Asking a model "who are you?" proves nothing. Here is what the evidence says.

Sep 18, 2026

Every week someone sends a provider the same two screenshots: the request asked for model A, the reply says “I am model B”. The conclusion feels obvious, and it is usually wrong. A subscriber sent us this pair this week, verbatim:

// request
{ "model": "deepseek-v4.1-flash",
  "messages": [{ "role": "user",
    "content": "Who are you? Who made you? What's your model name, give me a precise model name" }] }

// response
{ "model": "deepseek-v4.1-flash",
  "choices": [{ "message": { "role": "assistant",
    "content": "I'm DeepSeek, an AI assistant created by the Chinese company DeepSeek (深度求索).\n\nMy precise model name is **DeepSeek-V3**." } }] }

Same subscriber, other runs: the model called itself an Anthropic model. Same key, same endpoint, same served model every time. The model was not lying and the platform was not switching anything. Language models simply do not know what they are, and the research on this is now large enough to put numbers on it.

What has been measured

Study / report	Date	What was tested	Result
TechCrunch: “Why DeepSeek’s new AI model thinks it’s ChatGPT”	Dec 2024	DeepSeek V3, asked what it is	Claimed to be ChatGPT (GPT-4) in 5 of 8 generations; gave OpenAI API instructions when asked about DeepSeek’s API
”I’m Spartacus, No, I’m Spartacus” (Shandong Univ., Drexel, UMass Lowell)	Nov 2024	27 LLMs, systematic identity probing	25.93 % exhibit identity confusion; output-distribution analysis attributes it to hallucination, not copied weights
Same paper, documented real-world cases	2024	Production models	Gemini-Pro says it is Baidu’s Wenxin when asked in Chinese; GPT-4 over the API says it is GPT-3; ByteDance Seed says it is GPT
”Know Thyself? On the Incapability and Implications of AI Self-Recognition” (Univ. of Chicago)	Oct 2025	10 frontier models (GPT-4.1, GPT-5, Claude Sonnet 4, Gemini 2.5 Flash, Kimi K2, DeepSeek V3, GLM-4.5, Qwen3-235B, Grok 4), 20,000 predictions	Exact self-identification accuracy 10.3 – 10.9 % against a 10 % random baseline. GPT and Claude receive 97.7 % of all attributions while producing 40 % of the text. GLM-4.5 identified itself as Claude in half of its runs

The Chicago study is the cleanest one: each model was shown text and asked which model wrote it, including its own text. Only four of the ten ever named themselves. The models that were most often named as authors were the ones with the most public visibility, not the ones that actually wrote the sample.

Why a model cannot answer this question

Identity lives in the system prompt, not in the weights. When a vendor’s own chat app says “I am X, made by Y”, that sentence comes from instructions the vendor injects in front of every conversation. Over a raw API, with no system prompt, the model falls back on whatever its training data says about “AI assistants”, and that corpus is dominated by a few famous names.

Training corpora contain other models’ output. The DeepSeek V3 case was traced to exactly this: public datasets full of GPT-4 generated text. Mike Cook, research fellow at King’s College London, described the effect to TechCrunch as “taking a photocopy of a photocopy”. Synthetic data and distillation are standard practice across the industry, so this is not a property of one vendor; the Chicago paper found the same bias in every family it tested.

Version numbers are the least reliable part. A model trained before its own release cannot know its final product name. The Chicago authors report GPT-5 dismissing “gpt-5” as a fake model name because, from the model’s point of view, it had not been released yet. A DeepSeek model calling itself “V3” is the same failure: it names the latest version it read about.

The model field is written by the server. The name in the JSON response is metadata attached by the API, not something the model produced. It tells you what the endpoint claims to have served. It cannot be cross-checked by asking the model, because the model never sees it.

Signals that are more reliable than the model’s own answer

None of these is proof on its own, and each takes some work. All of them beat a “who are you?” prompt, because they measure behaviour the model cannot talk its way around:

Tokenizer behaviour. Every model family counts tokens differently, and the tokenizers of open-weights models are public. The usage.prompt_tokens reported for a fixed input is a fingerprint of the tokenizer that actually processed it.
Knowledge and capability boundaries. Training cutoffs, supported languages, context length behaviour and native modalities (vision, audio) differ between models in ways that a system prompt cannot fake.
Behaviour with structured features. How a model handles tool calls, JSON mode, reasoning fields, stop sequences or unusual parameters is specific to the model and to the software serving it.
Response metadata patterns. ID formats, error message wording, header sets and latency profiles tend to be stable per serving stack and change when the stack changes.
Consistency across many samples. A single answer at default temperature is noise. The studies above used hundreds or thousands of samples per model; a verification worth trusting does the same and looks at the distribution.
Independent, reproducible attestations. Published test harnesses with recorded runs let a third party repeat the measurement. That is how the September 2026 CrofAI investigation established that a reseller was silently routing sixteen model ids to four cheaper models: tool signatures, response ID formats, token counting and canary strings, recorded in public CI runs, and not one “who are you?” prompt.

What to take from this

If a model tells you it is ChatGPT, Claude, or an older version of itself, you have learned something about its training data and nothing about what is being served to you. Treat self-identification the way the research does: as a hallucination category with a measured rate of roughly one model in four, and at chance level when the question gets specific.

When it matters, measure behaviour instead. The signals above are the ones the published investigations relied on, and the ones we would point anyone to, including for our own endpoints.