{"slug": "the-more-it-says-the-more-you-pay-a-black-box-audit-of-token-inflation-in-llm", "title": "The More It Says, the More You Pay: A Black-Box Audit of Token Inflation in LLM", "summary": "A September 17, 2026 arXiv paper defines a Provider-Side Token Inflation Attack (PTIA) in which pay-per-token LLM providers covertly manipulate generation to inflate output tokens, with five representative attacks at the query, prompt, representation, and model levels each increasing mean output length to more than 10.2x the clean baseline. The authors design a lightweight single-probe audit that exploits PTIA saturation, achieving an average detection rate of 85.1% with false-positive rates below 2% across four open-weight models, and flagging 7 of 15 real LLM API services for PTIA-consistent behavior.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 17 Sep 2026]\n\n# Title:The More It Says, the More You Pay: A Black-Box Audit of Provider-Side Token Inflation in LLM Services\n\n[View PDF](https://arxiv.org/pdf/2609.20370)\n\n[HTML (experimental)](https://arxiv.org/html/2609.20370v1)\n\nAbstract:In pay-per-token LLM services, the more a model says, the more users pay. Dishonest providers can covertly manipulate generation to inflate output tokens while largely preserving task utility. We define such manipulation as a Provider-Side Token Inflation Attack (PTIA) and instantiate five representative attacks at the query, prompt, representation, and model levels of the provider-controlled pipeline. Our experiments show that each attack increases mean output length to more than 10.2x the clean baseline, demonstrating PTIA's financial appeal and feasibility at multiple stages of generation. Yet auditing PTIA from black-box responses is difficult for users. Our key observation is PTIA saturation: an initial attack sharply lengthens output, but further strengthening or composition has much less effect. We trace this saturation to stopping behavior: an initial PTIA sharply lowers the end-of-sequence token probability, whereas further intervention lowers it only marginally. Building on this insight, we design a lightweight single-probe audit that applies a controlled lengthening intervention. Under PTIA, the probe induces far fewer additional tokens than under normal service. The audit requires neither a trusted local reference model nor historical clean responses, and its separately issued original and probed requests resemble ordinary traffic, making evasion difficult. Across four open-weight models, it achieves an average detection rate of 85.1% with false-positive rates below 2%. Across 15 real LLM API services, the audit flags 7 for PTIA-consistent behavior.\n    \n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/the-more-it-says-the-more-you-pay-a-black-box-audit-of-token-inflation-in-llm", "canonical_source": "https://arxiv.org/abs/2609.20370", "published_at": "2026-09-18 07:07:12+00:00", "updated_at": "2026-09-18 07:25:09.075231+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-safety", "ai-policy", "ai-research"], "entities": ["arXiv", "Provider-Side Token Inflation Attack", "PTIA"], "alternates": {"html": "https://wpnews.pro/news/the-more-it-says-the-more-you-pay-a-black-box-audit-of-token-inflation-in-llm", "markdown": "https://wpnews.pro/news/the-more-it-says-the-more-you-pay-a-black-box-audit-of-token-inflation-in-llm.md", "text": "https://wpnews.pro/news/the-more-it-says-the-more-you-pay-a-black-box-audit-of-token-inflation-in-llm.txt", "jsonld": "https://wpnews.pro/news/the-more-it-says-the-more-you-pay-a-black-box-audit-of-token-inflation-in-llm.jsonld"}}