On the off chance you aren't trolling, lets imagine the "easiest" possible scenario for detecting a cheater.  

Lets assume all miners use "perfect" hardware.  Once they start a unit of work, they always check all nonce values (0% unchecked nonces), they always increment ntime rolling by one second and one second only (0% unchecked seconds), and they never have any errors have any hardware errors (either reported or not reported). 

Your pool sends test work to 10% of your users and waits 6 seconds (roughly 1% increase in orphan rate) for a response and then broadcast the block.

The miner in question:
a) returns the test work prior to broadcasting the block.
b) returns the test work but after you had broadcast the block.
c) does not return the test work.

In each scenario is the miner cheating or not?

I think you would agree that this scenario is about as simplistic as possible.   Right?  The real world is far more chaotic but this simplistic scenario takes ASIC complexity out of the picture.  The reality is you can not conclusively say if the miner is or is not cheating in any of those three scenarios.