrepancy between distributions are powerful for this task: a test built on a simple string kernel achieves a median of 77.4% power against a range of distortions, using an average of just 10 samples per prompt. We then apply this test to commercial inference APIs from Summer 2024 for four Llama models, finding that 11 out of 31 endpoints serve different distributions than reference weights released by Meta.

Published as a conference paper ICLR 2025
MODEL EQUALITY TESTING: WHICH MODEL IS THIS API SERVING?
Irena Gao, Percy Liang, Carlos Guestrin
irenaêcs stanford.ede pliangêcs. stanford. edu, guestrin@stanford. edu Stanford University
ABSTRACT
Users often interact with large language models through black-box inference APIs, both for closed- and open-weight models (e.g.. Llama models are popularly accessed via Ama- zon Bedrock and Azure AI Studios). In order to cut costs or add functionality, API providers may quantize, watermark, or finetume the underlying model, changing the output distribution possibly without notifying users. We formalize detecting such distortions as Model Equality Testing, a two-sample testing problem, where the user collects sam- ples from the API and reference distribution, and conducts statistical test to see if the two distributions are the same. We find that tests based on the Maximum Mean Discrep- ancy between distributions are powerful for this task: test built on a simple string kernel achieves a median of 77.4% power against a range of distortions, using an average of just 10 samples per prompt. We then apply this test to commercial inference APIs from Summer 2024 for four Llama models, finding that 11 out of 31 endpoints serve different distributions than reference weights released by Meta.
INTRODUCTION
Since running a large language model requires compute and technical expertise, many users rely on black- box APIs to handle inference. This applies to both closed-weight models, like GPT and Claude, and open- weight ones: c.g., Amazon Bedrock, Microsoft Azure, and the seven other companies Figure all compete to offer Llama models as a service. While users can sample from black-box APIs, they have little to no insight into the underlying implementation the model, including into questions like:
1. How has the API modified the language model's distribution? To drive down costs, API providers may quantize or prune large model weights; they may also watermark outputs or in- correctly implement some decoding parameters. These changes distort the resulting distribution of completions. The problem when such distortions are undisclosed: users assume that calling third-part party API is exactly equivalent to working with the original model. For example, bench- marks like HELM (Liang et al., 2022) evaluate models through third hirrtpprtty APIs, but quantized or watermarked models may be less capable than the intended model.
2. Is the API changing over time? Language model inference endpoints may also drift over time without notifying users (Chen et al., 2023; Eyuboglu et al., 2024), e.g., due finetuning updates to the inference stack. Unstable APIs affect research reproducibility (Pozzobon et al., 2023) and can disrupt user productivity human-AI teams (Bansal et al.. 2019).
Under the status quo, neither users nor regulators have way to rigorously answer these questions for themselves.' These concerns are important address: tens of thousands of developers already rely on black-box inference APIs for applications (Amazon, 2024), and this dependence will increase as LLMs
These problems already experienced by users: e.g., threads 1, 2 and 3.

---

Published as conference paper ICLR 2025
?
Liama
API Provider
8B
708
BB
708
How has the API modifled the LLMIs sampling distributtion?
D0
aws
X
X
X
X
sample
Referonce model
/
deepinfro
/
Se. Freworis
x
sample
groq
x
x
Black-box LLM API
changing
s perpexity
X
x
x
(current)
Pepliaate
Black LLM
together.ai
Figure (Left) We formalize auditing black-box language model inference APIs Model Equality Testing. This enables us to assess API's faithfulness to a reference distribution and its stability over time. (Right) We evaluate candidate tests and apply the most powerful one Ilaaa model APIs from Summer 2024, finding that 11 of 31 endpoints deviate from reference weights released by Meta.
and the corresponding infrastructure costs for hosting grow larger. For example, most must rely third-party APIs to use Llama 3.1 405B because of its size.
The current approach this problem is for outside auditor monitor APIs' accuracies on multiple-choice or short-answer benchmarks (ArtificialAnalye) 2024); these studies typically decode from the language model greedily. Such audits can be poor match for user needs. Greedy decoding only checks that the modes of the next-token distributions match, rather than the overall distribution over completions, which is problematic because users often sample from models. Short-answer benchmarks cover only a small slice of possible prefixes, which may significantly differ from particular user's task: e.g., common applications like code generation, dialogue, and summarization are longform tasks. Ideally, users could personally audit APIs their custom tasks. Such a method should be sample-efficient, apply to tasks without automated verifiers, and assess with confidence whether the overall distribution of completions has shifted in a statistically significant way.
We provide such a method. Suppose a user wishes to audit a an API on their task interest. The user collects samples: example, to answer if an API has modified the distribution of an open-weight model, P might be from reference model weights released Hugging Face. To answer the API is changing over time, / might be from the API at an earlier point in time (Figure left). The user then conducts two-sample test for whether P Q examine the API's distribution statistically indistinguishable from the reference.
from reference distribution P and from the test API's distribution Q. For
Our setting is challenging because the distributions being compared are high- -igh-dimensional:: they are defined over multi-token completions from large vocabularies. Two- Two-sample kernel tests based on estimating the Maximum Mean Discrepancy (MMD) between P and Q (Gretton et al., 2012) are flexible tools for this setting, as they allow us to specify a featurization to reduce dimensionality. We find that a simple string kernel based on the Hamming distance between completions is particularly sample-efficient. In simulations ($4), this test achieves a median of 77. 77.4% power against a wide range distortions - e.g., quantization, watermarking, and finetuning prompts. We then apply this test to nine commercial inference API providers across four Llama models ($5, Figure right). Our test flags 11 out of these 31 endpoints, with each audit costing less than $1.
using average of just 10 samples per prompt for distributions over 20-25
2

---

Published as a conference paper ICLR 2025
Because our test statistic is an estimate of distance, we also explore how this machinery can quantity statistical distances between black-box endpoints. In $4.3, we estimate pairwise distances between the output distributions of language models without requiring log probability access and find that models within the same family (e.g., the Llama family or GPT-3.5 family) output more similar distributions than models within the same size range (e.g.. 7B or 70B models). In $5, we estimate the effect size of deviations between API endpoints and reference weights, finding that some implementations are further from the reference weights than if the provider had substituted an entirely different language model.
Summary of contributions. We unify several API auditing tasks under the formalization of Model Equal- ity Testing, two-sample distribution testing problem, and empirically validate kernel-based tests for this problem. We then apply this test to audit popular commercial inference APIs. To enable users to audit APIs for custom applications, we open-source Python package. We also encourage future research in Model Equality Testing by releasing dataset of I million LLM completions from five models."
2 THE MODEL EQUALITY TESTING PROBLEM
Suppose an auditor is interested in a task parameterized by a distribution л over m prompts and a maximum completion length of L tokens. The auditor has sample access to a reference distribution P and API distribu- tion Q both operating on the same vocabulary V with the same decoding parameters. The auditor samples N prompt-completion pairs == (z, v) from each distribution:
Dp = (2(0) (00 7, ~ P(- x (0))) )
(1)
Dq= (2()) :z(1) y.y (0) Q(- x 1
We wish use these samples test if P Q i.e. distinguish between the hypotheses
Ho (<)) P(y .) x (x) x)) H1 : (() x) (x)Q(1) x))
(2)
We require that the Type-1 error rate is controlled at a. A good test will maximize power against unknown Q and generalize across several language models and prompt distributions æ. We are particularly interested in sample-efficient tests that are cheap to run: such tests are powerful when N is small compared to the size of the vocabulary [V] and the maximum completion length L.4 The latter parameters modulate the size of the space that the joint distributions where m is the number of prompts captured in æ. Effective tests must navigate this high- nigh-dimensional space well. Fortunately, expect the distributions in practice to be lower-dimensional, language typically only places significant mass on a small number of tokens at each position.
defined over: the set of all prompt-completion pairs has size m| V/
Throughout the paper, we will use n, SS} to denote the count of object s string or sample S, n to denote the joint distribution of prompts and completions under P, and TQ to denote the joint distribution under Q.
3 METHOD
To tackle the problem, we employ a two-sample kernel test from Gretton et al. (2012). This test uses samples 'Dr and Do estimate the Maximum Mean Discrepancy (MMD) between P and Q, which is measure of the distance between the two distributions. Intuitively, if the estimated MMD is large, we reject the null hypothesis that P Q.
Package, experiment code, and dataset: https: htt:://gitttttu cctmm//igaammmollle-ualaatttteee
'In Appendix C.6, we discuss how to extend this setup to uncqual sample sizes. As concrete example, Llama-3 uses vocabulary size of V 128 256, and users often sample L = 250 tokens for longform generation tasks.
3

---

Published as a conference paper ICLR 2025
The MMD is defined with respect to a unit-norm kernel function and its associated feature map é. For our two joint distributions x P and æQ, the MMD is defined as the squared distance between the expected features from each distribution:
MMD; (T (TP =Q)
|| [o(=)] R [d(=)]]1
(3)
P [k(2,2']] 2 [k(22 - P. (k(2,2'))
For simplicity, we select kernels of the form k(z, 2²) 1fx = x' (kV y'), where k is prompt-agnostic kernel over completions. Then (T P, 7 +)) = Rzz= [MMD] (P(y x)) Quy x))]-
To conduct a two-sample test with samples De and Dp, the test statistic is the empirical estimator of (3):
MMD(DQ. (D) N(N - 1)
Σ k(2,2)) + Σ E.
M2,222 2
2
Σ E
Σ xEDp='EDq
k(2,2").
(4)
N2
We can compute p-values by simulating the test statistic's distribution under the null, i.e., by repeatedly sampling both Do and 'Dp from P and computing (4), Alternatively, to avoid drawing extra samples from P. we can use the permutation procedure (Lehmann al., 1986), at potential cost to power. This procedure repeatedly shuffles samples between Do and Dp to recompute the test statistic (Appendix A.2).
Kernel choice. The choice of kernel (k, Φ) determines the test's semantics and power. For example, setting 6(2) to be an indicator of whether y passes automated verifier for Hr when one is available, leads to rejecting the null when P, Q result in different task accuracies. However, because á is relatively coarse, the MMD may be zero even when P + Q. limiting the test's power. At the other extreme are universal kernels, which guarantee that the MMD is zero if and only if P = Q (Gretton et al., 2012). One such universal kernel for strings is the computationally expensive all-substrings kernel (Borgwardt et al., 2006):
(an(y.))
Σ SEVEL
En(ty nsty'),
(5)
where n. [v is the number of times appears in y. Another universal kernel is the one-hot kernel:
Kone-ber (y. v/) 1yy=y'}.
(6)
which results in classical two-sample multinomial test between the joint distributions. While universal ker- nels can eventually detect differences between any P. Q with enough samples, they may have low power in the small-sample regime. For example, the one-hot MMD measures if there are more exact match collisions within Dr p or Dq than between them, but in small samples, we may see no duplicate completions at all.
We posit that other string kernels, though not universal, provide more powerful features for testing with small samples. Specifically, we investigate a fast kernel related to the Hamming distance between completions:
1. 1 = v/
knamming (2.1/)
Σ
where y shorter than L is right-padded with special token. Intuitively, test based on this kernel rejects if a significantly larger number of substitutions are needed to align completions between Dp and Dr2 than within each sample. The associated Hamming MMD is pseudo-metric, as it is when P = Q and obeys the triangle inequality, but may not separate all distributions (Appendix A. Despite this limitation, we find in the following sections that this kernel is empirically effective and well-suited to common distortions we encounter with language models: quantization, watermarking, finetuning, and related distortions tend to result in detectable inter-sample Hamming distances.
4

---

Published as a conference paper ICLR 2025
4 EVALUATING TESTS IN SIMULATIONS
In this section, evaluate test's power using different kernels at checking equivalence between known pairs of distributions. Specifically, we evaluate tests can detect when a language model has been quantized watermarked ($4.1), 1), finetuned ($4.2), swapped out for different model altogether ($4.3).
All experiments in this section are run on a longform language modeling task. The prompt distribution ı a uniform distribution over m 25 random 100-character strings sampled from English, German, Spanish, French, and Russian Wikipedia (Box 1). The maximum completion length is L 50, and we sample using temperature 1. Power is computed from 100 Monte Carlo simulations. We estimate p-values simulating the empirical distribution of the test statistic under the null 1000 times; in Appendix C, we validate that the permutation procedure results the same trends.
Box Sample prompt for the Wikipedia language modeling task
Continue the paragraph. Do not output anything except the continuation to the paragraph. Start the continuation immediately.
"The British Arab Commercial Bank PI.C (BACB) is an international wholesale bank incorporated the U..."
To evaluate tests' generalization across prompts, we repeat power experiments over ten different prompt distributions, where we resample 25 Wikipedia strings for each æ. All tests are conducted at significance level of = 0.05. Additional details can be found in Appendix B.
4.1 DETECTING QUANTIZATION AND WATERMARKING
our first experiments, the reference distribution represents full full-precision weights published on Hugging Face. We evaluate if tests can distinguish P from alternative distributions Q:
Quantized models. These alternatives represent the model inferenced at lower precisions: nf4 (Dettmers et al., 2024), int8 (Dettmers et al., 2022), and fp16. Some accounts suggest that quanti- zation particularly degrades Llama-3 models on longform tasks (Reddit, 2024; Panda, 2024).
Watermarked models. Some providers may watermark outputs so that they are later detectable as having been generated by the platform. We apply the watermarking algorithm from Kirchenbauer et al. (2023) with default bias of 2.5.
We repeat evaluations for 5 instruction-tur -undd models: Mistral 7B Instruct (Jiang et al., 2023), Llama-3 8B and 70B Instruct, and Llama-3.1 8B and 70B Instruct (Meta, 2024). Additional models are in Appendix C.I.
Tests We compare three choices of kernels: the Hamming kernel (7), the all-substrings kernel (5), and the one-hot kernel (6). We also evaluate two tests from the multinomial testing literature (Balakrishnan Wasserman, 2018; Bhattacharya & Valiant, 2015);
n2 [D - {D
Do)
Σ
(8)
N
sEDpUDg
(n, [Dp] n. (D2))² n, (Dp] - n. [Do]
((Dr,Da) = N2
Σ
n. (Dr) +n. (DQ)
=EDPUDg
Results. Figure 2 (left) compares the empirical sample complexities of each test. To draw out a sample complexity curve, we vary the number of samples from N = 10m N 100m, where the number of prompts in the prompt distribution. We observe that the Hamming MMD test attains the highest power with the fewest samples: average of 10 samples per prompt, this test has a median power
25 is
5

---

Published as a conference paper ICLR 2025
Sample complexity @ 50
Robustness to long completions @ N 250
MMD (Hamming) power by altemative
Medan power across atematwes
1.0
Medan power across altmaaatto
1.0
0.8
0.6
0.6
0.4
0.4
0.2
0.2
0.2
0.0
0.0
0.0
500
2500
1000
1500
2000
2500
Number sampless
Length of completion
Number samples
(Hamming)
Substringss
Two sample
watermark
intil
(Left) Sample complexity of tests. At an average of just 10 samples per prompt, the Hamming MMD test is able detect quantization and watermarking with nontrivial power. Curves first median power across alternative distributions Q. averaged over language models and prompt distributions, with shaded standard errors. Results stratified by language model and alternative are in Appendix C.I. (Middle) While other tests rapidly degrade in power when the user is interested in longer completions, the Hamming MMD) test maintains power best across completion lengths. (Right) Power of the Hamming MMD test, stratified by alternative distribution. The test is significantly less powerful against the fp16 alternative.
Figure 2:
of 77.4% across alternatives. Figure (right), we break down power by alternative distribution. The Hamming test is strong on all alternatives except fpl6, where the initial power at N 10m is much smaller. This suggests that fp16 and fp32 differ in ways that are not captured by the Hamming kernel.
To accommodate user tasks which require very long completions, it is important that tests retain power the completion length L increases, even though the size of the sample space grows exponentially with L. In Figure 2 (middle),
fix N 250 (i.e., N 10m) and vary the completion length T. from to 50 tokens. We observe that the Hamming MMD and all substring tests are more robust to increasing completion length than the other tests. This result is consistent with the intuition that clever string kernel as opposed to a one-hot kernel - can help MMD tests generalize to high-dimensional spaces.
4.2 DETECTING FINETUNING
Given their effectiveness in detecting quantized and watermarked models, we next ask if MMD-based tests can detect when a model has been finetuned. We finetune Llama-3 8B Instruct on two datasets: disjoint, i..dd. split of the testing Wikipedia task, and an out- out-of-distribution code dataset (Chaudhary, 2023). We use a small learning rate of 1 x 10-6 with AdamW (Loshchilov, 2017). We then use the Hamming MMD test to compare finetuned checkpoints Q to the original model as the reference distribution P.
Figure (upper left) plots power against the checkpoint number of the finetuned model. The Hamming MMD test is always able to detect finetuning with nontrivial (greater than 50%) power, even after single epoch (42 optimization steps). One might expect that finetuning on the out-of-distribution code dataset would not affect the model's distribution on the Wikipedia testing task, but find this is not the case. Finetuning affects the model on other distributions enough to be detectable by statistical tests. These results suggest that it is challenging to isolate the effects of full finetuning to any single distribution, which may have implications for tasks such as unlearning or model editing (Hase et al., 2024).
4.3 DISTINGUISHING IF SAMPLES COME FROM DIFFERENT LANGUAGE MODELS
We next explore if the Hamming MMD test can distinguish whether two bodies of text are generated from the same language model. In this setting, P and Q are two different language models, drawn from pool of 13 instruction-tunee models (Figure 3 right), including eight open-weight models (Abdin et al., 2024; Groeneveld et al., 2024: Team et al., 2024) and and five OpenAl closed- weight models. In order compare
6

---

Published as conference paper ICLR 2025
Detecting
finetuning
Estimntedd distance between models (MMD Hammingg)
Average power
1.0
Liama 8B
0.00
0.5
Llama-3 70B
0.01
0.00
0.06
Uama 3.1
0.02
3.20
8
Number of dataset spachs
Mittr
Rineuuned on Wikipodia distribbtio)))
Ph--3 mini
0.04
0.05
0.05
3.35
0.01
0.00
Finetuned CodeAlpaca (oub of distribbuin))
Power
gpt-4o mini
0.04
0.00
0.05
0.05
0.00
0.04
0.07
0.00
0.02
Alternative Q
(P I.lama3.1 8B)
spt-fo
0444
0.05
9.25
0.01
9.00
3,500
Llama 8B
0.76 (0.00)
g0s turbo 0125
0.02
3.23
0.02
0.52
0.00
0.01
3
(0.00)
Llama-3.1 3.1 70B
0.75 (0.07)
turburroooooo 1106
0.03
0.04
9.03
0.02
2.02
0.05
0.07
9.81
0.003
0.00
OLMo
1.00 (0.90)
gpt upl-4o-mini
1.00 (0.00)
0.04
2.03
0.07
0.04
2,000
Llama 3.1 SB (watermark)
0.32 (0.04)
Llama-3.1 3.1.3 (in(8)
Gemmai2 9B
0:07
0.05
0.08
3.05
13
0.10
3:31 0.13 0:31
3.05
6.04
0.07
0.59
Llama 3.1 8B (nf4)
1.00 (0.00)
L 6g
Lix 3.1 80
Limoa-3. 3.1
Musrrll 70
Phi-3 mini
OLAt
6ot-40-min m02-4--min
8ct-46
a0t.5 S-tttbbb 0125
0o0 3 4--ubnn-- 30-0 1105
4 4-0125 20125--tre preddww
Gemma-2 50
708
Figure 3: (Upper left) The Hamming MMD test is able detect when Llama-3 8B has been finetuned on datasets of 1000 samples, even after single epoch. Power is higher, earlier, when the finetuning distribution Li.d. with the testing distribution. (Lower left) The Hamming MMD test can also detect when two models are different with near-perfect power. Standard errors Appendix C.2. (Right) The MMD framework allows us to estimate statistical distance between any models from which are sorted using spectral clustering with two components. Models within family are typically clustered together, suggesting that factors like training data, rather than scale, determine model similarity.
prompt distributions. Full results are in
draw samples. The cells show average estimated MMDs over 10 bootstraps. Rows
models with different tokenizers, samples must be compared in character space. We sample L = 50-token completions to the Wikipedia language modeling task before, and then we decode these characters, ignoring special tokens. The vocabulary of interest is now all Unicode characters ([V) 155 063), the maximum completion length is 1000 characters, and we test with N 10m samples.
Switching to character space makes the testing problem significantly more challenging, as the sample space is higher dimensional: Figure 3 (lower left) shows that power to detect quantization and watermarking is lower this setting than the token space setting ($4.1), However, even in this more challenging setting, we find that all model swaps are detectable with 100% power, except for pairs within the Llama family, e.g., Llama-3.1 8B and Llama-3.1 70B (75% power) or Llama-3 8B and Llama-3.1 8B (76% power; Figure lower left). Model swaps significantly more detectable than watermarking quantization. Appendix D.2 shows qualitative examples of completions from different models.
Estimating distances between models. A useful feature of the MMD tests is that the test statistic is an estimator of a distance. As result, we can reuse the machinery quantify the degree which two models differ by estimating Ez-- (MDD( MMD between all pairs of models. To decrease estimator error, we increase the sample size N 100m samples from each model and report the average MMD over 10 simulations, along with standard errors. We observe that models within a family are typically clustered together, suggesting that training data, rather than Note that the Hamming MMD is pseudometric: MMDrtamming! (P, (P.Q. Q) 0 does not imply (Appendix A.1).
x), Q( +))]. Figure 3 (right) estimates the Hamming
7

---

Published as a conference paper ICLR 2025
scale, determines model similarity. Surprisingly, while generations of Llama models (3 and 3.1) are close in distance, some generations of GPT models (e.g., 4-preview and 3.5-turbo) are not. This result suggests the use of different training data or procedures between these models.
5 AUDITING INFERENCE API PROVIDERS
As a case study, we now apply our test to 31 commercial inference endpoints for four of Meta's Llama models (Figure 1). These endpoints are distributed across nine API providers from Summer 2024: Amazon Bedrock, Anyscale, 6 Azure AI Studio, Deepinfra, Fireworks AI, Groq, Perplexity, Replicate, and Together.ai." We are interested in whether endpoints differ from weights published by Meta on Hugging Face inferenced commonly accepted precisions. Specifically, we consider two possible null distributions: the full-precision weights (Pi) and the fp16-precision weights (P2). The null and alternative hypotheses are
Ho P1) x) = (v) x) OR T()) x) = x(r](V x) (v))(v
(10)
H1: P1y z) x)
AND P2 (o)yy11))>>)))) + x(x)((y
To test this composite hypothesis, we collect three samples: Dy, and Dr, from the two null distributions, and Do from the API. We then conduct 2 two-sample tests, one for (Dr, DQ) and another for (Dp,, Dq), and obtain p-values p1 and P2. We set the overall rejection rule to
((P,, Dr., DQ) 1 < <aAp <a).
(11)
This rule continues to control the FPR at a under the composite null hypothesis: without loss of generality, suppose Q = P1. Since Pa=ri (p1 < a) a, have Po=r: (P1 < P2 a) Po=ni (p1 PQ-A (p2 < a p1 <a) S a. Note that this rule may be pessimistic, reducing power.
Experiment details. We consider testing with three prompt distributions π. For all models, we test with one set of the Wikipedia complction task from $4, where π is uniform over m = 25 prompts, and L = 50 tokens or around 1000 characters. For the smaller Llama-3 8B and Llama-3.1 8B models, we also test with the coding task HumanEval (Chen et al., 2021b) and instruction task UltraChat (Ding et al., 2023). Both л are uniform over m = 20 prompts, and L = 250 tokens or 3000 characters. Because APIs often return decoded completions, rather than individual tokens, we conduct all tests in character space, in $4.3. We explicitly requested all samples at temperature 1. Tests are conducted at level a = 0.01 using N = 10m samples. To reduce variance, repeat tests over ten samples and fail endpoints if the average rejection rate is 2 0.5. For the most expensive endpoint (Azure's s Llama-3 70B), a Wikipedia audit costs $0.14 14, HumanFval $0.83, and UltraChat $0.93. For the cheapest endpoint (Fireworks' Llama-3 8B), all three audits cost less than $0.02. For additional details, including the dates we collect API samples, see Appendix B.
Results. Despite power being generally reduced due to the composite decision rule, the test flags several endpoints (Table 1).8 Notably, Amazon Bedrock and Perplexity have the most endpoints flagged, with the latter failing all tests. In Box 2, we include an example comparing samples from the fp32 null and Perplexity: these samples suggest that Perplexity serves a lower entropy distribution than the full-precision model. Additional qualitative samples can be found in Appendix D.3. The HumanEval and UltraChat prompt distributions elicit more failures than the Wikipedia distribution; this may be because these knowledge- intensive distributions are more sensitive to changes such as quantization.
To estimate the effect size of deviations, we estimate the MMD between providers and the nulls using ten bootstraps of N = 100m samples each. We find that some deviations are quite large: some APIs'
We collected samples from Anyscale's serverless endpoints from before they were deprecated in August 2024.
"At the time writing, only two providers disclosed iustribution-alterin optimizations: Fireworks Al noted seman- tic caching, and Together.ai noted quantization.
*In Figure 1, combine the results of the tests the prompt distributions via Bonferroni correction, setting the level of each test 0.01/3 /3 and rejecting if the endpoint fails any of the three prompt distributions.
8

---

Published as conference paper ICLR 2025
Wikipedia
HumanEval
UltraChat
8B
3.1 8B
70B
3.1 70B
3 8B
3.1 8B
8B
3.1 8B
Amazon
x
X
x
Anyscale
/
Azure
/
/
/
/
/
V
/
V
Deepinfra
/
V
/
J
Fireworks
/
X
/
X
Groq
V
X
X
J
X
Perplexity
X
X
X
X
Replicate
Together
V
Table 1: Audit results for 31 API endpoints across nine companies and four language models. x denotes an endpoint failure, i.c., the average rejection rate over samples is 50%.
Average distances between providers for each model endpoint
String kemel based MMD vs. task accuracy on Humaneval
WHD (Hamming))
0.15
Accurscy dift:
0.6
0.10
0.05
0.2
0.00
0.0
4maccon decpiitra
ertaztnn togeheer
arraccn deepiitrs
despinkfe
despinfra together
0.00
0.05
0.30
0.15
0.20
0.25
0.30
MND (Harmiing!
Ulema-1
Usmo 3.1 88
Libma 3.1
Lisma-1 700
Liwma-1.1 4058
1.826x 0.000 oR 0.394)
Figure 4: (Left) Average MMD (Hamming) between providers for each model. Amazon Bedrock's Llama- 3 and -3.1 70B models are the most different from the other providers. (Right) Absolute difference in HumanEyal average accuracy
the MMD) (Hamming). There is moderate positive correlation between MMD and task accuracy. Gray points indicate pairs where both distributions have accuracy < 10%. There are multiple ways to be wrong for task, and the MMD captures these differences.
implementations further from the reference weights than if the provider had substituted in an entirely different language model. For example, the deviation between Perplexity's Llama-3 8B and the fp32 null on the Wikipedia testing task is 0.03. This comparable to the deviation between Llama-3 8B and GPT-3.5- Turbo (0.03; Figure 3 right), Phi-3 mini (0.04), or OLMo 7B (0.04).
Correlating MMD with task accuracy. We now ask how well the Hamming MMD correlates with task accuracy when available. Automated verifiers exist for of our prompt distributions, HumanEval. We find a moderate positive correlation between the absolute average accuracy difference and the Hamming MMD (Figure 4 right, R 0.392). In several cases, the MMD is high but the accuracy difference low. These are often when both task accuracies are low: the gray points in the figure highlight pairs where both distributions have accuracy < 10%. In these cases, the MMD captures that there are multiple ways be wrong for a task. For example, the bottom- rii---rggtttttte most point in the figure contrasts Llama-3. 8B from Perplexity vs. the nf4 version: Perplexity answers with incorrect code snippets, while nf4 outputs nonsense Samples from this comparison can be found in Appendix D.3.
completions (e.g., Siimulatio!!!!!!!!![[]...
Which models do providers differ on most? Finally, we ask whether providers differ on some more models more than others. Figure 4 (left) estimates the MMD between providers for each model, and the large Llama-3.1 I 405B model. We find that deviations are larger on the earlier Llama models than the recent Llama-3.1 405B model.
9

---

Published as a conference paper at ICLR 2025
Box 2: Samples from fp32 vs. Perplexity for Llama-3 8B (Instruct)
Prompt: Continue the paragraph. Do not output anything except the continuation to the paragraph. Start the continuation immediately. "Weaver, Tom. Talked with a Zombie: Interviews with 23 Veterans of Horror and Sci-Fi Films and Tele..."
Jp.2
Perplexity
Visiin, Some of Whom Are Still Alive. New York: Pocket Books, 1981. According Tom Weaver, Vincent Price was known for being a bit of practical joker, and he would often play harmless pranks on the crew
"... Visions. New York: St. Martin's Press, 1988, This collection of interviews horror science liction professionals fascinating look at the creative process and the people hehind some the most iconic films and shows of
"...vnsion, voodoo, and the Apocalypse. New York: St. Martin's s Press, 1990. The book features interviews with notable horror and science fiction persomalities, including Greg Cannom, makeup artist for The Lost Boys and RoboCop
"... visions. New York: St. Martin's Press, 1988. In this collection of interviews, Weuver delves into the experiences some of the
most iconic figures in the horror and science fiction genres,
including George Romero, John Carpenter,
"...vision. Written by Tom Wenver, renowned authority classical horror cinema, this book brings together intimate and legendary figures in
". vision. New York: Martin's Press, 1988. 224 pp. This collection of interviews with horror and science fiction
revealing conversations the genre, including Vincent Price, Boris Karloff, and Bela Lagosi. Interviews
professionals fascinating look the people hehind genre's most iconic films. Weaver's conversational style
6 RELATED WORK
Auditing ML APIs. Prior work either only applies to the classifier setting (Chen et al., 2021a: 2022) or audit by monitoring performance on low-temperature multiple-choice or short-answer benchmarks (Artifi- cialAnalysis, 2024; Chen et al., 2023; Eyuboglu et al., 2024). Concurrent work studies a general language model setting, but does not provide guarantees of audit correctness (Sam et al., 2025). In contrast, we formalize auditing the general setting of sampling completions from language models, including for tasks without automated verifiers. In cryptography, body of work has aimed verify ML API predictions through proof protocols (Ghodsi et al., 2017; Feng et al., 2021; Liu et al., 2021; Kang et al., 2022; Weng et al., 2023; Lee et al., 2024). These methods require APIs cooperate and opt-in to providing proofs of valid inference alongside each prediction; public verifiers then check these proofs for correctness with perfect accuracy. Unfortunately. these methods scale too poorly to apply large language models: in Kang et al. (2022), generating a proof takes 41 minutes per prediction for a 68M parameter MobileNet (Sandler et al., 2018).
hypothesis testing problem, allowing us to provide FPR guarantees, and we study
Two-sample testing. Testing whether two samples come from the same distribution is an established prob- lem in statistics. A line of work focuses on testing multinomial distributions (Batu et al., 2013; Chan et al., 2014; Canonne, 2020), including when samples have unequal sizes (Bhattacharya & Valiant, 2015; Di- akonikolas & Kane, 2016; Balakrishnan & Wasserman, 2018). MMD-based tests are general approach that do not assume a specific distributional form (Gretton et al., 2012). These tests can be applied to struc- tured data when paired with appropriate kernels (Lodhi et al., 2002; Borgwardt et al., 2006).
7 CONCLUSION
As the public grows more dependent on black- box APIs to interact with language models, tools for audit- ing these APIs are increasingly important. In this work, we unified several API auditing tasks under the formalization of Model Equality Testing, a two-sample distribution testing problem, and we extensively validated candidate tests for this problem. Future work could explore stronger tests than those have presented, or explore how to adapt these tests to other modalities, such as image generation models. To help facilitate this research, we open-source the dataset of 1 million LLM completions used for this work at https: / //ggttttbb// com/i i models across quantized, watermarked, and API alternatives; also see Appendix B.1.
ty- syy-tssting... This dataset contains completions from five
10

---

Published as a conference paper ICLR 2025
ACKNOWLEDGEMENTS
The authors would like to thank Mert Yuksekgonul, Steven Cao, Chenchen Gu, Chenglei Si, Nicole Meister, Yifan Mai, Simon Guo, Teddi Worledge, Yuhui Zhang, and other members the Guestrin and P-Lambda labs for feedback on this paper.
CONFLICTS OF INTEREST
PL is a ro-founder of Together AI; this work was done in his Stanford capacity. The topic, research, and results of this work were not shared with Together, or any other API provider evaluated, until the public release of the paper.
REFERENCES
Marah Abdin, Sam Ade Jacobs, Ammar Ahmad Awan, Jyoti Aneja, Ahmed Awadallah, Hany Awadalla, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Harkirat Behl, al. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint 24X4::2404..121111 2024.
Amazon. Amazon 2024 ql earnings. 2024/q1/AMZN Q1 10-0001-2000 2024-Earnings-Rellee
financials/
pdf, 2024.
ArtificialAnallsis. Artificial analysis, 2024. URL http:://arrtiiiciaaaalllsss
Sivaraman Balakrishnan and Larry Wasserman. Hypothesis testing for high-dimensional multinomials: A selective review. 2018.
Gagan Bansal, Besmira Nushi, Ece Kamar, Daniel S Weld, Walter Lasecki, and Eric Horvitz. Updates in human-ai teams: Understanding and addressing the performaanc/coomaubbiyy tradeoff. In Proceedings the AAAI Conference on Artificial Intelligence, volume 33, pp. 2429-2437, 2019.
Tugkan Batu, Lance Fortnow, Ronitt Rubinfeld, Warren D Smith, and Patrick White. Testing closeness of discrete distributions. Journal of the ACM (JACM), 60(1):1-25, 2013.
Bhaswar Bhattacharya and Gregory Valiant. Testing closeness with unequal sized samples. Advances in Neural Information Processing Systems, 28, 2015.
Karsten M Borgwardt, Arthur Gretton, Malte J Rasch, Hans-Peter Kriegel, Berharrd Schölkopf, and Alex J Smola. Integrating structured biological data by kernel maximum mean discrepancy. Bioinformatics, 22 (14)xe49-557, 2006.
Clément L Canonne. A survey on distribution testing: Your data is big. but is it blue? Theory of Computing, pp. 1-100, 2020.
Siu-On Chan, Ilias Diakonikolas, Paul Valiant, and Gregory Valiant. Optimal algorithms for testing closeness of discrete distributions. In Proceedings of the twenty-fifth annual ACM-SIAM symposium on Discrete algorithms, pp. 1193-1203. SIAM, 2014.
Sahil Chaudhary. Code alpaca: An instruction-folloiing Ilama model for code generation. https:// wwthub.com/sahiill wwt.sahil220111111 Bachhi288014/ooeaappppp 4/codealpaca, 2023.
github.
Lingjiao Chen, Tracy Cai, Matei Zaharia, and James Zou. Did the model change? efficiently assessing machine learning api shifts. arXiv preprint 1rXiv:2107.14203 202
Lingjiao Chen, Zhihua Jin, Evan Sabri Eyuboglu, Christopher Ré, Matei Zaharia, and James Y Zou. Hapi: large-scale longitudinal dataset of commercial ml api predictions. Advances in Newral Information Processing Systems, 35:24571-2455 2022.

---

Published as a conference paper ICLR 2025
Lingjiao Chen, Matei Zaharia, and James Zou. How is chatgpt's behavior changing over time? arXiv
preprint arXiv:2307.09009 2023.
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ry- der, Mikhail Pavlov, Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Clemens Winter, Philippe Tillet, Felipe Petroski Such, Dave Cummings, Matthias Plappert. Fotios Chantzis, Elizabeth Barnes, Ariel Herbert-Voss, William Hebgen Guss, Alex Nichol, Alex Paino, Nikolas Tezak, Jie Tang, Igor Babuschkin, Suchir Balaji, Shantanu Jain, William Saunders, Christopher Hesse, Andrew N. Carr, Jan Leike, Josh Achiam, Vedant Misra, Evan Morikawa, Alec Radford, Matthew Knight, Miles Brundage, Mira Murati, Katie Mayer, Peter Welinder, Bob McGrew, Dario Amodei, Sam McCandlish, Ilya Sutskever, and Woj- ciech Zaremba. Evaluating large language models trained on code, 2021b.
Cohere. Multilingual wikipedia (1 (11-2023), 2023. URL https://huggingfatt http:///gggggggeer.oooo/ctst///a co/caatatttttt/hheeeee wikipedia- Sitipeedia-223-1111 2023- wultilinguall-----eeee Huggingface dataset.
Tim Dettmers, Mike Lewis, Younes Belkada, and Luke Zettlemoyer. Gpt3. int8 (): 8-bit matrix multipli-
cation for transformers at scale. Advances in Neural Information Processing Systems, 15:30318-30332
2022.
Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. Qlora: Efficient finetuning of quantized lims. Advances in Neural Information Processing Systems, 36, 2024.
Ilias Diakonikolas and Daniel M Kane. A new approach for testing properties of discrete distributions. In 2016 IEEE 57th Annual Symposium on Foundations of Computer Science (FOCS), pp. 685-694. IEEE, 2016.
Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. Enhancing chat language models by scaling high-quality instructional conversations. arXiv preprint arXiv:2305. 14233, 2023.
Sabri Eyuboglu, Karan Goel, Arjun Desai, Lingjiao Chen, Mathew Monfort, Chris Ré, and James Zou. Model changelists: Characterizing updates to ml models. In The 2024 ACM Conference on Fairness, Accountability, and Trunsparency, pp. 2432-2453, 2024.
Boyuan Feng, Lianke Qin, Zhenfei Zhang, Yufei Ding, and Shumo Chu. Zen: An optimizing compiler for verifiable, zero-knowledge neural network inferences. Cryplology ePrint Archive, 2021.
Zahra Ghodsi, Tianyu Gu, and Siddharth Garg. Safetynets: Verifiable execution of deep neural networks on an untrusted cloud. Advances Neural Information Processing Systems, 30, 2017.
Arthur Gretton, Karsten M Borgwardt, Malte Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. The Journal of Machine Learning Research, 13(1):723-773, 2012.
Dirk Groeneveld, Iz Beltagy, Pete Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Harsh Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang, et al. Olmo: Accelerating the science of language models. arXiv preprint 00X08:2402.008888 2024.
Peter Hase, Thomas Hofweber, Xiang Zhou, Elias Stengel-Eskin, and Mohit Bansal. Fundamental problems with model editing: How should rational belief revision work in llms? arXiv preprint arXiv:2406. 19354, 2024.
12

---

Published as a conference paper ICLR 2025
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:2310.06825, 2023.
Daniel Kang, Tatsunori Hashimoto, Ion Stoica, and Yi Sun. Scaling up trustless dnn inference with zero- knowledge proofs. arXiv preprint arXiv:2210.08677 2022.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pp. 17061-17084. PMLR, 2023.
Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph Gonza- lez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. In Proceedings of the 29th Symposium on Operating Systems Principles, pp. 611-626, 2023.
Seunghwa Lee, Hankyung Ko, Jihye Kim, and Hyunok Oh. venn: Verifiable convolutional neural network based on zk-snarks. IEEE Transactions on Dependable and Secure Computing, 2024.
Erich Leo Lehmann, Joseph P Romano, and George Casella. Testing statistical hypotheses, volume 3. Springer, 1986.
Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu, Michihiro Yasunaga, Yian Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar, et al. Holistic evaluation of language models. arXiv preprint arXiv:2211.091 10, 2022.
Tianyi Liu, Xiang Xie, and Yupeng Zhang. Zkenn: Zero knowledge proofs for convolutional neural net- work predictions and accuracy. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 2968-2985, 2021.
Huma Lodhi, Craig Saunders, John Shawe-Taylog Nello Cristianini, and Chris Watkins. Text classification using string kernels. Journal of machine learning research, 2(Feb):419 2002.
Loshchilov. Decoupled weight decay regularization, arXiv preprint arXiv: 2017.
Al Meta. Introducing meta llama 3: The most capable openly available I1m to date. Meta AI, 2024.
Ashwinee Panda. Post by @pandaashwinee. discussion of quantization for Ilama 3.1. https: httpaa/wwinneessssttt///////////
2024.
Luiza Pozzobon, Beyza Ermis, Patrick Lewis, and Sara Hooker. On the challenges of using black-box apis for toxicity evaluation in research. arXiv preprint 3rXiv:2304.12339 2023.
Reddit. Post by user: mo4g/9eywmpmm'xxx result: Llama 3 ex12 quant quality compared to gguf and Ilama 2. https://wwet reddit. quant.qualit wuant.quality.compas.. wtt.ttccoc.eee...ooo to/, 2024.
1.x12m...exx22.
Dylan Sam, Marc Finzi, and J Zico Kolter. Predicting the performance of black-box Ilms through self- queries. arXiv preprint arXiv:2501.012: 2025.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang- Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pultern recognition, pp. 4510-4520, 2018
Ingo Steinwart. On the influence of the kernel on the consistency of support vector machines. Journal of machine learning research, 27Nov):67 2001.
13

---

Published as a conference paper ICLR 2025
Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Lau- rent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, et al. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403. 0.299, 2024.
Jiasi Weng, Jian Weng, Gui Tang, Anjia Yang, Ming Li, and Jia-Nan Liu. pvenn: verifiable convolutional neural network testing. IEEE Transactions on Information Forensics and Security, 18:2218-2233, 2023.
and
Thomas Wolf, Lysandre Dehut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf. Morgan Funtowicz, et Transformers: State-of-the-an natural language processing, In Proceedings of the 2020 conference on empirical methods in natural language processing: system demonstrations, pp. 38-45, 2020.
14


Reviews:
[{"review_id": "d0uuPPxHuK", "reviewer": "Reviewer_qBpo", "summary": "The paper proposes Model Equality Testing to understand the differences between models served by APIs. The proposed method is a two-sample test that uses various prompts along with multiple generations of a given prompt and tries to infer if two instances of generations come from the same distributions using the Maximum Mean Discrepancy kernel. The proposed method is studied empirically to understand its power in identifying the differences for models served by many APIs.", "questions": "- Regarding the kernel:\n    - For the choice of the kernel, you are basically trading off bias and variance. I think this might be good to call out in the manuscript. My understanding is that as L goes to infinity, the hamming kernel approaches the universal one-hot kernel. Similarly as L goes to 0, one biases towards the first tokens. I’d love to understand the implications of this bias-variance tradeoff on tasks that require more creativity like writing.\n    - Also L is set to 50 and the sensitivity to L is studied until L=50. I think 50 tokens for generations is typically on the lower end when it comes to LLM-based applications. I’d recommend studying it at least until 10 folds.\n    - I’d think L is affected by the vocabulary size of the tokenizer. Did the authors study the effect of L under different tokenizers? \n    - The kernel checks for token equivalence but an important piece to capture might be around semantic equivalence. Have the authors considered other kernels that can capture semantic equivalence?\n- Evaluations:\n    - Figure 3 lower left. The power of detecting Llama3.1 8B from Llama3.1 8B (int8) and (watermark) are 0.07 and 0.32, respectively, which are very low. I’d love to hear the author's thoughts on this as one of the premises of the method is to be able to detect such changes in the model. \n    - Consider adding an analysis that shows that the method does not detect any changes if the two samples come from the same model. It would be great to show the detection power using samples obtained at different temperatures.\n    - Can you extend the analysis in Figure 3 lower left to other models? One thing I’m interested to understand is that the method is able to detect different model sizes and looking at Figure 3 on the right hand side, the models from the same family look very close in terms of distance.\n- Nit: Mention that L is the number of tokens in the manuscript.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The paper is overall well written, organized and easy to follow. The application of two sample testing using the Maximum Mean Discrepancy kernel is novel for studying distributions coming from different models.", "weaknesses": "- I’m not convinced of the significance of this problem. Can this problem be solved through policy if the users ask from providers to disclose such changes? The API provides can be even motivated to charge users differently based on the optimizations done to models. \n- Evaluations can be stronger:\n    - The authors claim that the proposed method works using an average of 10 samples per prompt across 20-25 prompts. Since the paper relies on empirical analysis, I would love to see more analysis backing this claim/more guidelines around these requirements. For instance, do I still need to provide 10 samples per prompt if I generate the samples using 0 temperature? What about if my prompts are all from a niche topic versus if I’m testing across various different unrelated topics? Does one still obtain high power using 20-25 prompts?\n    - The evaluations are done using samples from English, German, Spanish, French, and Russian Wikipedia. I’d love to see more diversity in the evaluation tasks. For instance, consider showing the results for coding tasks, which can help with the broader applicability of the proposed method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9jL8Axq3GQ", "reviewer": "Reviewer_vPAW", "summary": "In this paper, the authors study the equivalence problem of LLMs in an API service environment. They formulate it as a two-sample test to assess the consistency of output distributions from different APIs. Ultimately, they use Maximum Mean Discrepancy (MMD) and achieve effective differentiation.", "questions": "1. MMD performance declines with small sample sizes, which is likely the case in real-world scenarios. Although the paper discusses sample efficiency, additional experiments with smaller sample sizes could provide further insights into this limitation.\n\n2. In practice, API services may not use the same model but rather similar models(like MOE). I suggest the authors provide some discussion on this point.\n\n3. How does MMD perform in terms of efficiency in large-scale testing scenarios?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well-organized and written, making it easy to understand.\n  \n2. The problem addressed is valuable, as APIs have indeed become one of the mainstream forms of LLM applications.\n\n3. The method design is reasonable and concise, and the experiments appear to be effective.", "weaknesses": "1. The study primarily focuses on the LLaMA series models. Although this aligns with the paper’s emphasis, I recommend that the authors verify the generalizability of MMD across more models.\n\n2. The computation cost of MMD appears to be somewhat high.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hnGFH76AEA", "reviewer": "Reviewer_jNji", "summary": "The authors propose a method for determining whether a model black-box (i.e. an LM served through an API) differs from a reference model; usually a canonical model version or simply an earlier version of the API.\nThe proposed method relies on sampling texts from different models / APIs or the same one at different times and estimating their relation against a distance metric under some kernel. The authors propose a Hamming distance kernel as an empirically reliable approach for this estimation. They provide analysis of different foundation models and APIs over time gleaning insight into how inference service providers may affect inference reliability.\n\n### Typos\n- Line 081: extra article 'a' inserted before 'an API'", "questions": "- In Figure 4, you compare absolute task accuracy difference with MMD, but this is slightly less informative than showing non-absolute task difference. You imply on lines 415-418 that task accuracy difference are usually lower for the non-reference models, but this isn't necessarily obvious that a provider's interventions are always harmful to accuracy / quality. Could you provide some information about MMD and absolute accuracy?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The overall idea of providing more analytic tools for black-box models / APIs seems important and interesting. I think many people reliant on these black-box APIs are left at their mercy and have little means of understanding how different service providers could affect their system performance.\n- The public release of generated samples offers valuable data for community use and future API change tracking.\n- Providing a framework for analyzing APIs on non-classification based (i.e. difficult to evaluate) tasks seems fairly novel and is a good contribution.", "weaknesses": "- One immediate problem I see is that acquiring the reference distribution on a user-defined task requires setting up the reference LM anyways, which was something that is acknowledged to be inconvenient or infeasible in many cases. That would make this method impossible in certain scenarios.\n- The hamming kernel's effectiveness across different tasks raises concerns, particularly for open-ended tasks like creative generation where diverse outputs may be desirable. The significance tests may struggle with high-variance outputs, potentially missing quality differences. Further analysis is needed on how task semantics and natural distribution affect the method's applicability. Additionally, using Wikipedia-based language modeling as the primary test task may underestimate output diversity due to the highly factual nature of the content and potential data contamination. This is partially addressed by the inclusion of HumanEval, but additional comparisons and/or analysis could strengthen the results.\n- I didn't see any mention of two model customizations that I suspect may be popular: system prompt customization and generation-time safety interventions. It's not clear to me how the proposed method would behave under these customizations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "g0cKqIm4kk", "reviewer": "Reviewer_Sprd", "summary": "The authors formulate the problem of testing whether two versions of a language models (either fully accessible, or accessible via API) are the same given two sets of samples from one model and another. They propose a simple but effective statistical test to distinguish between two sets of samples based on the Maximum Mean Discrepancy (MMD) string kernel method with the Hamming distance. They compare the chosen Hamming distance to other simple string distances and find that Hamming distance is well-suitable kernel to compare the samples from prompted language models. To evaluate the proposed MMD test, they verify that it shows high power for distinguishing different version of the same model or different models with a reasonably small number of samples, and degrades less w.r.t. the sequence length. Finally, they use the test to audit the API endpoints and find that a large portion of LLaMa 3 API providers give access to a different version of the model.", "questions": "Q1. My intuition is that Hamming distance would be too sensitive to positions of tokens in the sentence by its construction, e.g. they don't capture the similarity between two shifted chunks of text. I would have started with Levenshtein distance, have you maybe tried it in your experiments?\n\nQ2. How do you compute the kernels if a language model generates a shorter sentence compared to the maximal length?\n\nOther questions:\n- eq.4, should there z and z' be different?\n- 162: what does accurate completion means?\n- 210: is the only difference in the weights of the models, can generation algorithms also be different?\n- Figure 2: a not well-readable sentence: \"Curves first median power ...\"\n- 312: you write 1.1M unicode characters, but as far as I can check in Unicode 16.0 there are 155,063 unique characters, how it was computed?\n- 326: \"significantly different training data\": do you use word significantly in statistical meaning here?\n- 337: semantic caching, quantization: is it possible to put citations here?\n- Figure 4 (right): what are the colours here?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "This paper touches upon a very timely problem of verifying the integrity of the black-box APIs and model versioning in the cases when full detailed for a particular API are not open. Namely, the important question this paper formulates and proposes a test for is whether two different versions of the same model are the same. This is an important test given that sometimes models are changed, compressed for efficiency or safety reasons, and it is important for practitioners to understand what to expect from a given API.\n\nOverall, the paper is easy to follow, and methodology is sound. Experimental setup is sound enough to support the claims. Proposed method is simple and intuitive and builds upon the older works on string kernel based tests. I expect this paper will have a high impact within the language modelling community.", "weaknesses": "There are no critical weaknesses, in my opinion, only minor ones.\n\nThe choice of baselines is limited to different choices of string kernels.\nI was a bit surprised to see Hamming distance to perform the best, and in general felt that discussion and intuition why it works well is not present.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)