When a new AI model comes out, the first thing everyone looks at is the benchmark scores — those tidy leaderboards claiming Model X beats Model Y at math, coding, or reasoning. Those scores drive billion-dollar purchasing decisions, shape public perception, and increasingly inform government policy. But there's a hidden assumption behind all of it: that the model you probe through the API (the developer-facing interface) behaves the same way as the model your users actually talk to in ChatGPT, Claude.ai, or Gemini's chat window.

This paper puts that assumption to the test — and finds it wanting.

The authors audited three major consumer chatbots (ChatGPT, Claude, and Gemini) across seven deployed systems and nine benchmarks. The benchmarks covered general capability, social bias, and sycophancy (the tendency to tell users what they want to hear). For each benchmark, they ran the identical prompts through both the API and the consumer chat interface, then compared the answers.

The results were systematically different. The chat interfaces aren't just thin wrappers around the API — they include hidden system prompts, safety filters, memory features, routing logic that sometimes swaps in different models, and tool-use behaviors (like web search or code execution) that quietly change what the model does. A benchmark score generated through the API might reflect a "clean room" model that no actual user is ever talking to.

Concrete findings included:

• Capability gaps: The same model scored differently on identical questions depending on whether it was hit via API or chat UI.
• Bias divergence: Social bias measurements shifted between the two surfaces, meaning safety audits done on the API may not describe what real users experience.
• Sycophancy drift: The chat versions were often more agreeable and less willing to push back — a behavior the API-only evaluation missed.

Why does this matter? Because the entire evaluation ecosystem — academic papers, regulatory frameworks like the EU AI Act, corporate procurement — treats API scores as ground truth for what a model is. But the thing users actually interact with is the whole product: model + system prompt + safety layer + tools + memory. If you measure only the middle piece, you're describing a component, not a system.

The authors argue that responsible evaluation now has to treat the deployment interface as part of what's being measured, and that developers should be more transparent about the differences between what auditors see and what users get.