- Hidden system prompts can shift an LLM's behavioral fingerprint up to a Jensen-Shannon distance of 0.46, effectively making it behave like a different model.
- The study tested 5,660 controlled API calls, injecting real CLI prompts (Codex CLI and Claude Code) into models like GPT-5.5 and gpt-4o-mini, and measured drift in answer distributions.
- The Claude Code prompt pushed both models into 'different model' territory: colors collapsed to a single answer, and languages switched (e.g., 30/40 responses in Chinese).
- Length alone can cause drift, but it varies by model: GPT-5.5 drifted 0.355 on meaningless filler, while gpt-4o-mini was stable at 0.066.
- A severity ladder across 3 models and 6 probes showed interference is a three-way coupling (model × task × condition), and no universal 'small injection = small drift' rule exists.
- The adversarial instruction 'select uniformly at random' is the hard boundary, causing nearest-neighbor attribution to fail for all tested models.
- The 1–100 number probe is the best compromise for stability and signal, while high-entropy probes (e.g., random word) are most fragile.
- Using a stability-selected battery (number + letter + animal) reduces false alarms from 25% to 8% while catching ~95% of impostors.
- Full-distribution Jensen-Shannon divergence beats all shape features (e.g., modal answer) under interference; shape features are unreliable.
- Real-world audits found hidden wrappers of ~1,447 tokens on a commercial relay endpoint, causing 50× billing inflation and drifting fingerprints from official models.