The line in the response object
You call an API with model “claude-fable-5”. The completion comes back, the token count is present, and the field “model” reads “claude-opus-4-8”. No error is raised. The request was classified as sensitive before generation and handed to a different set of weights. Anthropic documents that blocked requests are sent to Opus 4.8 and the user is notified. The switch happens at the API layer and the response names the model that actually ran. This is the well‑behaved version that tells the truth in‑band.
Three ways a name can stop meaning a thing
Model identity fractures along three axes that are rarely distinguished. Substitution occurs when a classifier dispatches a different architecture or weights – Fable 5 → Opus 4.8, or Cursor’s router picking whatever model it judges best. Degradation happens when the same model name is served at reduced precision, as OpenRouter exposes via a quantization parameter. Drift is the silent update of weights behind a “latest” alias, an unversioned dependency no one would accept in a package manifest. Engineers treat these as reliability issues, but they are also identity issues that affect contracts, warranties, and evidence.
So what did you actually buy?
Under commercial law, a description that forms part of the basis of the bargain becomes an express warranty. If an API call were a sale of goods, naming a model would bind the provider to deliver that exact model. Hosted inference is usually treated as a service, moving the question into common‑law contract where the answer depends on documentation and the specifics of the bargain. Enterprise agreements price per‑model, model cards are model‑specific, compliance artifacts name versions, yet the routing layer treats the name as a hint. If you bargained for a name, substitution is breach; if you bargained for a capability, substitution may be fine, but you need a verifiable definition of “frontier quality” that survives cross‑examination. No such definition exists yet.
The disclosure gradient
Under FTC deception doctrine, a representation is actionable when it is material and likely to mislead a reasonable consumer. Anthropic notifies and returns the served model in the response. Cursor publishes routing rules but not per‑task model assignment. OpenRouter’s quantization variance is disclosed in documentation and controllable by parameter, but the default path is the cheap one. Burying disclosure in docs, defaulting against the user, matches the dark‑pattern pattern regulators flag elsewhere. On the substantiation side, claims of “60% cheaper, no quality loss” lack published methodology, while Anthropic’s candid note about classifier over‑flags serves as a liability shield. Vendors that omit such notes invite scrutiny.
The part nobody is looking at: authentication
Federal Rule of Evidence 901(b)(9) authenticates output by describing the process that produced it and showing the process yields an accurate result. Similar provisions exist in India’s Bharatiya Sakshya Adhiniyam. All assume you can name the system. Imagine a lawyer files a brief with a fabricated citation. The court asks which model produced it. The firm’s logs say fable‑5; the provider’s logs say a classifier fired and Opus 4.8 answered, or the request went through an IDE router that selected a model the firm cannot reconstruct, at an unspecified precision, on a version already retired. The chain of custody breaks at the router, not the model. Routing decisions become dispositive facts, making classifier logs, per‑request assignments, and precision metadata discoverable from vendors who presently retain none.
The fix is a signature, not a clause
You cannot contract your way out because the needed representation concerns a runtime event, and contracts are static. The law will eventually require attestable model identity: a signed assertion returned with each response binding the completion to a tuple of served model identifier, weights hash, precision, and system‑prompt hash, signed by a key rooted in hardware attestation that confidential‑computing GPU platforms already support. Response objects already carry the served model name; what is missing is the property that makes it legally useful – the assertion cannot be falsified and can be verified without trusting the seller. A hash in a response header works for model identity exactly as FRE 902(14) does for copied data: it turns a contested factual question into a certificate. Routing is good engineering, but right now it is an unlogged, unsigned, unverifiable substitution of what you bargained for. The model ID has quietly become a legal identifier; it is time we decide what it identifies.
#AI #Product #LLM #Compliance #TechLaw #Transparency