MIT研究团队推出AgentProv，通过工具调用分布检测API是否偷偷更换底层模型，准确率远超现有方法。
AgentProv是首个基于行动的身份审计方法，通过分类工具调用分布来识别部署模型。该方法在630个评估检查点对中实现了100%的替换模型检出率，且在系统提示注入下的误报率仅为7%。与MET和RUT相比，AgentProv在第三方API端点上的不一致性与独立令牌计数侧信道检测结果一致。
AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes
Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to save deployment costs. All existing audits decide backbone identity from the text-output channel, which is structurally fragile for agentic APIs because modern serving stacks (OpenAI, Anthropic, Gemini, Cloudflare Workers AI, LangGraph) discard text and expose only structured actions when the model calls a tool, and provider-injected system prompts can distort text distributions enough that text-channel tests falsely accuse honest providers of substituting the claimed model. We observe that recent agentic post-training internalizes tool-use directly into the weights, opening a new audit channel that the serving stack still exposes and that is largely invariant to deployment context. We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs: AgentProv fingerprints a deployed model through its categorical tool-call distribution and decides identity via an MMD permutation test. AgentProv catches every substituted model (100% on 630 evaluated checkpoint pairs), while holding the false-positive rate under system-prompt injection at 7% (vs. 67% for MET and 53% for RUT). On third-party API endpoints, AgentProv's disagreements with MET are consistent with an independent token-count side-channel that detects provider-injected system prompts.