WHICH MODEL
ACTUALLY RAN?
A 2026 audit of shadow AI APIs found identity-verification failures in 45.83% of its tests — you pay for a frontier model and a small open-weight one answers (CISPA, arXiv 2603.01919). Paste a request ID below. Phantom returns the receipt the enclave signed for that exact answer, naming the model that actually ran.
Checking with the pass stored in this browser.
receipt detail
// WHAT THIS CHECKS
The answer is hashed
When your request runs, the enclave hashes the exact bytes it received and the exact bytes it sent back, and writes both into a receipt.
The enclave signs it
The receipt names the model that actually served you, and is signed by a key generated inside the sealed hardware. That key never leaves it — not to phantom, not to anyone.
You get a verdict
Phantom compares the model you were sold against the model the receipt names. If they differ, this page says so. There is no version of that check phantom can quietly pass.
// QUESTIONS
Where do I find the request ID?
Every non-streaming answer comes back with an x-phantom-receipt header holding it, plus an x-phantom-verify header holding a link straight to this page with the fields filled in. On a streamed answer, read the id field out of the SSE payload. In chat, every answer carries its own verify button.
What does "not verifiable" mean?
Proxy-tier models (OpenAI, Anthropic, Google, x.ai) run on the vendor's own machines. There is no enclave there to sign anything, so no receipt can exist — and phantom will not fake one. Only the TEE tier is verifiable. See which is which.
Why do I need a key to check?
Fetching a receipt costs an upstream call. Requiring a live key stops anonymous strangers from burning that budget. Any active phantom key or pass code works, and the request never leaves this origin.
Can phantom forge a pass?
Not without the enclave's signing key, which is generated inside Intel TDX and never exported. You can re-check the signature yourself against the raw quote chain at GET /v1/inference-attest.
What if the check fails?
A red verdict names the model that actually ran. Send it to us over PGP with the request ID. A substitution is a defect, not a policy.
Is my prompt in the receipt?
No. The receipt carries hashes of the request and response bodies, never the bodies. The hash proves which bytes were covered without revealing them.