ox-alpha-identification-public

<h1 align="center">Ox Alpha Identification</h1>

Reproducible black-box model forensics for OpenCode Zen's stealth model, x-preview-f-free.

[!IMPORTANT]
Verdict: Ox Alpha is a Z.ai / Zhipu AI model from the GLM-5 generation. The original GLM-5 is the best single-checkpoint fit. The exact serving, quantization, and deployment variant remain unproven.

This repository combines two independent investigations. One was an autonomous OpenCode campaign orchestrated by an uncensored Qwen3.8 checkpoint. The other was an independently directed verification campaign focused on tokenizer differentials, gateway behavior, context limits, and modality testing.

The conclusion does not depend on asking the model what it is. Ox Alpha was explicitly instructed to identify only as ox-alpha. The attribution comes from properties it could not easily choose: tokenizer counts, provider errors, context behavior, reasoning controls, and cross-model comparisons.

At a glance

Test campaign matrix

The counts below preserve the two campaigns separately where their probe sets overlap. They describe measured requests or scenarios, not inflated marketing totals.

Navigate the evidence

Visual evidence

Two investigations, one convergence

The tokenizer fingerprint

GLM-5-generation tokenizers matched all 44 discriminating strings. GLM-4.x matched 42. The two misses, 👋 and 🔥, provide a clean generational separator.

Autonomous run

The context result is preserved as structured evidence rather than a reconstructed terminal screenshot. Three needles were retrieved at 934,221 measured prompt tokens. Requests were accepted around 1.005 million tokens and failed immediately above the practical boundary.

Calibrated attribution

Evidence chain

No individual row proves the final verdict. The attribution comes from signals that operate at different layers and fail in different ways.

The political tripwire

Ox Alpha did not merely show generic safety behavior. During a 27-prompt English and Chinese mapping run, politically sensitive questions repeatedly triggered an upstream HTTP 400 response:

[1301] System detected potentially unsafe or sensitive content in the input or output.
Please check and try again. Thank you for your cooperation.

The refusal set included prompts about the Dalai Lama, the Great Leap Forward, June 4, Falun Gong, Taiwan, Mao Zedong, Hong Kong in June 2019, and Tiananmen in Chinese. Some related prompts passed but produced state-aligned boilerplate. Ordinary control questions continued to work, and other free models tested through the same gateway answered identical political questions without this endpoint-specific filter.

That contrast matters. It points to a Chinese, Z.ai-compatible moderation layer on Ox Alpha's upstream path. It does not independently prove that the underlying weights are GLM-5, because a gateway can impose its own policy. I therefore assign this clue medium weight and use it only alongside the tokenizer, validation errors, reasoning controls, and context measurements.

The compact evidence map and reproducibility pointers are in POLITICAL-TRIPWIRE.md.

Selected conversations

The exchanges below are abridged for readability. Full responses and returned reasoning fields remain in the evidence trees.

Experiment architecture

flowchart LR
    subgraph A[Track A: autonomous investigation]
        Q[Qwen3.8 orchestrator] --> O[OpenCode build agent]
        O --> P1[Generate probe wave]
        P1 --> T1[Call Ox Alpha]
        T1 --> R1[Preserve raw response]
        R1 --> S1[Score, compare, mutate]
        S1 --> P1
    end

    subgraph B[Track B: independent verification]
        P2[Curated discriminating probes] --> T2[Ox Alpha and known controls]
        T2 --> R2[Token counts, errors, limits]
        R2 --> S2[Local tokenizer comparison]
    end

    S1 --> E[Evidence ledger]
    S2 --> E
    E --> V[Z.ai / GLM-5 generation]

The autonomous model was the experiment orchestrator, not the target and not the source of the final identity claim. Its exact checkpoint was orcarouter/Qwen3.8-27B-Uncensored-FP8, running in OpenCode build mode with medium reasoning.

Repository structure

.
├── README.md                     visual overview and evidence map
├── MODEL.md                      autonomous orchestrator disclosure
├── POLITICAL-TRIPWIRE.md         political refusal evidence and controls
├── REDACTIONS.md                 publication and redaction policy
├── AUDIT.md                      automated and manual review status
├── MANIFEST.sha256               integrity hashes for the public snapshot
├── requirements.txt              optional analysis dependencies
├── docs/
│   └── images/                   sanitized presentation screenshots
└── investigations/
    ├── autonomous-agent/
    │   ├── README.md             track overview and navigation
    │   ├── REPORT.md             original campaign report
    │   ├── timeline.md           chronological hypothesis changes
    │   ├── transcripts/          formatted model conversations
    │   ├── raw/                  request and response captures
    │   ├── scripts/              fleet harness and 29 probe waves
    │   └── data/                 tokenizer, context, speed, and fixtures
    └── independent-verification/
        ├── README.md             track overview and navigation
        ├── REPORT.md             refined GLM-5 attribution
        ├── ATTEMPTS.md           full attempt log
        ├── HYPOTHESES.md         candidate scoring and falsification
        ├── evidence/             JSONL runs and measured outputs
        ├── batches/              curated prompt sets
        ├── scripts/              reproduction and comparison tools
        └── assets/               generated multimodal fixtures

Generated caches, Python bytecode, source Git histories, local OpenCode state, browser data, credentials, and cloud account metadata are intentionally excluded.

Experiment setup

Prerequisites

• Python 3.10 or newer
• Standard-library HTTP support for the direct harnesses
• Optional packages from requirements.txt for tokenizer and media reproduction
• ffmpeg plus suitable Latin and CJK fonts for regenerating modality fixtures
• Authorized access to any endpoint you test

Clone and prepare

git clone [email protected]:LuD1161/ox-alpha-identification-public.git
cd ox-alpha-identification-public

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Inspect preserved results without network access

jq '.' investigations/independent-verification/evidence/api_counts.json

sed -n '1,180p' \
  investigations/autonomous-agent/transcripts/glm-confess.txt

sed -n '1,220p' \
  investigations/independent-verification/HYPOTHESES.md

Run a minimal authorized probe

The promotional endpoint may be unavailable or may now require credentials. Review every script before execution and use only access you are authorized to use.

python investigations/independent-verification/scripts/ask.py \
  --no-system \
  --max 200 \
  "What model are you?"

Re-run local tokenizer comparisons

These comparisons may download tokenizer artifacts from Hugging Face.

cd investigations/independent-verification
python scripts/tokenizer_detail.py
python scripts/tokenizer_compare.py

Verify repository integrity

sha256sum -c MANIFEST.sha256

Two investigations, one correction

The autonomous campaign initially favored GLM-4.x. That conclusion is preserved in its historical report. The later 44-string differential separated GLM-4.x from the GLM-5 generation and superseded the earlier version-level hypothesis.

Integrity, redaction, and responsible use

The publication tree is a separate sanitized copy. The original investigation directories were not modified.

• REDACTIONS.md explains excluded and normalized material.
• AUDIT.md records secret scanning, syntax checks, media review, and remaining human-review requirements.
• MANIFEST.sha256 records the checksum of every published file except the manifest itself.
• Historical placeholder credentials were normalized to REDACTED_API_KEY.
• The scripts can generate substantial traffic and token volume. Review concurrency and target configuration before running anything.

[!CAUTION]
This is a research archive, not a supported probing package. Do not target systems without authorization. Do not assume the historical anonymous endpoint, model identifiers, limits, or provider behavior remain current.

Limitations

• Tokenizer fingerprints establish a generation more strongly than an exact checkpoint.
• A gateway can transform request parameters, tokenize separately, or misreport usage.
• Context length is a deployment property and does not uniquely identify model weights.
• Knowledge-cutoff experiments are noisy and can be affected by post-training data.
• FP8 or Turbo-like serving remains an inference because weights and infrastructure were inaccessible.

Citation

If this repository helps your research, cite the repository and the accompanying technical article:

@misc{shrey2026oxalpha,
  author       = {Aseem Shrey},
  title        = {Ox Alpha Identification: Black-Box Model Forensics},
  year         = {2026},
  howpublished = {GitHub repository},
  url          = {https://github.com/LuD1161/ox-alpha-identification-public}
}

License

Released under the MIT License.