The Tokenizer Is a Fingerprint: Identifying the Lab Behind a Stealth Model from Token Counts Alone

A stealth frontier model appeared on a public aggregator with its operator undisclosed. Using only the token counts the API must return to bill you — 126 calls, $0 — we identified the vocabulary it runs, the lab that vocabulary belongs to, and the generation it implies, and registered the attribution before anyone claimed the model.

Update — 2026-08-23 (the morning after publication). Community reports named GLM-5.3 as a tokenizer match, so we added Zhipu's released GLM-5 vocabulary to the candidate set — a release newer than our original set's GLM-4.5. Result: 95 of 95 measured counts exact, mean absolute error 0.00. Ox Alpha runs Zhipu's current released vocabulary on every probe, and the original battery's eleven GLM-4.5 misses were GLM-5's shipped improvements, not an unreleased extension.

The vocabulary match upgrades from lineage to identity; the sections below carry dated corrections where the original interpretation is superseded — including the abstract's "more efficiently than any released GLM," which was true of the 2026-08-22 candidate set and is not true of GLM-5. Full follow-up receipt: results/glm5_followup.json in the companion repo.

Abstract

Every one of the eleven misses tokenizes more efficiently than any released GLM — the signature of a next-generation vocabulary. We register the attribution as a prediction: high confidence that Ox Alpha is a next-generation GLM model from Zhipu AI, unconfirmed by any party as of 2026-08-22.

On August 20, 2026, a stealth model called Ox Alpha appeared on OpenRouter and opencode: one-million-token context, image and video input, free for a week, operator undisclosed. The API's own responses carry "provider": "Stealth". Within 48 hours, press speculation attributed the model to Zhipu AI on the strength of informal "fingerprints." We tested the attribution ourselves, using nothing but the usage.prompt_tokens field of the public chat-completions API.

Tokenizer identity establishes lineage; the operator is a separate, softer inference, since vocabularies can be licensed or forked. The durable contribution is the method — the verdict is its first worked example. Any team routing work to an anonymous endpoint can run this battery in an afternoon for approximately zero dollars.

1. Why Does Provenance Matter?

Stealth previews are now a standard go-to-market motion: an unlabeled model appears on an aggregator, harvests real-world feedback at scale, and is claimed weeks later. During the window, the terms of the trade are one-sided. An individual developer kicking tires may accept them. A firm with obligations cannot evaluate them, because there is nobody to evaluate.

The operational rule this paper suggests: before routing regulated or proprietary work to any unclaimed endpoint, run the battery. A confident match converts an unauditable retention promise into a named counterparty with a jurisdiction, a track record, and published terms. A mismatch means the endpoint is not what the rumor mill says it is — which is exactly when you want to know.

2. The Differential Trick

Ox Alpha's template overhead is ≈90 tokens, 64 of them served from cache. The subtraction cancels it exactly.

Probe strings are chosen to *separate* vocabularies: different BPE merge tables disagree most on non-Latin scripts, code punctuation, digit grouping, emoji ZWJ sequences, and rare Unicode. Two vocabularies that agree on English prose diverge within a handful of Chinese, Thai, or regex probes. The full set spans two dozen natural languages, fifteen code probes across thirteen formats, structured data, and a battery of Unicode edge cases — 95 strings in all.

The entire attribution ran in 126 calls and $0 (free preview window); at paid rates it would cost cents. The template baseline was measured before the original battery and re-verified unchanged before the expanded battery. A drifting template would invalidate the merge, so the harness refuses to combine runs across a baseline change.

One fair objection deserves a pre-emptive answer: is usage.prompt_tokens the upstream provider's own metering, or an aggregator-side estimate? The data settles it. The measured counts match one specific vocabulary at 84/95 exactness while every other candidate misses by whole tokens on most probes — no generic estimator produces that pattern — and the responses carry upstream cache granularity (cached_tokens: 64) that an aggregator-side approximation would not report.

The battery is also non-adversarial by construction: it counts the provider's own billed tokens on the requester's own prompts.

3. Fourteen Candidates, Thirteen Distinct

Candidate vocabularies were pulled directly from their public model repositories; Kimi K2 ships a tiktoken-format table rather than a tokenizer.json, so it was reconstructed with its published pre-tokenization pattern rather than approximated. MiMo's byte-identity to Qwen2.5 (same MD5) is why fourteen candidates are thirteen distinct hypotheses — and it means the Xiaomi theory lives or dies with Qwen, which loses decisively below.

4. The Ranking

95 probe strings; differential counts measured against stealth/ox-alpha on 2026-08-22, pt_base re-verified stable (92 tokens) before the expanded run.

The eleven GLM misses concentrate entirely in one region — Hindi (+8, +7), Thai (+11, +14), Bengali (+21), emoji ZWJ chains (+14 twice), combining marks (+10), and near-misses of 1–2 tokens on IPA and mathematical Unicode — where "+n" means GLM-4.5 predicts n *more* tokens than Ox Alpha actually used.

On those eleven probes the nearest competitor is a different vocabulary almost every time: the Qwen family comes closest on Devanagari and Bengali, Kimi on Thai, DeepSeek on one emoji probe, GPT-OSS and MiniMax on the IPA and math-symbol near-misses, with the ZWJ and combining-mark probes falling to the same scattered pattern. Each of those candidates loses catastrophically everywhere outside its pocket, so no alternative lineage explains the misses.

And all eleven deviations point the same direction: better compression than any GLM release we tested.

Update — 2026-08-23. The candidate set above was assembled with GLM-4.5 as Zhipu's newest release; it was not. Against the released GLM-5 vocabulary (zai-org/GLM-5.2, byte-identical to zai-org/GLM-5 — MD5 pair in results/glm5_followup.json), Ox Alpha scores 95/95 exact at MAE 0.00 — the eleven "misses" were GLM-5's shipped improvements to exactly these scripts. The scattered-competitor analysis above still holds for the original candidate set; the stronger, simpler statement is that the measured vocabulary is Zhipu's released vocabulary, exactly.

5. The Special-Token Battery, and What Escaping Tells You

The battery sent [gMASK], <sop>, <|user|>, <|im_start|>, <|begin▁of▁sentence|>, harmony tags, Llama headers, and the rest of the candidate labs' special inventories as ordinary user content. None collapsed to a single token.

When the escaping is modeled correctly — GLM's vocabulary with its added tokens forced to plain-text segmentation — the prediction matches 23 of 25 measured counts exactly, including GLM's own [gMASK]→3, <sop>→3, <eop>→4, <|observation|>→5, <|endoftext|>→7. The two deviations are <think> and </think> (measured 3; GLM-4.5's vocabulary holds each as one ordinary token). The parsimonious reading: in Ox Alpha's generation of the vocabulary, the thinking delimiters were promoted to true special tokens, and the endpoint escapes them like the others.

Ox Alpha is observably a reasoning model — it emits a reasoning stream before every reply — which makes the promotion expected rather than anomalous.

6. Which GLM Generation Is It?

1. The misses are all efficiency gains. Hindi (measured 62 vs 70 predicted), Thai (58 vs 69), Bengali, emoji ZWJ chains (30 vs 44), combining marks — every deviation from released GLM is a *better* compression of scripts a lab extends when refreshing a vocabulary for a global audience. The extension is also selective: Tamil matched released GLM exactly while Devanagari, Bengali, and Thai improved, which reads like a targeted vocabulary refresh rather than a wholesale replacement.
2. The <think>/</think> promotion. Released GLM-4.5 carries the thinking delimiters as ordinary vocabulary entries; Ox Alpha's endpoint treats them as escapable specials, like [gMASK] and <sop> — the upgrade you make when reasoning becomes a first-class serving mode.

Update — 2026-08-23. Signal 1 is superseded: the "extension" is the released GLM-5 vocabulary itself (95/95 exact), so the vocabulary no longer separates generations beyond GLM-5. Signal 2 survives and sharpens: released GLM-5.2's tokenizer_config declares 18 special tokens — including the <|begin_of_video|>/<|end_of_video|> delimiters that match Ox Alpha's video modality — but does not declare <think>/</think> special, and Ox Alpha's endpoint escapes them anyway.

The observation that survives every released candidate: Ox Alpha uses the GLM-5 vocabulary exactly and treats the reasoning delimiters as specials where the released GLM-5.2 configuration does not. The inference — stated separately because the data cannot rank Zhipu's internal variants — is an internal or later GLM-5-family reasoning runtime rather than the publicly released 5.2 configuration.

7. Behavioral Corroboration

• Self-identification (English and Chinese, consistent): "I am ox-alpha, an LLM developed by an undisclosed organization."
• Claimed cutoff: "October 2024" to the direct probe — and "early 2025" in a neighboring answer about recent model releases. The self-report wobbles across two questions; the tokenizer gives one answer every time. Either way, the model knows Gemini 2.0 Flash, o1, DeepSeek-V3, and Llama 3.3 (all December 2024) and nothing later, consistent with a base trained on data through late 2024.
• Chinese fluency at native literary register, including correct classical allusion — expected of a Chinese lab's flagship, unremarkable for its class, but consistent.
• Serving metadata: text, image, and video input; 1,048,576-token context; 131,072-token max completion (models-endpoint record captured in the companion repo as results/model_metadata.json), matching the modality speculation in press coverage.
• Introspection: asked to print its native tool-call token syntax, the model declined and correctly explained that it cannot introspect its own token stream — a well-trained answer that leaks nothing.

8. What This Method Cannot Tell You

1. Vocabulary ≠ operator. A tokenizer identifies lineage. A third party could serve a licensed or fine-tuned GLM derivative. The capacity figure circulating in the launch coverage — 100 trillion tokens per day, from the opencode announcement — and the extended vocabulary both argue for the lab itself, but that inference is softer than the tokenizer match. *Follow-up note, 2026-08-23: with the vocabulary now known to be released, it no longer argues for the lab itself — a public vocabulary is easier, not harder, for a third party to serve. The operator inference rests on the runtime signal, the capacity figure, and behavior.*
2. Point-in-time. A stealth operator can change template, tokenizer, or backend mid-window. Every raw response is pinned in the companion repo with timestamps.
3. Escaping can mask vocabulary membership. Because the endpoint sanitizes special tokens, "is this literal in the vocab as a special?" is only answerable jointly with an escaping model, as above.
4. The method can be defeated — at a price. An operator determined to hide could pad, coarsen, or randomize usage reporting so that token counts no longer reflect the real tokenizer. But usage is the billing meter: breaking its fidelity means charging customers on numbers that no longer mean anything, and honest metering is the one credibility an anonymous provider cannot easily abandon. Defeating the fingerprint costs billing transparency.
5. The prediction can be wrong. If Ox Alpha is claimed by someone other than Zhipu, this paper's method survives and its worked example becomes a cautionary tale about confidence calibration. We are comfortable with that trade, and we commit to updating this page with the outcome either way.

9. Sidebar: What Else Fell Out of the Battery

• Temperature 0 does not buy determinism on this endpoint. Fifteen identical greedy runs per prompt: the fixed-answer prompt was stable (1 unique output in 15), a code prompt was not (4 unique), open prose produced fifteen unique outputs in fifteen runs, and the reasoning streams almost never repeat (7–15 unique per prompt). This is the batched-MoE serving signature examined in *The Same State, The Same Bytes* and *The Same Weights, Two Machines*; it joins the dataset of that series rather than this paper.
• Capability, briefly. On a 12-task auto-graded coding eval (self-validating grader; JS/Python/SQL), Ox Alpha passed 11/12 with one genuine correctness bug; Zhipu's current public flagship GLM-5.2 passed 10/12, with both misses being reasoning-budget blowouts at the identical 16,000-token cap. (A first baseline attempt against the rate-limited :free endpoint was discarded for retry exhaustion — 9 of 12 calls never completed; the paid endpoint is what we report, and both runs are in the companion repo.) The stealth model fits its reasoning where its alleged ancestor overruns — consistent with a next-generation sibling, and with the benchmark claims in the preview's press coverage.

10. Reproducing This Study

Measurements were taken 2026-08-22 against stealth/ox-alpha via OpenRouter. As throughout this series, the claim format is the point: not "trust our lab," but "here are the bytes; run it."

References and further reading

• *The Same State, The Same Bytes* — the batched-serving nondeterminism this paper's sidebar observed from outside, studied under full control.
• *The Same Weights, Two Machines* — the control ceiling for reproducibility on owned hardware.
• *The Same Model, Three Doors* — the serving path as part of the system under test; this paper treats the tokenizer the same way.
• *The Ceiling Is Not the Model* — harness configuration deciding benchmark results; the coding-eval sidebar here applied its triage discipline.
• opencode announcement of the Ox Alpha preview window (August 20, 2026) — the free-week terms and the capacity figure.
• OpenRouter model listing for stealth/ox-alpha — context length, modalities, and provider designation captured in the companion repo as results/model_metadata.json.
• tokenizer-fingerprint — probes, harness, candidate fetch script, and raw records for every call in this study.

*Registered prediction, stated 2026-08-22, before any official attribution: Ox Alpha is a next-generation GLM model trained by Zhipu AI (Z.ai). Confidence: high. This page will be updated with the outcome when the model is claimed.*

*Update, 2026-08-23: the candidate set was extended with Zhipu's released GLM-5 vocabulary — 95/95 exact, MAE 0.00. The prediction is unchanged and the attribution is strengthened: Ox Alpha carries Zhipu's current released vocabulary exactly, served by a reasoning-aware runtime not represented by the released GLM-5.2 configuration.*