Between 2010 and 2012, an ocean conservation group called Oceana sent people into grocery stores, restaurants and sushi bars across 21 US states to buy fish. They collected 1,215 samples from 674 places and sent every one for DNA testing. A third came back as something other than what the label said.
Snapper was the worst. Of 120 samples sold as red snapper, only seven were red snapper, and some of the rest were cheaper farmed fish like tilapia. The “white tuna” was even stranger. 84% of it turned out to be escolar, a fish that can give some people serious stomach trouble if they eat more than a few ounces.
White fish on a plate looks like white fish on a plate. So people at the table couldn’t say.
Not so many can see it now, but AI has a blind spot. AI has a lot of them, but this one builds on something we already talked about earlier.
A few weeks ago I wrote about AntSeed, an open market where anyone can sell access to AI models. Also, I know we never had an Inference 1 article to begin with, but this is 2. So essentially, that one was 1.
Read: GPT 97% Off
In the antseed article, we saw two sellers offering OpenAI’s GPT-5.6 Sol at 7 cents per million input tokens, 97% below the price the market’s own dashboard compares against. A token is a chunk of a word, and a million of them is roughly 750,000 words. Only OpenAI and its cloud partners can run that model. So either the seller had found some cheap way to resell real access. Or it was serving a different model and calling it GPT or Opus.
Antseed isn’t the only one. Surplus Intelligence also buys and sells models. Orbio does something closer. OpenRouter is the famous one, but they review applications and test endpoints themselves.
Today we’re picking up where that piece left off, with the second possibility, and with the handful of companies trying to make it easy to check which model you got.
StablesReward: Your AI Agent Spends, You Earn
AI agents can surf the web, read reviews, and book hotels for you. All these tasks cost money. But what if these tasks could earn you back something?
StablesReward does just that. Once you connect your agent to an MCP endpoint, it gives your agent a menu of paid tools. Every call your agent pays for earns you miles or stocks. And this is in addition to the rewards you earn anyway on your own spending across 800+ merchants.
Every purchase pays you back. The best part is that you can choose how you’d like to be rewarded. Transfer miles to airlines and hotels, or let your stocks build a portfolio from the spend you were making anyway.
Launching soon. Free to join.
A quick map, since this is a series. Every time you type into ChatGPT, a computer somewhere runs the model on your words and sends back a reply. That’s called inference.
Around that activity, now there’s a business of hosting models and selling access, also called inference-as-a-service. Running the software that handles those requests is called model serving.
Our first piece covered the open markets. This part covers verification. Later parts look at the companies that run models for you, like Together AI and Groq, and then at the chips built just for this job.
From the buyer’s side, buying AI is very easy. The buyer here is usually a developer or a company building an AI product, rather than someone using a chatbot directly.
The buyer sends a message with a model name attached, say kimi-k3, a model from the Chinese lab Moonshot. An answer comes back, and Moonshot charges $3 per million input tokens for Kimi K3, according to the price comparison on Engy, which itself charges $1.95. Some AntSeed sellers go lower. All of them send back text that reads like Kimi. I picked Kimi for this over GPT or Claude for a reason.
Moonshot makes Kimi K3’s model files available to download, so providers can run it on their own hardware and compete to sell access. Some sellers may instead forward requests to another provider.
Proprietary GPT and Claude models are different. Their files are not publicly available, so genuine access ultimately comes through OpenAI, Anthropic or their supported cloud services. You can compare a seller’s answers with those from an official service, but you cannot download the model and independently rerun it to check.
On the seller’s side, they can cut costs in two ways. It can run a smaller model under the big model’s name. Or it can run the real model in a squeezed form. An AI model is a giant pile of numbers, billions of them. Normally, each one is stored with a lot of detail. A seller can store them with less detail, so each number gets rounded to the nearest value in a smaller set. The whole model then fits on fewer chips. That’s called quantisation, and it’s a bit like saving a photo at lower quality. Done well, you barely notice. Done badly, the model gets worse at long, careful reasoning, and on easy requests you’d never spot it.
Researchers have checked. In mid-2024, a Stanford team tested 31 services from nine companies selling Meta’s Llama models, and 11 of them were serving something that didn’t match what Meta released.
It was even worse for GPT and Gemini, models you can’t download. In March, researchers at CISPA, a German security research centre, studied what they call shadow APIs, the unofficial resellers selling cheap access to these models, often to people in countries where the official services are blocked. Some 187 academic papers used them. The researchers ran identity checks on 24 reseller connections, and 11 failed. Two services selling GPT-5 answered like much cheaper open models, GLM-4 and DeepSeek-V3.
Gemini 2.5 Flash scored about 84% on a US medical licensing exam through Google and about 37% through the resellers. One item asked which test confirms HIV in a mother during labour. The official service got it right, meanwhile three resellers got it wrong.
A bad answer doesn’t always mean cheating, though. When Moonshot saw other hosts of its Kimi models scoring below its own service, much of it came down to setup mistakes, like getting the temperature wrong, which is the dial that controls how random a model’s word choices are. In April it released a free test kit for checking hosts.
OpenRouter, which routes requests to model providers, analysed billions of requests. It found that when AI failed to use an app or carry out an action, the problem usually came from the software running the model.
Sending traffic only to hosts with good records lifted its test scores 10-20%. So you’re dealing with careless sellers and dishonest ones at the same time, and from where you stand they might seem identical.
You can test a little of this yourself. The Stanford method needs about ten answers per prompt, compared against a copy of the model you trust, and for GPT or Claude nobody outside the labs has that copy. A Berkeley team also found these checks easy to dodge. A seller can serve the real model some of the time and a cheap one the rest, or spot the test prompts and send only those to the real thing. Moonshot’s own full check took about 15 hours on two big servers.
AntSeed has started adding checks. Since June, sellers have digitally signed their answers, creating a record of who supplied each response. That does not establish which model produced it. AntSeed says it checks answers against patterns associated with each model. Basically, you know who sold it, but you don’t know what you bought.
Who’s trying to fix it?
The companies here fall into two camps. One camp is trying to prove which model ran. The other is making models cheaper to run.
Engy is the most direct fix for the AntSeed problem, at least for open models, the ones anyone can download, like Kimi, DeepSeek and Qwen. It sells them through independent GPU owners on the crypto network Bittensor, some of them running ordinary gaming cards.
For example, someone who owns a server with several NVIDIA graphics cards installs Engy’s software, loads a supported model and makes their server available to process requests. When Engy sends them your prompt, their GPUs run the model and return the answer with verification evidence.
As a model generates text, it produces internal numerical values called activations. Engy’s verification method, TOPLOC, records a compact fingerprint of selected values. This gives a checker something to examine.
A checker loads the same model version on its own hardware and recomputes the relevant calculations using your prompt and the returned text. It compares the resulting activations with the operator’s fingerprint. A significant mismatch can indicate that the operator used a different or modified model.
Engy’s network checks sampled requests. Customers can also request evidence and verify responses independently, but they need the model files and suitable hardware. With all of this, Engy is able to offer cheaper prices.
Attestable does this with heavier maths. It launched in August with $20 million led by Altimeter Capital and TLV Partners, and it makes zero-knowledge proofs.
ZK proves that the specified model produced the answer from the given input, without requiring the checker to see the model’s private weights or rerun it.
The proof ties those together, so the provider cannot substitute another model or alter the answer without invalidating it.
The buyer checks that proof using Attestable’s standalone verifier, which runs on a CPU. Unlike Engy’s approach, the checker does not need the model’s weights or hardware capable of running it. That also makes the approach potentially useful for proprietary models, provided their owners cooperate in generating the proofs.
So in theory OpenAI could prove GPT answered you without showing GPT to anyone. Attestable reports verification times below a second in its alpha benchmarks, but that excludes proof generation. Its current system also limits context length and changes the numerical precision of some calculations.
Inference Labs has been at this the longest, and its story took a turn this month. It uses ZK proofs to verify AI computations. From 2024 it ran a Bittensor network called DSperse, where computers competed to make these proofs fastest by chopping a model into slices and proving the slices side by side. ZK Proofs are expensive. One of its team members said on a podcast last year that proving even GPT-2, a small model from 2019, could cost $100 of computing on Amazon’s cloud. In October, the network was handed to DaniLabs, led by DSperse’s lead author Dan Ivanov, which plans to turn it into a cheap, private service that runs AI models rather than proving them. Inference Labs still sells verification for AI agents and robotics.
EigenLayer’s EigenAI makes AI answers repeatable. Normally, asking the same question twice can produce different answers, making comparisons unreliable. EigenLayer’s EigenAI fixes the chip type and software versions so the same prompt always returns the exact same answer. Anyone can rerun a request and compare, and operators caught cheating can lose staked ETH.
Some sellers lean on hardware instead, using chips with a sealed section, called a trusted execution environment, that can sign a note saying which program ran inside it. AntSeed, for example, lets buyers send requests only to sellers running these chips. Google’s Private AI Compute is built the same way. The Berkeley team called those chips the most practical fix today, though you end up trusting the chipmaker instead of the seller.
Now there’s another camp. Zro, from a team called MoonMath, writes its own low-level code for AI chips and says it gets 220 tokens a second out of a DeepSeek model.
Inferact, started by the people behind vLLM, free software many AI hosts use to run their models, raised $150 million in January at an $800 million valuation. Neither of these tries to prove which model you got. They matter here because a low price can also mean an honest seller found a smarter way to run things, and companies like these make that kind of cheap more common.
Moonshot said it now works with the teams behind vLLM and similar software to fix the setup errors it found, which tells you where a lot of the honest mistakes come from.
Most people will never touch any of this directly. But many of the apps they use run on these services, and some of those apps buy their AI from the cheapest reseller available. If a study app or a health chatbot runs on a shadow API, you could be getting the 37% Gemini instead of the 84% one, you wouldn’t know.
So the first thing verification could give you is the name of the model that answered. The second is privacy, and here the big labs are involved. In June 2025, Anthropic and a security firm called Pattern Labs described a setup where Claude requests stay encrypted except at the exact moment they’re processed. Then the keys go only to a machine whose chip proves it’s running approved code. Anthropic called it a sketch to start a conversation. The third is a record of what the model said, which starts to make sense once AI agents spend money for you and someone has to show what was asked and what came back.
My take is that if you use ChatGPT in OpenAI’s own app, none of this reaches you as of now. Because there the brand does the job a proof would do. It matters wherever there’s no brand, which is most of the cheap market.
“Cheap” always gets a bad name.
In 1970, an economist named George Akerlof wrote about used cars. The seller knows whether a car is good or a lemon, and the buyer doesn’t. As a result, buyers offer only what an average car is worth. Owners of good cars refuse to sell at that price, the average gets worse, buyers offer even less, and soon mostly lemons are left. He later won a Nobel prize for the idea.
If you can’t tell an honest cheap seller from a fake one, you treat every cheap listing as possibly fake. The good sellers get nothing for being good, and they’re the first to give up
Warranties and vehicle history reports partly rescued used cars by giving buyers what sellers used to keep to themselves. Proofs try to do that for AI, and for open models it’s closer than I expected. Once a model has a public seal, “kimi-k3” means one exact file, and OpenRouter already publishes each host’s speed and reliability. Choosing between two Kimi sellers feels like me picking mobile data plans, where the product is the same and you just compare price and reliability.
None of the checkers can verify GPT or Claude from the outside, which are the names on the flashiest discounts.
Big labs can ask you to trust them. Cheap sellers have to show their work, and that may be what gets cheap AI taken seriously.
Token Dispatch is a daily crypto newsletter handpicked and crafted with love by human bots. If you want to reach out to 165,000 subscriber community of the Token Dispatch, you can explore the partnership opportunities with us 🙌
📩 Fill out this form to submit your details and book a meeting with us directly.
Disclaimer: This newsletter contains analysis and opinions of the author. Content is for informational purposes only, not financial advice. Trading crypto involves substantial risk - your capital is at risk. Do your own research.