We study what model-identifying information leaks through commercial language-model APIs that expose top-k token log probabilities. Building on extreme-value theory predictions for logit order-statistic gaps, we confirm that the normalized third logit gap (δ norm) remains near the Gumbel-class constant ≈0.318 across 6 models from 3 providers (OpenAI, Google Vertex AI, xAI) and 3 independent measurement sessions, demonstrating that output-layer universality persists through API truncation and quantization. We introduce a PPP-residualization transform that removes the dominant tail scale factor and reveals a low-dimensional but stable endpoint-specific geometry in the remaining gap spectrum. Contrary to common assumption, "provider" is not a geometrically coherent label: models do not cluster by corporate origin under these observables, but they do separate by model identity across independent sessions. Using a challenge-response protocol with centroid averaging and per-model thresholds, we demonstrate cross-session endpoint verification with a 0.83% breach rate (119/120 correct identifications across three temporal sessions); per-model thresholds eliminate all breaches on this dataset. We observe a robustness phase transition governed by enrollment depth. Under single-session enrollment, prompt selection is load-bearing: the majority of bootstrapped banks fail to separate the six endpoints. Under two-session enrollment, bank sensitivity collapses on this dataset, and a bank compiler produces small compiled banks that exceed the margin of larger uncompiled banks. A dimensionless robustness parameter SNR(K,S) unifies both axes: prompt count K and enrollment depth S jointly govern the transition from bank-sensitive to bank-robust verification. We discuss operational implications for re-enrollment cadence and template management in production deployments. Addendum (02/26/2026): Post-publication results extend this framework in two directions. A distillation experiment across six training protocols demonstrates that a model's structural fingerprint (weight-geometry regime) is completely invariant to knowledge distillation, while its functional fingerprint (PPP-residual template) converges 31--52% toward the teacher's — enabling forensic detection of distillation provenance through API measurements alone. A conditional impossibility theorem, machine-checked in Coq (41 theorems, 0 Admitted), proves that no standalone model can spoof another's PPP-residual template across independent challenge prompts without exhausting its KL divergence budget, under four explicit trust assumptions.
Anthony Coslett (2026) studied this question.