A dishonest model provider can inflate your output tokens more than 10x, and one probe catches it.

arXiv 2609.20370 defines the Provider-Side Token Inflation Attack and builds five variants at the query, prompt, representation and model levels of a provider-controlled pipeline, each raising mean output length above 10.2x the clean baseline while largely preserving task utility. The attack saturates: the first intervention sharply drops end-of-sequence probability and further stacking barely moves it. That saturation is the audit. A single-probe test applies a controlled lengthening intervention and needs no trusted local reference model and no historical clean responses.