"AT&T may, but is not required to, monitor your compliance, or the compliance of other subscribers, with AT&T's terms, conditions, or policies"
And, of course, it's now well-known that the government WAS using deep packet inspection on AT&T internet traffic.
I would assume they're just looking at how much you download in a month, though. I don't think AT&T is worried about offending outliers using large amounts of mobile data by inaccurately accusing them of tethering.
Requesting non-mobile versions of sites that do not have the option
User Agent strings such as "Internet Explorer" or "Safari" in HTTP requests
Sending screen sizes via relatively common web calls
The use of UA-Pixels at all, especially when specifying large screen sizes.
Use of protocols that are only seen in desktop OS programs (ventrilo, starcraft2, etc for instance is one that should be a good detector).