LLM Cost per Task: How to Calculate the Real API Cost

LLM cost

Prices checked 28 October 2026: standard (pay-as-you-go) API tier, US dollars per million tokens, from each provider’s official pricing page unless stated otherwise.

Kimi K3.1 Pro costs half as much per token as Claude Opus 5.5: $2 per million input tokens and $10 per million output tokens, against $4 and $20. On Artificial Analysis’s Intelligence Index runs, Kimi still cost more per task: $2.11 against $1.82 for Opus 5.5 at High effort. It produced 55,000 output tokens per task to Opus’s 36,000.

That’s the mistake a price table invites. A per-token rate tells you what one unit of text costs. It doesn’t tell you how many units a model will spend on your job, or how often the job comes back usable. LLM cost per task captures both.

LLM cost per task is the total API spend on every attempt at a set of tasks, divided by the number of attempts that met your acceptance criteria.

The rest of this article is about calculating that number correctly, and about knowing when to trust it.

Key Takeaways
  • Price per token and cost per task can rank models in opposite orders. Kimi K3.1 Pro is half Opus 5.5’s per-token price but cost about 16% more per Artificial Analysis task.
  • Reasoning tokens are billed as output by OpenAI, Anthropic and Google, even when you never see them. Anthropic also bills earlier turns’ thinking as input on its newest models.
  • Caching can swing the bill several-fold. In one public test, a broken cache made a single run cost $17.60 instead of $2.62.
  • Divide by successes, not attempts. Failed runs cost money and produce nothing.
  • Twenty runs can’t separate close results. An 80% and a 65% pass rate from 20 runs each have overlapping confidence intervals.
  • Price changes can settle a close call. One developer test found Gemini 4 Argon roughly level with Opus 5.5 per successful fix. At Argon’s December 1 prices, it would cost about twice as much.

Quick Navigation


The LLM cost per task formula

For one attempt, the API cost is the sum of each token category times its rate, with token counts converted to millions:

Attempt cost = (fresh input tokens  ÷ 1,000,000 × fresh-input rate)
             + (cache-read tokens   ÷ 1,000,000 × cache-read rate)
             + (cache-write tokens  ÷ 1,000,000 × cache-write rate)
             + (billable output     ÷ 1,000,000 × output rate)
             + per-call charges (web search, code containers, grounding)

Then, across a test set:

LLM cost per successful task = sum of all attempt costs ÷ number of successful attempts
LLM cost

Each line has its own billing rules, and they differ by provider. This is the buyer’s cost. What it costs a provider to serve those tokens, and its margin, is a separate question, covered in what inference actually costs per token.

What each line costs at OpenAI, Anthropic and Google
Line itemOpenAI (GPT-5.6 and later)Anthropic (Claude 5.5 models)Google (Gemini 4 Argon)
Fresh inputList rateList rateList rate
Cache read0.1× input; 0.05× on GPT-6.1 Sol and Terra0.1× input; 0.05× on Opus 5.5 and Sonnet 5.5$0.10 per million (0.05× input)
Cache write1.25× input (30-minute) or 2.5× (12-hour)1.25× input (5-minute) or 2× (1-hour)No separate charge listed; caching is implicit only
Reasoning tokensBilled as outputBilled as output, including when thinking text is hiddenBilled as output (“incl. thinking”)
Search tools$10 per 1,000 web searches$10 per 1,000 web searches$14 per 1,000 grounded queries after 5,000 free a month

Sources: OpenAI pricing and prompt caching; Anthropic pricing and prompt caching; Gemini API pricing.

Two details catch people out. Anthropic’s thinking defaults to a display mode of “omitted” on Opus 5.5 and Sonnet 5.5, but its thinking documentation is explicit: “You’re still charged for the full thinking tokens. Omitting reduces latency, not cost.” On those models, previous turns’ thinking blocks also stay in context and are billed as input, so a long agent session pays for old reasoning again on every turn.

Reading usage fields without double-counting

A common error in home-made calculators is adding a field that already contains another one.

  • Anthropic: input_tokens counts only the tokens after the last cache breakpoint. Total input is cache_read_input_tokens + cache_creation_input_tokens + input_tokens, and each part takes its own rate.
  • OpenAI: cached_tokens excludes tokens charged as writes, which appear in cache_write_tokens. Reasoning tokens sit inside output_tokens, under output_tokens_details.reasoning_tokens. Don’t add them again.
  • Truncated responses: with reasoning models, a request that hits its output limit can bill input and reasoning tokens and return no visible answer, as OpenAI’s reasoning guide warns. That attempt still counts toward the cost.

Then reconcile your summed usage against the provider’s invoice for the same period. In July 2026, developers on OpenAI’s forum reported that GPT-5.6 output-token counts were several times higher than the text actually generated. OpenAI didn’t publicly confirm a defect in that thread. Whatever happened there, the invoice is the figure your finance team will pay.

From cost per attempt to LLM cost per successful task

The numerator is everything you paid to get results. That includes failed attempts, automatic retries, intermediate calls inside an agent loop, any model you use as a judge and per-call tool fees. Count each API call once, at the moment it happens. If your harness logs both an agent step and its parent run, sum only one of them.

The denominator is the number of attempts that passed a fixed acceptance test, written before the run. “The tests pass” is a test. “The output looked fine” is not. The same criteria must apply to every model, or the division compares different jobs.

There are two valid ways to define a task:

  • Independent attempts. Each run is scored on its own, which is what most benchmark-style comparisons do.
  • Tasks with a retry policy. A task succeeds if any attempt within, say, three tries passes. Then the cost per task is all spend divided by tasks completed. That matches production better, but pick one definition and use it for every model.

API cost is not the whole bill. Human review, retrieval infrastructure, observability and sandboxes belong in a fully loaded cost per task whenever models differ in how much of that work they create. A model whose failures are obvious and cheap to discard can beat one whose failures look plausible and need a reviewer to catch.

A public test: 20 runs, four models

On 14 October 2026, a developer writing at paddo.dev replayed six merged changes from a production monorepo against four models. Each model got 20 runs (three or four per change) at medium effort in the Claude Code harness. Gemini 4 Argon was routed through OpenRouter. A run passed if the tests that shipped with the original fix passed. Costs were calculated at list prices.

ModelRunsPassing runsTotal costCost per runCost per passing run
Gemini 4 Argon2016$57.68$2.88$3.61
Claude Opus 5.52013$45.81$2.29$3.52
Claude Sonnet 5.52011$11.76$0.59$1.07
GPT-6.1 Sol2011$6.73$0.34$0.61

The totals and pass counts come from the post. The last two columns are our arithmetic, and they check: $57.68 ÷ 16 = $3.605, and $45.81 ÷ 13 = $3.524.

Argon and Opus are close, nine cents apart per passing run. Argon’s per-token prices matched Sonnet 5.5’s at the time ($2 input, $10 output), yet it cost five times as much as Sonnet per run. It wrote 1.37 million output tokens across the 20 runs, 2.8 times as many as Opus.

GPT-6.1 Sol had the lowest cost per passing run, but the post also records five Sol runs that broke a previously passing test, against none for the others. It doesn’t say whether those runs are among Sol’s 11 passes. If “breaks nothing” is part of your acceptance test, Sol’s denominator may shrink, which is why the test has to be written down before anyone divides.

How much a 20-run test can tell you

Not much, at the margin. A 95% Wilson confidence interval on 16 passes out of 20 is about 58% to 92%; for 13 out of 20, about 43% to 82%. The ranges overlap heavily, so a rerun could reverse the order. And six changes from one codebase, with correlated runs on each change, say little about a different stack.

What the December repricing does

Google’s pricing page doubles every Argon token rate on 1 December 2026: input from $2 to $4, cached input from $0.10 to $0.20, output from $10 to $20. If the runs used identical tokens, Argon’s total would become $115.36, or $7.21 per passing run, about twice Opus’s $3.52. We covered the change itself in Gemini 4 Argon pricing doubles Dec 1.

A simple break-even check shows how far the decision moves. One model is cheaper per success than another when its pass rate exceeds the other’s pass rate multiplied by the ratio of their per-attempt costs. Before December, Argon needed a pass rate above 65% × 1.26 ≈ 82% to beat Opus; it scored 80%. After December, it would need 65% × 2.52 ≈ 164%, which is impossible. Even at the bottom of Opus’s confidence interval, Argon would lose. On this test, the price change settles a question the sample size couldn’t.

How caching and reasoning change LLM cost per task

The same post found a stark caching failure. The first Argon run cost $17.60 because it read 8.4 million input tokens and only 59,000 came from cache. The harness inserted system messages that changed the prompt prefix on every call, so Gemini’s implicit cache never matched. After a fix, the same run cost $2.62, with 94% of input served from cache.

The second example is illustrative. The token counts and pass rates are assumptions, not measurements of any real model. Two models attempt the same agent task:

  • Model X: $1 input, $0.05 cache read, $1.25 cache write, $5 output, per million tokens. Pass rate 60%.
  • Model Y: $4 input, $0.20 cache read, $5 cache write, $20 output. Pass rate 85%.
  • Each attempt sends 300,000 input tokens over its turns. When caching works, 270,000 are cache reads and 30,000 are cache writes.
  • Model Y produces 20,000 output tokens per attempt, including reasoning. Model X produces 60,000.
ScenarioCost per attemptPass rateCost per successful task
Model X, cache broken (all 300,000 input tokens fresh)$0.60060%$1.00
Model X, cache working$0.35160%$0.585
Model X, cache working, reasoning doubles to 120,000 output tokens$0.65160%$1.085
Model Y, cache working$0.60485%$0.711

The calculation for the second row: 270,000 × $0.05 + 30,000 × $1.25 + 60,000 × $5, each divided by one million, gives $0.0135 + $0.0375 + $0.30 = $0.351. Dividing by 0.60 gives $0.585.

LLM cost

With caching working, the cheaper model wins. Break the cache, or let it reason twice as long, and the expensive model wins instead. Neither change shows up in a price table.

What published comparisons actually measured

Before using a published cost-per-task figure, check the effort setting, what counted as a task, and whether success was part of the number.

  • Effort settings. Put Gemini 4 Argon’s 36,000 reasoning tokens per task next to Opus 5.5’s 84,000, and Argon looks far leaner. Both figures appear on Artificial Analysis, but they come from different settings: Argon at High effort and Opus 5.5 at Max. At matched High effort, the comparison reverses: Argon used 36,000 reasoning tokens per task to Opus’s 18,000, and 62,000 output tokens in total to Opus’s 36,000. Argon still cost less per task, $1.62 against $1.82, because its tokens were half the price at the time.
  • Vendor claims. OpenAI launched GPT-6.1 Terra on 26 October at $1 input and $5 output. DataCamp’s write-up of the announcement says that at max effort Terra is over three times as token-efficient as Opus 5.5 and a quarter of the price per token, and it puts the combined effect at “9x lower cost per task”, attributed to OpenAI. No benchmark is named, and we couldn’t open OpenAI’s post to check. Three times the efficiency at a quarter of the price would multiply to about 12 times, not 9, so the figure depends on a token breakdown that hasn’t been published. Treat it as a vendor claim to test, not a result.
  • Cost per task is not cost per success. Artificial Analysis computes cost per task from token counts at list prices. It doesn’t divide by how many answers were right. A model that is cheaper per task but scores lower may still cost more per correct answer. As we argued in why benchmark scores don’t transfer to your workload, these numbers are good for building a shortlist, not for making the final decision.

How to measure LLM cost per task on your own workload

  1. Pick 30 to 50 real tasks from production traffic, covering easy, typical and hard cases. More tasks beat more runs of the same task.
  2. Write the acceptance test first: unit tests, a schema check or a fixed-judge rubric, identical for every model.
  3. Fix the configuration: prompts, tools, effort setting, context limits and retry policy.
  4. Log raw usage for every call, including retries and sub-agents, with each token field stored separately.
  5. Price the logs offline against a dated copy of each pricing page, so you can reprice them when rates change.
  6. Check cache hit rates per model. A low rate in a repetitive session usually means the prompt prefix changes between calls.
  7. Reconcile with the invoice for the test window.
  8. Report ranges: pass rate with a confidence interval, cost per attempt, cost per successful task and latency.

Run at least two attempts per task. That shows whether failures are random or the same task fails every time.

A decision rule for LLM cost per task

Compare models on cost per successful task, after deciding what a success is worth. Then apply three checks.

  • If the confidence intervals on pass rate overlap, treat the models as tied on quality and choose on cost per attempt, latency and operational fit.
  • If one model’s cost per attempt is k times another’s, it needs a pass rate more than k times higher to win. When that would take a pass rate above 100%, stop testing.
  • If a success is worth far more than the API cost, as with a merged fix that saves an engineer an hour, pass rate and reviewer time outweigh token prices. Optimise for the fewest failures, then for cost.

Per-token prices still have a job. They tell you where to look first. LLM cost per task tells you what you’ll actually pay.

Frequently asked questions

What is LLM cost per task?

It is the total API spend on all attempts at a set of tasks, divided by the number of attempts that met a fixed acceptance test. Failed attempts, retries, intermediate agent calls and judge-model calls stay in the total, because you paid for them. A broader, fully loaded version adds review time and infrastructure.

How do I calculate LLM API cost for one request?

Multiply each token category by its rate per million tokens: fresh input, cache reads, cache writes and output, including reasoning. Then add per-call tool fees such as web search. Take the counts from the response’s usage object, and check that one field doesn’t already include another before adding them.

Are reasoning tokens billed?

Yes. OpenAI, Anthropic and Google bill reasoning or thinking tokens at the output rate, even when the reasoning text isn’t returned. On Anthropic’s Opus 5.5 and Sonnet 5.5, previous turns’ thinking blocks are also billed as input when they stay in the conversation.

How much does prompt caching save?

Cache reads cost between 5% and 10% of the input rate at OpenAI, Anthropic and Google for current models. OpenAI and Anthropic charge 1.25 times the input rate or more to write to the cache. Savings depend on how much of each request repeats an earlier prefix, so measure the hit rate rather than assuming it.

Is the cheapest model per token ever the cheapest per task?

Often, yes. On Artificial Analysis’s figures, Gemini 4 Argon at High effort cost less per task than Opus 5.5 at High, while its tokens were half the price. The ranking flips when the cheaper model uses many more tokens, misses the cache or fails more often. Only measurement on your own tasks tells you which case you’re in.


Keep reading

Enterprise AI Spending

Enterprise AI Spending Hit $177B. Agents Are Driving the Bill

Figures checked against Menlo Ventures’ 2026 State of Enterprise AI report on 4 November 2026. Market sizes are Menlo estimates, shown as annualised run rates. …
Machine Unlearning

Machine Unlearning: Can We Really Trust an Edited AI Model?

Checked against Hirundo’s and Lazarus AI’s published results, CrowdStrike’s DeepSeek-R1 study, Lawfare and the Federal Register on 4 November 2026. Ask Alibaba’s Qwen3.6-35B-A3B about Tiananmen …
Robotics Cybersecurity

Your Robot May Pass Every Test. Its Simulator Could Still Be Lying

Last checked: 3 November 2026. Vulnerability identifiers, affected projects and patch information will be updated as coordinated disclosures become public. A robot that clears every …
Model Weights

Verify Model Weights: 7 Checks Before You Download

Checked against the burner22/numbat repository and its discussions, Hugging Face and PyTorch documentation, and Moonshot AI’s announcement on 2 November 2026. On 1 November, a …

LLM Determinism: Why the Same Prompt Gives Different Answers

LLM determinism

A classification endpoint has been running at temperature 0 for a month. A team replays last Tuesday’s inputs to debug a complaint, and a handful of the labels come back different. Nobody changed the prompt, the model ID or the code. (This is a hypothetical scenario, but the pattern is common enough that Anthropic’s own glossary warns about it.) The glossary says that “even with temperature set to 0, the results will not be fully deterministic, and identical inputs might produce different outputs across API calls.”

The usual fix, turning temperature down, only controls one step: how the next token is picked from the model’s probabilities. It does not control how those probabilities were computed, which hardware computed them, which other requests shared the batch, which model version sat behind the name, or what the tools returned. LLM determinism is a property of the whole inference pipeline, not of one parameter. Where in that pipeline the variation enters decides what an application can honestly promise about it.

Key Takeaways
  • Temperature 0 controls token selection, not computation. Anthropic documents that it is “not fully deterministic”, and OpenAI described its seed as “best effort”.
  • The main documented cause on modern stacks is a lack of batch invariance, not concurrency. A request’s arithmetic can depend on which other requests share its batch. Batch-invariant kernels removed the variation in Thinking Machines’ test, at a speed cost.
  • A pinned model ID freezes the weights, not the serving stack. Anthropic says infrastructure updates are the most likely cause of behaviour changes on a stable ID.
  • In agents, one different token can redirect a whole run. Safety must come from validation and approval gates, not from the model repeating itself.
  • Evaluate distributions, not single runs. Report standard errors, resample where variance is high, and track failure modes.
  • Pick a reproducibility level: exact, best-effort, statistical, or application-level correctness. Then control the layer that matters for that level.

Quick Navigation


What LLM determinism actually means

A system is deterministic if the same inputs always produce the same output. The difficulty with LLMs is that “the same inputs” hides most of the inputs. The prompt is visible. The model weights, numerical kernels, batch composition, hardware, decoding settings, tokenizer and every tool response along the way are not, and all of them feed into the result.

It helps to separate four questions that often get merged:

  • Repeat within one fixed environment. Same weights, same kernels, same hardware, same batch shape. This is the narrowest case, and the one most likely to be reproducible bit for bit.
  • Repeat across serving conditions. Same model and prompt, but different load, batch sizes or machines. This is what an API user actually experiences.
  • Reproduce after a change. The provider updates the model, the serving stack or the infrastructure. The question is now whether the behaviour is preserved, not the bits.
  • Reproduce a workflow. An agent’s final state depends on many calls, plus tools and external data. Matching one response is not the same as matching the run.

Reproducibility is also not correctness. A model can return the same wrong answer every time. It can also return different wording that is equally correct. Exact text equality, equivalent meaning, task success and safe execution are four different success criteria, and an application should choose one deliberately.

Temperature is only one LLM determinism control

At each step, the model produces a score (a logit) for every token in its vocabulary. Decoding turns those scores into a choice. Greedy decoding takes the highest-scoring token. Sampling draws from the probability distribution. Temperature reshapes that distribution: lower values concentrate probability on the top token, and temperature 0 is generally treated as greedy. Top-p and top-k limits trim the candidate set before the draw.

A seed fixes the random number generator used for sampling, so that two runs with the same probabilities make the same draws. OpenAI introduced a seed parameter in 2023. Its cookbook guide promised “(mostly) consistent outputs” on a “best effort” basis and stated that “determinism is not guaranteed”. It paired the seed with a system_fingerprint field identifying the backend configuration, warning that when the fingerprint differs “you may see different outputs”. The current Chat Completions reference now marks system_fingerprint as “Deprecated”. So the visible signal for backend change is going away even on the API that introduced it. We found no seed parameter documented for Anthropic’s Messages API, and Anthropic’s glossary says outright that temperature 0 is not fully deterministic, on its own service and through third-party clouds.

Both controls act on the last step of the computation. Greedy decoding is deterministic given its input, but its input is a vector of floating-point logits computed by everything upstream. If two top candidates are close and the upstream arithmetic shifts one of them slightly, greedy decoding faithfully picks a different token. There may also be implementation details in tie-breaking. Temperature and seeds narrow the variation that sampling adds. They do nothing about variation in the numbers being sampled from.

How the serving system breaks LLM determinism

The root mechanism is that floating-point addition is not associative. Real-number arithmetic says (a + b) + c equals a + (b + c). Floating-point arithmetic rounds after every operation, so the order matters. In 32-bit floats:

  • (100,000,000 + (−100,000,000)) + 1 = 1
  • 100,000,000 + ((−100,000,000) + 1) = 0

In the second order, adding 1 to −100,000,000 is lost to rounding, because 32-bit floats near that magnitude are spaced 8 apart. The same effect, at smaller scale, occurs whenever a GPU kernel sums thousands of products in a matrix multiplication or attention reduction. Change the order of the sum and the last few bits of the result can change.

That alone does not make a system nondeterministic. A fixed kernel on fixed hardware sums in a fixed order. NVIDIA’s cuBLAS documentation says its routines “generate the same bit-wise results at every run” on GPUs “with the same architecture and the same number of SMs”. It lists the exceptions: multi-stream execution, atomics mode and certain workspace conditions. It also notes that results are not guaranteed to match across toolkit versions.

The more interesting finding came from Thinking Machines Lab. In Defeating Nondeterminism in LLM Inference (September 2025), Horace He and colleagues argued that the common explanation, “concurrency plus floating point”, misses the main cause. A typical forward pass, they wrote, uses essentially no atomic operations and is run-to-run deterministic. What it is not is batch-invariant. Many kernels choose a different reduction strategy depending on how many tokens are in the batch, so one request’s numbers depend on how many other requests were processed alongside it. Server load sets the batch size, and load is outside any user’s control.

Their experiment makes the scale concrete. They ran 1,000 completions of the same prompt at temperature 0 on Qwen3-235B-A22B-Instruct-2507 and got 80 unique outputs. All 1,000 matched for the first 102 tokens, then split at token 103: 992 continued “Queens, New York” and 8 “New York City”. With batch-invariant kernels, all 1,000 completions were identical. The cost was speed. In their unoptimised test on a smaller model, a run that took 26 seconds with default vLLM took 55 seconds deterministically, or 42 seconds with an improved attention kernel. That is one implementation on one stack, but it establishes the mechanism. It also shows why providers optimising for throughput may not choose batch-invariant kernels by default.

Two qualifications matter. First, a numerical difference only changes text when it lands on a near-tie between candidate tokens. Most batch changes alter nothing visible, which is why the divergence above appeared at token 103 and not token 1. Second, once a single token differs, every later token is conditioned on a different prefix, so a one-bit difference can become a different paragraph.

Mixture-of-experts (MoE) models add a possible amplifier. A router scores each token and sends it to a few experts. If two experts score almost equally, a small numerical shift could change the assignment, and with it the computation path. Some MoE designs also cap how many tokens each expert accepts. The Switch Transformer paper sets expert capacity from the tokens in a batch and a “capacity factor”. Tokens beyond that capacity are “dropped” and passed through the residual connection without the expert’s computation. In such a design, whether a token is processed can depend on what else is in the batch. Whether any particular commercial model uses capacity limits at inference, and how often near-ties occur, is not publicly documented. This is a plausible mechanism, not a measured cause for any named API.

LLM determinism

LLM determinism and the model behind the name

Even with perfectly deterministic kernels, the model itself can change. Four things are worth distinguishing:

  • A model family: “Claude Sonnet”, “GPT-6”. This is a marketing label, not something you can reproduce against.
  • A mutable alias: a name that resolves to the latest snapshot. Anthropic’s model ID documentation describes an alias such as claude-sonnet-4-5 as “a convenience pointer that resolves to the most recent dated snapshot”.
  • A pinned snapshot: a fixed version. Anthropic says its IDs from the 4.6 generation onward map “to a single, fixed model snapshot” and that it “does not update the weights or configuration of an existing model ID”. OpenAI’s text generation guide recommends pinning production applications to snapshots for consistent behaviour.
  • The serving implementation: kernels, hardware, quantisation and routing infrastructure.

The fourth layer can change while the third stays fixed. Anthropic’s documentation says so directly: “If you notice unexpected behavioral differences on a previously stable model ID, an infrastructure update is the most likely cause.” That is a candid statement, and it applies in principle to any hosted model. A pinned snapshot freezes the weights. It does not freeze the arithmetic.

Unchanged application code therefore proves very little. Tokenizer versions, default parameters, safety filters, system-level prompt handling and the hardware a request lands on can all differ while the request body stays byte-identical. And snapshots do not last forever. When one is retired, the replacement is a different model, and UniverseBlend’s account of what breaks when a model version retires covers the migration that follows.

When LLM nondeterminism becomes an agent security and reliability problem

In a single chat answer, a changed word is usually harmless. In an agent, outputs become inputs. A one-token difference can change:

  • which tool the model selects, or the arguments it passes;
  • the text of a retrieval query, and therefore which documents come back;
  • an intermediate conclusion that later steps rely on;
  • whether the agent decides it is finished, or retries;
  • the exact downstream API call, and the state it leaves behind.

Because each step conditions the next, small divergences compound. Hypothetically: two runs of a support agent read the same ticket. One run’s first query returns a refund-policy document. The other’s, worded slightly differently, returns a shipping FAQ. From then on, the runs are reasoning about different evidence. Neither run is broken. The system simply has more than one plausible path, and a single test exercised only one of them.

This is where reliability shades into security, and the two should be kept apart. Ordinary variation is not an attack. But a safety property that holds on 99 runs and fails on the 100th is not a property the system has. Any defence that relies on the model “usually” refusing a dangerous action inherits that variance. The safer design assumes the model will sometimes choose differently and makes high-impact actions safe regardless:

  • idempotent operations, so a repeated call does no extra harm;
  • deterministic validation of tool arguments in code;
  • bounded retries;
  • approval gates for irreversible steps;
  • logs detailed enough to reconstruct which path a run took.

It also explains why an agent can pass an evaluation one day and fail a near-identical run the next without having become less capable. The capability did not change. The sample did.

Why one evaluation run cannot establish LLM determinism

If outputs vary, every evaluation score is an estimate with error. Anthropic’s 2024 research note, A statistical approach to model evaluations (with the companion paper by Evan Miller), recommends:

  • reporting the standard error of the mean with every score;
  • clustering standard errors when questions are grouped;
  • “resampling answers from the same model several times” to reduce within-question variance;
  • comparing models with paired differences on the same questions;
  • using power analysis to decide how many questions an evaluation needs.

None of those recommendations prescribes a universal sample size, and neither does this article. The right number of repeats depends on how variable the task is, how costly each run is, how risky a wrong conclusion would be, and how important the decision is. A model-selection decision for a regulated workflow justifies more trials than a prompt tweak for an internal tool. The practical rule is to keep running until the confidence interval is narrow enough that a plausible value at either end would not change your decision.

Variance is also only one of the reasons a public number misleads. Benchmarks can be contaminated, harnesses differ, and few report error bars. UniverseBlend’s case for building your own evals instead of trusting benchmark scores works through those gaps. For agents, measure the distribution of outcomes, not just the mean: how often the task succeeds, how it fails when it fails, and whether any failure involved an unsafe action. Two configurations with the same success rate can have very different worst cases.

A practical LLM determinism protocol for production teams

The aim is to make every surprising output diagnosable, then decide which layer to control.

  1. Record the model identifier exactly as sent and as returned, preferring pinned snapshots to aliases. Store any version or fingerprint field the provider still returns.
  2. Capture every request parameter: temperature, top-p, top-k, max tokens, stop sequences, seed, reasoning or thinking settings, and response format.
  3. Version the context, not just the prompt: system instructions, tool definitions, JSON schemas, retrieval configuration and any preprocessing.
  4. Log identifiers and timing: provider request IDs, timestamps, region, retries and their causes. A retried call is a second sample, not the same call.
  5. Snapshot tool and retrieval results for each step, so a replay can separate model variation from changes in the data.
  6. Test repetition deliberately. Run the same request many times in sequence and in parallel. Parallel requests are more likely to share batches with different neighbours, which exposes batch-dependent variation.
  7. Diagnose before controlling. If the variation disappears at temperature 0, it was sampling. If it persists with fixed inputs, suspect serving and ask the provider, or test on a controlled stack. If it appears after a date, suspect a model or infrastructure change. If it appears only in multi-step runs, look at tools and external state.
  8. Re-run a representative workload after any model change, alias move or announced retirement, and compare distributions, not single outputs.
  9. Track failure modes by category (wrong tool, wrong argument, premature stop, unsafe action), not only pass rates.
  10. Write down the reproducibility contract: the success criterion, the acceptable variation, and who signs off when it changes.
LLM determinism

Logging a seed does not make a result reproducible across providers, model versions or serving stacks. It is one field in a record whose purpose is diagnosis.

What teams should promise about LLM determinism

The useful framework here is a contract with four levels. It is a synthesis, not an industry standard. Choose the level from the task’s risk and from what a changed answer would cost.

LevelWhat it meansAchievable whenTypical use
Exact reproducibilityIdentical tokens for identical inputsYou control weights, kernels (batch-invariant), hardware and software versionsResearch replication, regulated audit trails, debugging
Best-effort reproducibilityUsually identical, with no guaranteeHosted API with pinned snapshot, temperature 0, seed where offeredCaching, regression tests, user-facing consistency
Statistical consistencyThe distribution of outcomes is stableRepeated evaluation with confidence intervalsModel selection, quality monitoring, agent evals
Application-level correctnessThe outcome is valid and safe, whatever the wordingValidation, constrained actions and approval gates in codeAgents that act, financial or customer-facing operations

Most production teams need the last two and only claim the second. Hosted APIs generally cannot offer the first, because the batch a request lands in is not the customer’s to choose. Self-hosting can achieve it at a throughput cost, but self-hosting is not a cure-all. It moves the responsibility for kernels, hardware and versioning onto the team. Who controls each of those layers is also a vendor question. The model vendor risk checklist covers what to ask about notice periods and snapshot pinning.

Conclusion

A repeatable prompt is not a reproducible system. Temperature and seeds control the last step of a long computation. Batching, kernels, hardware, model versions and tools sit upstream and downstream of it. The practical principle is to decide which level of reproducibility the task needs, find out which layer is producing the variation, and control that layer. For any action that cannot be undone, rely on validation in code rather than on the model making the same choice twice.

FAQ

Does temperature zero guarantee deterministic LLM outputs?

No. Temperature 0 makes decoding choose the most likely token, but the probabilities themselves come from floating-point computation that can vary with batch size, kernels and hardware. Anthropic’s documentation states that results at temperature 0 “will not be fully deterministic”. Other hosted APIs behave similarly, unless the provider guarantees otherwise.

Why can the same prompt produce different answers?

Sampling is the obvious reason, but not the only one. The same prompt can be processed in a different batch, on different hardware or with a different kernel. It can also reach an updated model behind an alias, or receive different tool and retrieval results. Any of these can change one token, and later tokens follow from it.

Can a random seed make LLM responses reproducible?

A seed fixes the randomness used in sampling, so it removes one source of variation. It does not fix the numbers being sampled from. OpenAI’s own guidance called seed-based determinism “best effort” and said that “determinism is not guaranteed”. Seeds also don’t carry across model versions or providers.

Do model updates affect reproducibility?

Yes. A new snapshot behind an alias is a different model. Pinning a dated or fixed snapshot avoids that, but the serving infrastructure can still change. Anthropic names infrastructure updates as the most likely cause of behaviour differences on a stable model ID. When a snapshot retires, the replacement must be re-evaluated.

How should teams evaluate nondeterministic models?

Treat each evaluation as a statistical estimate. Run tasks repeatedly, report the mean with a standard error or confidence interval, and compare models on paired questions. Scale the number of trials to the task’s variance and the decision’s importance. For agents, also categorise failures, because averages hide unsafe outliers.

Can LLM agents be made fully deterministic?

Rarely, in practice. You would need deterministic inference (fixed weights, batch-invariant kernels, fixed hardware) and frozen tools and external data. That is achievable in a controlled test harness, not across live systems. Production agents should instead be made safe under variation, using validated actions, idempotency and approval gates.


Keep reading

Enterprise AI Spending

Enterprise AI Spending Hit $177B. Agents Are Driving the Bill

Figures checked against Menlo Ventures’ 2026 State of Enterprise AI report on 4 November 2026. Market sizes are Menlo estimates, shown as annualised run rates. …
Machine Unlearning

Machine Unlearning: Can We Really Trust an Edited AI Model?

Checked against Hirundo’s and Lazarus AI’s published results, CrowdStrike’s DeepSeek-R1 study, Lawfare and the Federal Register on 4 November 2026. Ask Alibaba’s Qwen3.6-35B-A3B about Tiananmen …
Robotics Cybersecurity

Your Robot May Pass Every Test. Its Simulator Could Still Be Lying

Last checked: 3 November 2026. Vulnerability identifiers, affected projects and patch information will be updated as coordinated disclosures become public. A robot that clears every …
Model Weights

Verify Model Weights: 7 Checks Before You Download

Checked against the burner22/numbat repository and its discussions, Hugging Face and PyTorch documentation, and Moonshot AI’s announcement on 2 November 2026. On 1 November, a …

Model Card Disclosure in 2026: What AI Labs Actually Tell You

Model Card Disclosure

Open the documentation for any model released this year and you will find something. Whether you find the thing you came for depends entirely on which lab shipped it, and increasingly on which document you happened to open.

This article presents a seven-point framework for reading model-card disclosures and following their source references. It does not report a completed comparative audit.

The aim is to distinguish what a document states, what it links elsewhere and what remains unverified.

Key Takeaways

  • Use the same seven questions for each document, recording the exact version and source passage.
  • Distinguish direct disclosure from pointers to other documents.
  • Treat missing evidence as unverified rather than assigning an unsupported score.
  • Separate vendor claims, independent research and your own observations.
  • No completed four-card scoring exercise is reported here.

Quick Navigation


What a Model Card Is, and What Model Card Disclosure Now Means

What is a model card? A model card is a short structured document published alongside a machine learning model that states its intended uses, training data, evaluation results, and known limitations. The format was proposed by Margaret Mitchell and colleagues in 2019 and has since become the default unit of AI documentation.

The original proposal assumed one document would carry everything. That assumption broke in 2026. Frontier labs now publish a system card focused on pre-deployment safety evaluation, a model card focused on specifications and benchmark results, and — for anyone selling into Europe — a separate public summary of training content filed under the AI Act. These three documents overlap unevenly and almost never link to one another.

So “model card disclosure” in 2026 means something looser than it did five years ago: the sum of what a provider publishes about a model, wherever it lands. The problem for the reader is that nobody tells you which document holds which fact.


How to Review Model Card Disclosure

This article presents a seven-point checklist for reviewing model-card disclosures. It does not report a substantiated four-card audit. For each criterion, record the document version, relevant passage and linked sources, distinguishing information stated in the card from information available elsewhere.

The Seven-Point Model Card Disclosure Checklist

#ItemWhat counts as disclosed
1Training data provenanceNamed sources or source categories with indicative proportions
2Evaluation methodologyEnough detail to interpret or reproduce the reported scores
3Contamination checksA stated train-test overlap analysis
4Safety testingEvaluations run, thresholds applied, who ran them
5Stated limitationsSpecific failure modes, not generic hallucination boilerplate
6Compute usedParameter count, FLOPs, or hardware-hours
7Licence termsWeights licence and acceptable-use policy

Applying the Seven-Point Checklist

A completed comparison should include a source passage for each assessment. Use “not verified” when the available evidence does not support a judgment. No model-by-model scores are presented here.

Training Data Provenance

Which sources, categories and proportions does the document identify?

Evaluation Methodology

What information does the document provide about datasets, settings, graders and reproducibility?

Contamination Checks

Does it describe checks for overlap between training data and evaluation material?

Safety Testing

Which evaluations, thresholds and evaluators are identified?

Stated Limitations

Which specific limitations and failure modes are documented?

Compute

Which compute figures are disclosed, and what do their units measure?

Licence Terms

Which licences, usage policies and distribution terms apply?

Existing source references for further reading (not a completed review): anthropic · simonwillison · deepmind · stanford · hardware-hours. Google names TPUs as the training hardware without quantity. Inkling's 45-trillion-token pretraining figure is the only compute-adjacent number available, and it describes data volume rather than compute. · stanford

Why Model Card Disclosure Fragmented

The fragmentation has a date. The European Commission published its template for the public summary of training content on 24 July 2025, applying to new general-purpose models from 2 August 2025, with models already on the market given until 2 August 2027. Enforcement began on 2 August 2026.

Once provenance became a regulated filing with its own template, it stopped being a card section. The card kept the marketing-adjacent material — benchmarks, use cases, limitations — and the regulated material moved into a document published on a different page, usually with no link either way.

For a European compliance officer this is a nuisance. For everyone else it is a trap, because the card still looks complete.


Reference Chains Are Quietly Hollowing Out Model Card Disclosure

Reference chains need explicit review: follow a pointer and record which document supplies the information.

Check whether a reference to a predecessor describes unchanged information or supplies evidence for the specific release being assessed.

A pointer does not by itself establish that a successor was independently assessed. Preserve the referenced version and relevant passage before drawing that conclusion.

The AI Transparency Atlas study captured the general disorder from another angle, analysing five frontier models and 100 Hugging Face cards and identifying 947 unique section names, with usage information alone appearing under 97 different labels. arxiv


What the Broader Corpora Say About Model Card Disclosure

Published transparency studies provide a broader context for these review questions.

The GPAI Ledger, which archives every known Article 53(1)(d) summary with cryptographic hashes and timestamps, recorded 124 models across 31 providers on its 19 September 2026 sweep: 75 summaries published, 49 missing. The missing entries cluster at the top of the market. Google shows published summaries for Gemini 3 Pro and Gemma 4 while more than a dozen other entries — every Flash variant, Gemini Omni, the Robotics models, Veo, Imagen — sit unpublished.

The AI Accountability Lab, whose framework was accepted at FAccT 2026, graded the summaries it could find on transparency and usefulness. Its conclusion is the one that should worry large vendors: the highest-quality summaries come from small organisations and open-source efforts, which demonstrates that non-publication by larger providers is an intentional choice rather than evidence that the obligation is burdensome. Apertus, from the Swiss AI Initiative, grades A and A+. Microsoft’s Phi-4 summary grades D and F.

Stanford’s December 2025 index completes the picture. Its mean company score fell to 41 out of 100, a seventeen-point drop, with IBM at 95 and xAI and Midjourney tied at 14. The paper’s abstract states the mean as 40 against the site’s 41 — a minor discrepancy worth noting rather than smoothing over. Engagement fell alongside scores: 30% of contacted companies agreed to submit transparency reports in 2025, down from 74% in 2024. stanford


A Practical Framework for Reading Model Card Disclosure

If you evaluate models for a living, this is the order that saves time.

  1. Check for a pointer before you read. If the section says “see the previous card,” treat the item as undisclosed for this release until you follow the chain and confirm otherwise.
  2. Look for the provenance document separately. Search the provider’s linked documentation and record what you locate. An unsuccessful search is not proof that a document does not exist.
  3. Check benchmark evidence. Look for a documented overlap analysis and distinguish reported scores from independently verified performance.
  4. Read the limitations section. Record specific failure modes and whether the document supports the intended use.
  5. Separate tested from inferred. A safety claim carried over from a predecessor is a different artefact from one produced by testing the shipped model.
  6. Record what is missing, with dates. Providers revise cards without notice. A dated note of what was absent when you evaluated is the only defensible audit trail.

What Model Card Disclosure Still Cannot Tell You

A document review establishes what the documents disclose. It does not independently establish model behaviour, training-data composition or the validity of a reported benchmark. Record those limits rather than treating disclosure as experimental verification.

Frequently Asked Questions

What is a model card?

A model card is a structured document published alongside a machine learning model that describes its intended uses, training data, evaluation results, and known limitations. The format was introduced by Mitchell and colleagues in 2019. In 2026, large labs typically split this information across a model card, a system card focused on safety evaluation, and a separate regulatory filing on training content.

What is the difference between a model card and a system card?

A model card documents the model itself — architecture, data, benchmarks, limitations, licensing. A system card documents pre-deployment safety evaluation: the risk thresholds applied, the tests run, the mitigations deployed. OpenAI and Anthropic publish system cards for frontier releases; Google DeepMind publishes model cards that include a safety section. Neither format reliably includes the other’s content.

Do model cards disclose training data?

Check whether the document identifies sources or source categories and proportions, and follow any training-content-summary links. This article does not establish a result for a reviewed sample.

Why don’t AI labs disclose training compute?

Check which parameter counts, FLOPs or hardware-hours are actually disclosed. If a figure is absent, record it as unverified; do not infer the provider’s reason from that absence.

Which organisations publish the highest-quality AI documentation?

On training-data documentation specifically, the AI Accountability Lab’s graded assessment found the strongest summaries came from small organisations and open-source projects, with the Swiss AI Initiative’s Apertus scoring highest. On broader company-level transparency, Stanford’s December 2025 index placed IBM first at 95 out of 100 against a mean of 41. Scale and disclosure quality are not correlated.


Keep reading

Enterprise AI Spending

Enterprise AI Spending Hit $177B. Agents Are Driving the Bill

Figures checked against Menlo Ventures’ 2026 State of Enterprise AI report on 4 November 2026. Market sizes are Menlo estimates, shown as annualised run rates. …
Machine Unlearning

Machine Unlearning: Can We Really Trust an Edited AI Model?

Checked against Hirundo’s and Lazarus AI’s published results, CrowdStrike’s DeepSeek-R1 study, Lawfare and the Federal Register on 4 November 2026. Ask Alibaba’s Qwen3.6-35B-A3B about Tiananmen …
Robotics Cybersecurity

Your Robot May Pass Every Test. Its Simulator Could Still Be Lying

Last checked: 3 November 2026. Vulnerability identifiers, affected projects and patch information will be updated as coordinated disclosures become public. A robot that clears every …
Model Weights

Verify Model Weights: 7 Checks Before You Download

Checked against the burner22/numbat repository and its discussions, Hugging Face and PyTorch documentation, and Moonshot AI’s announcement on 2 November 2026. On 1 November, a …