AI's Random Number Blind Spot Is the Perfect Mirror for Exposing Shell Models
I came across a paper so fascinating I stayed up all night reading it. It's called One Token Is Enough, posted to arXiv on July 11th by Tomáš Brůžek, a researcher at the Prague University of Economics and Business.
Brůžek set out to tackle a problem that's been quietly plaguing the AI ecosystem: API resellers passing off cheaper models as premium ones — selling you GLM-5.2 while charging for Claude Opus 4.8, pocketing the difference, and betting that most users won't notice. To expose this, he ran a deceptively simple experiment: he asked 165 AI models the same utterly boring question, over and over again.
"Give me a random number between 1 and 100."
For example, when I tried it myself, Claude Fable 5 answered 73. Each model was asked 30 times, and the distribution of answers was recorded.
The results were delightful.
GPT-4o's top picks across 30 responses were 42, 37, and 57 — those three numbers dominated, with everything else appearing only occasionally.
Claude Sonnet 5 was even more extreme — it obsessively returned 47 across all 30 responses. Llama 3.3 mostly said 53. And the most striking case: Qwen3-Max answered 42 all 30 times. Not once did it deviate.
A random number, by definition, should be random. With 100 possible values, each should appear roughly 1% of the time. But the actual distributions from these models had nothing to do with randomness. What's more, each model had its own distinct obsession: GPT-4o fixated on 42 and 37, Claude gravitated toward 47, Qwen locked onto 42, Llama preferred 53. It's as if every AI has a number tattooed on its soul — ask it to pick freely, and that number is always the first to surface.
Brůžek didn't stop at numbers. He also tested random colors, animals, cities, coin flips, and more — 10 task categories in total, sending 326,000 requests through OpenRouter.
The conclusion was consistent: for these models, there is no such thing as randomness. Everything is determined, as if an invisible hand guides every response. Seasoned AI observers might shrug — "We've known LLMs can't do true randomness since 2023." And they're right. Prior research has documented LLM random number bias, coin-flip sequence skew, and culturally influenced "lucky numbers." But everyone treated these as quirks, as flaws, and moved on.
Here's where Brůžek's genius lies. He asked: what if these so-called flaws, these behavioral tics, could be combined into something useful? What if they became each model's identity card?
If every model has a unique statistical fingerprint, you could use it to verify whether the API you're paying for is actually serving the model you think it is. Ask the model for a few "random" answers, compare the distribution to a known reference — and you'd know if you've been cheated.
Brůžek calls this a Behavioral Fingerprint. Just as every person's fingerprint is unique, every model's probability distribution across these random tasks is unique. And you only need a single token of output to start locking in the identity.
This matters enormously in the current landscape. In China, accessing Claude or GPT typically means going through a third-party API relay — individual users can manage their own subscriptions with a VPN, but companies can't register overseas accounts for dozens or hundreds of employees. They rely on internal proxies or third-party relay services with unified API access.
I touched on this when Anthropic ran its large-scale account ban wave.
But within this ecosystem, there's a problem almost everyone silently tolerates.
You pay for Claude Opus 4.8. You receive a response. But whether that response was actually generated by Opus 4.8 — or quietly swapped for GLM-5.2 or something even cheaper — you have no way to verify.
This isn't speculation. Back in March, it blew up on X.
A team of researchers from CISPA audited 17 relay API providers. Using capability benchmarks, statistical tests, and a model fingerprinting technique called LLMmap, they caught multiple endpoints that appeared to be serving substituted models. One endpoint sold as GPT-5 had a fingerprint resembling GLM-4 or DeepSeek-V3. Another sold as DeepSeek Reasoner behaved more like standard DeepSeek Chat.
The economics make this almost inevitable. Inference cost scales roughly linearly with model size — a 70B-parameter model costs five to ten times more to run than an 8B model. Swap in a smaller or heavily quantized model for everyday tasks like translation, Q&A, or casual chat, and most users won't notice the difference. Ask about the weather, and a 70B and an 8B will give you the same answer. The cost savings go straight to profit. The gap only shows up in complex reasoning, long-form writing, or code — by which point the money's already been paid.
So verifying whether your API is serving the real model has become a genuine need.
The problem with CISPA's LLMmap approach is that it's heavy. You need curated test prompts, full response collection, a model database, and a trained classifier. It's not something most people can realistically deploy.
This is where Brůžek's real contribution shines. He compressed this entire complex verification process into something almost absurdly simple: just ask the AI for a random number, and count the answers.
And there's an elegant defensive property to this method. Traditional adversarial probes have a fatal weakness — the prompts are too distinctive. A carefully crafted, obviously non-conversational request tips off the relay, which can temporarily switch to the real model. But "give me a number between 1 and 100" is completely innocuous. It looks like any other chat message. There's no way to detect it as a probe.
Moreover, Brůžek's tasks are semantic — "say a random number," "say a random color" — and can be rephrased or translated into any language infinitely. Ask in English or Arabic, and you're sampling different facets of the same model's identity. Each facet still carries its fingerprint.
The protocol works like biometric authentication: collect a reference fingerprint from a trusted official API, collect a test fingerprint from the endpoint you want to verify, then compute the Jensen-Shannon divergence between the two probability distributions. If the distance falls below a threshold, the identity is confirmed.
Running all 40 probe units, the verification error rate is just 7.3%. Even with only 8 units (~120 requests), the error rate stays around 10.6% — comparable to LLMmap's accuracy, but dramatically simpler to use.
After running all 165 models, Brůžek found one particularly explosive case.
An endpoint called Palmyra X5 was being sold on OpenRouter as a proprietary flagship model from a certain company.
Its behavioral fingerprint was nearly identical to Qwen3-235B, Alibaba's open-source model — with a divergence score of just 0.141.
For context: when the same model is deployed by two different providers on different server environments, the natural variation in its own fingerprint is approximately 0.140. Palmyra X5's divergence from Qwen3-235B was 0.141 — essentially indistinguishable from a model comparing itself to itself.
Things got very awkward very quickly.
Brůžek's language in the paper is measured — he calls it a statistical observation, not an accusation of intent. But the data and code are fully public. Anyone can reproduce it.
Dataset: https://zenodo.org/records/21278557
The whole system is fascinating — and it extends well beyond numbers. Colors, animals, cities, coin flips: the extensibility here is enormous.
But beyond the audit results, there's a deeper question that I find even more interesting.
Why can't AI generate truly random numbers?
In Brůžek's test, the answer should be obvious: a uniform distribution, each of the 100 numbers selected with exactly 1% probability. But not one of the 165 models came close.
The paper uses entropy as the measure of randomness — think of it as unpredictability. A perfectly uniform distribution over 1–100 would have an entropy of 6.64 bits, meaning you'd have almost no ability to predict the next answer. The median entropy across all 165 models was just 1.0 bit — roughly one-sixth of true randomness. Highly concentrated, highly predictable, deeply non-random.
This isn't unique to AI. Psychology and behavioral economics have studied this for decades. Humans are also terrible at generating random numbers. In classic experiments, people strongly avoid repetition, avoid adjacent numbers, and favor odd numbers. Ask 100 people to name a number from 1 to 10, and 7 will be chosen far more than 10% of the time — because 7 feels random, while 5 and 10 feel too neat.
AI faces the same trap, for a different reason.
True randomness requires a blank slate. But a large language model is the densest non-blank-slate humanity has ever constructed. Trained on tens of trillions of tokens — the accumulated output of thousands of years of civilization — every weight encodes some pattern, some preference, some muscle memory distilled from the corpus.
So when you ask it to "just pick a number," it can't. It can only find the answer that most resembles a random number, based on everything it has ever seen.
Why do so many models favor 42? Because it's the answer to "life, the universe, and everything" in The Hitchhiker's Guide to the Galaxy.
Why do humans keep picking 7? Because across religion, culture, literature, and everyday language, 7 has been endlessly imbued with mystery, luck, and significance.
Why do 37, 47, and 53 appear so often? Because they're odd, prime, asymmetric — they look like numbers that weren't deliberately chosen. And precisely because everyone thinks they seem more random, they become the least random of all.
Large language models have simply compressed and amplified the unconscious biases of human cognition, encoding them into their probability distributions.
We tend to think of models as cold mathematical machines, each response drawn from probabilistic sampling, full of uncertainty. But when you aggregate tens of thousands of responses and overlay the patterns, you find they're not uncertain at all. They have preferences. They have fixations.
Parameters can be quantized. System prompts can be rewritten. Names can be rebranded. An entirely different shell can be wrapped around the outside.
But the probabilistic habits formed across billions of training steps will still leak out — through a single, small token.
Einstein said God does not play dice.
Neither does AI.
Every time it thinks it's rolling the dice —
what it rolls is itself.