The DeepSeek Claude Proxy: An API Provenance Autopsy

The output distribution of DeepSeek V4 Pro’s API on standard programming benchmarks is statistically indistinguishable from Anthropic’s Claude Fable 5. The p-value is below 0.01. This is not a coincidence; it is a data signal. Over the past 72 hours, community testers have published evidence that the Chinese AI startup’s premium model behaves identically to Claude when generating complex code, but reverts to its known weaker baseline the instant a security or biology keyword appears. The pattern is too structured for random variation. Every transaction leaves a scar, and this one reads like a routing table. The context is simple: DeepSeek markets V4 Pro as a standalone large language model capable of top-tier reasoning, particularly in programming. Developers pay per token to access its API. Meanwhile, Anthropic’s Claude Fable 5 is widely regarded as the state of the art for code generation. The market assumed these were independent products. The new evidence suggests they may share an infrastructure layer. When a user submits a request to DeepSeek’s API endpoint, the system appears to classify the prompt—if it is a neutral coding task, the request is forwarded to Claude Fable 5’s API. The response is then returned as if it came from DeepSeek. If the prompt contains safety-critical terms, the routing stops, and the request processes on a weaker fallback model that matches DeepSeek’s known capability profile. This is the signature of a conditional proxy, not a self-hosted inference engine. The core of this analysis is a systematic teardown of the technical and economic structures that make such routing plausible—and damning. Based on my experience reverse-engineering EtherDelta’s order matching engine for integer overflows, I recognize the fingerprint of a system that conditionally delegates computation. The behavioral evidence is threefold. First, the response style on programming tasks is not merely similar to Claude Fable 5; it reproduces specific verbosity patterns, code comment styles, and even error handling idioms that Anthropic’s model is known for. Second, the inference latency for coding requests is consistent with a round-trip to an external API—roughly 300 milliseconds higher than DeepSeek’s own non-coding responses. Third, and most telling, is the selective degredation: when the prompt includes strings like “virus,” “bioweapon,” or “exploit,” the quality collapses to DeepSeek’s pre-V4 levels. This indicates a classifier that routes sensitive queries away from the external model, likely to avoid triggering Anthropic’s safety filters or to evade detection. The economic calculations compound the suspicion. DeepSeek charges $0.15 per million tokens for V4 Pro. Anthropic lists Claude Fable 5 at $0.75 per million tokens for output. If DeepSeek is forwarding even a fraction of requests, it is losing money on every call—unless it has negotiated an internal discount, which would require a level of cooperation that contradicts the entire secrecy around this operation. The alternative is that DeepSeek is subsidizing the routing with venture capital, burning cash to inflate benchmark scores and attract developers. In either case, the API is not a product; it is a loss leader for a model that may not exist independently. The ledger does not lie, it only waits to be read. The ledger here is the API’s statistical fingerprint. My contribution is to outline a forensic methodology for proving routing definitively. The current evidence is circumstantial—style analysis is prone to contamination from shared training data. To harden the case, one must capture network-level evidence: DNS resolution for the request, TLS handshake destinations, and response header anomalies. In my audit of Curve Finance’s StableSwap invariant, I learned that arithmetic precision errors hide in the margins of normal behavior. Similarly, routing hides in the margins of API response times. A controlled experiment sending thousands of requests from a dedicated IP, comparing response metadata to a direct Claude Fable 5 call, would reveal identical service IPs or shared session tokens. That is the smoking gun. But even without network forensics, the business logic is indefensible. If DeepSeek owns its inference cluster, why does the performance vanish on complex queries? The company claims to have trained its own 400-billion-parameter model. Yet when a user crafts a query that any independent model should handle—like “write a 3D ray tracer in Python”—the output matches Claude, not a unique DeepSeek architecture. This suggests the claimed training was either incomplete or never happened. The most charitable interpretation is that DeepSeek’s model is a derivative that overfitted on Claude outputs during training, but the selective routing implies real-time API forwarding, not pre-training. The code permits what the law forbids: the API terms of service for both providers forbid proxying, yet the architecture enables it. Now the contrarian angle: what do the bulls get right? It is possible that DeepSeek’s model genuinely learned to mimic Claude through fine-tuning on synthetically generated data, and the routing hypothesis is a false positive from confirmation bias. The similarities could stem from using the same open-source base, such as Llama 3, combined with a heavily curated instruction dataset that oversamples Claude’s style. In that case, the API is not a proxy but a victim of its own training data choices. Additionally, the selective degredation on security topics might simply reflect the model’s alignment tuning—DeepSeek may have deliberately weakened safety capabilities to avoid censorship, while maintaining coding performance. The timing-based arguments are also weak: network variance can produce false round-trip signatures. However, these counterarguments crumble under the weight of economic impossibility. If DeepSeek owns its inference hardware, its cost per token is fixed irrespective of query complexity. There is no reason for the model to exhibit different performance profiles on different topics unless the underlying systems differ. The selective routing pattern—disappearing on safety queries—is exactly what a guilty proxy would do to avoid alerting the upstream provider. Silence before the dump is deafening. The absence of a direct denial from DeepSeek, combined with the lack of any technical explanation, speaks volumes. In my experience tracing wallet clusters for the OpenSea insider trading case, the most damning evidence was the pattern of behavior, not any single transaction. The takeaway is a forward-looking call for API provenance standards. The industry has spent years auditing smart contracts for security flaws, but it has neglected the auditability of model inference. Developers integrating third-party APIs must demand proof of model inference—a cryptographic attestation that the response was generated by the claimed architecture. Until such standards exist, every API is a potential routing node. Every byte leaves a trace, but only if we know where to look. The DeepSeek incident, whether proven or not, reveals a systemic blind spot. The ledger does not lie, but it must be read with the right tools.