Claymore has a check on third share to his DevFee address, if it doesn't go to his address something happens (lower hashrate) or something like that, I am not sure, just a guess.
I will sniff the outgoing traffic to see if there is something like this. But i think Claymore use other tricks to spot a cheater. Because all the devfee work is referenced with the same worker name. (see here
https://eth.nanopool.org/account/0xc1c427cd8e6b7ee3b5f30c2e1d3f3c5536ec16f5 ) So he can't differentiate the status afterwards.
If someone have an idea how can we make sure we are not detected as cheater (except rely on the pool, which is fluctuant on luck) or what are the technique used to spot the cheat, i'm very interested for an alternate open-source project.