I will sniff the outgoing traffic to see if there is something like this. But i think Claymore use other tricks to spot a cheater. Because all the devfee work is referenced with the same worker name. (see here https://eth.nanopool.org/account/0xc1c427cd8e6b7ee3b5f30c2e1d3f3c5536ec16f5 ) So he can't differentiate the status afterwards.
If someone have an idea how can we make sure we are not detected as cheater (except rely on the pool, which is fluctuant on luck) or what are the technique used to spot the cheat, i'm very interested for an alternate open-source project.