An attack where the seller is the attacker
Almost every commercial language model is sold by the token, and almost every customer takes the provider’s word for how many tokens were produced. A paper submitted to arXiv on 17 September asks what happens if the provider quietly makes the model say more.
The authors — Leilei Chen, Lan Zhang, Chen Tang, Pengcheng Sun, Jiewei Lai, Yixiao Huang, Zhaopeng Zhang and Xinpeng Shen — call it a provider-side token inflation attack, or PTIA, and set out five variants. Each one lengthens the output without degrading the answer enough for a user to notice.
How far it goes, and where it stops
The paper reports that each attack pushed mean output length to more than 10.2 times the clean baseline. That is the headline number, and it is the reason the question matters commercially: a tenfold increase in output tokens is a tenfold increase in the part of the bill that is hardest for a customer to verify.
The more useful finding is that the attacks saturate. The initial lengthening is dramatic, but pushing harder yields diminishing returns, because the model’s stopping behaviour reasserts itself. That regularity is what the authors turn into a detector.
An audit with nothing to compare against
The hard part of catching this is that a customer has no clean reference. They cannot run the same model locally, and they have no archive of known-honest responses from before the attack started.
The authors’ audit needs neither. They report an average detection rate of 85.1% with false-positive rates below 2%, across the scenarios they test. Those are the paper’s own figures, from its own evaluation, and they have not been reproduced independently.
Seven out of fifteen
The authors then ran the audit against 15 real language model API services. It flagged seven of them for behaviour consistent with token inflation.
That phrasing matters. Behaviour consistent with an attack is not the same as an attack. Verbose system prompts, a default reasoning mode, a model tuned to pad, or a decoding configuration that simply favours length would all produce output the audit could read the same way. The paper is not evidence that seven named providers overcharged anyone, and it does not present itself as that.
What it does establish is that the behaviour is detectable from the outside, at all, and that on a fleet of real services something shows up.
What to watch
The practical consequence is a governance one. Enterprise contracts for model inference are written on metered usage that the vendor measures, without an independent meter. This paper is an argument that such a meter is buildable. Whether procurement teams start asking for one, and whether any provider volunteers a verifiable token count, is what to watch next.
