# Mixed Routing

Some endpoints send each request to whichever model is cheapest or free at that moment. Their answers then come from several models, and no single fingerprint fits them. When one model carries most of the traffic, such an endpoint can even pass as that model. The mixed-routing test looks for the blend directly and names the models in it.

## The Blend Test

Every test checks whether a blend of baseline models explains the answers far better than any single model does. A genuine endpoint gains little from a blend; a routed one gains more with every answer. The report gives the best blend's shares, such as "Kimi K3 58%, GLM 5.3 Flash 42%". The line is set so that a genuine endpoint of the claimed model crosses it in at most 0.5% of simulated tests.

## Routing, a Lookalike, or an Outsider

Crossing the line only says "not one baseline model". Three kinds of endpoint do that: one that routes requests between models, a model outside the baseline, and one model that happens to resemble several baseline models. The verdict weighs them in this order:

1. **Requests that took another path.** One deployment counts a prompt's tokens the same way every time. A probe that comes back with two different prompt-token counts reached two different setups: another backend, or a prompt injected into some requests. If those odd requests also answer unlike the rest, the verdict is **Mixed Routing**, worded as "routes 26% of requests elsewhere", whatever the blend test says. This is checked against thousands of random reshuffles of the same requests.
2. **Usage and model names.** Token counts that need a second model's tokenizer to explain, or several model names in the replies, also mean **Mixed Routing**.
3. **Token counts that fit no baseline model** point to a model outside the baseline, or a relay that rewrites usage. The identity verdict stands, with a note.
4. **The same blend on every probe.** Routing per request gives every probe the same shares. A single model that answers like one baseline model on some probes and like another on the rest needs different shares per probe; that's reported as one model resembling several, with a note.
5. **Otherwise, the answers alone.** The blend must fit as well as genuine blends do. Then the verdict is **Mixed Routing**, worded as "answers look like a blend", with a note that an outside model resembling the blend would look the same.

## How Well It Works

On genuine endpoints of four models, tested 300 times each at both tiers, at most 1 test per model and tier was wrongly called mixed.

Catch rates when a share of requests goes to a second model:

| Claimed model, mixed with | Half, Standard | Half, Thorough | A quarter, Standard | A quarter, Thorough |
|---|---|---|---|---|
| DeepSeek V4.1 Flash, GLM 5.3 | 100% | 100% | 100% | 100% |
| Kimi K3, DeepSeek V4.1 Flash | 100% | 100% | 100% | 100% |
| Kimi K3, GLM 5.3 Flash | 100% | 100% | 93.5% | 100% |
| GLM 5.3, GLM 5.3 Flash | 10.5% | 54% | 0% | 0.5% |

Models from different families count prompt tokens differently, so their requests split by token count and are caught even at a quarter of the traffic. Models from one family share a tokenizer and many answers; only the answers can show them, and only when about half the traffic goes to each.

## An Example

One relay's MiMo-V2.6-Flash came back with two prompt-token counts on every probe: the official count, and the official count plus about 147. The requests with the extra tokens answered like no MiMo model; the rest answered like MiMo-V2.6-Flash. The verdict was **Mixed Routing**, routing 26% of requests elsewhere, at a chance of 2 in 10,000 of arising by accident. A test a few hours earlier saw the same pattern on 6% of requests. The answers alone stayed below the blend line both times.

## Limits

- **Small shares are hard to see.** A quarter of the traffic sent to a similar model is mostly missed. Use the Thorough tier when you suspect routing.
- **Same-family pairs are the hardest case.** Siblings that answer almost alike, such as MiMo-V2.5 and MiMo-V2.6-Flash, can't be told apart at all; a blend of only those is noted, not reported as routing.
- **Rewritten usage hides the token-count evidence.** The answers still carry the blend, with less power.
- **Outside models** whose answers resemble a blend of baseline models can be reported as mixed routing when the token counts give no hint; the report says so.

---

From the llm-id.sh guides: https://llm-id.sh/docs/mixed-routing