Trust from afar: Evaluating remote model instances

Audits, model reporting, and safety evaluations of frontier models assume that the model a provider claims to serve is the model that answers user queries, but API access alone gives no way to verify this. We treat the challenge-response protocol as a practical hypothesis test for this problem and ask, on a GPT-2 benchmark, how many queries are needed to detect fine-tuned, compressed, adaptive, and backdoored variants of a trusted reference model. Detectability is governed primarily by the challenge distribution rather than by the modification: a switching responder that defeats repeated-token challenges is exposed in a single mixed challenge, and a backdoor that passes every ordinary distribution is exposed at a single query by trigger-aware probes. Because no statistical test can rule out audit-time model switching on its own, we further propose a zkML-assisted variant in which a zero-knowledge proof binds each response to a committed model.