Is Your LLM Overcharging You? Tokenization, Transparency, and Incentives

State-of-the-art large language models require specialized hardware and substantial energy to operate. Consequently, cloud-based services that provide access to these models have become very popular. In these services, the price users pay depends on the number of tokens a model uses to generate an output–they pay a fixed price per token. In this work, we show that this pricing mechanism creates a financial incentive for providers to strategize and misreport the (number of) tokens a model used to generate an output, and users cannot prove, or even know, whether a provider is overcharging them. However, we also show that, if an unfaithful provider is obliged to be transparent about the generative process used by the model, misreporting optimally without raising suspicion is hard. Nevertheless, as a proof-of-concept, we develop an efficient heuristic algorithm that allows providers to significantly overcharge users without raising suspicion. Crucially, the cost of running the algorithm is lower than the additional revenue from overcharging users, highlighting the vulnerability of users under the current pay-per-token pricing mechanism. Further, we show that, to eliminate the financial incentive to strategize, a pricing mechanism must price tokens linearly on their character count. While this makes a provider's profit margin vary across tokens, we introduce a simple prescription that allows a provider to maintain their average profit margin when transitioning to an incentive-compatible pricing mechanism. To complement our theoretical results, we conduct experiments with large language models from the $\texttt{Llama}$, $\texttt{Gemma}$ and $\texttt{Ministral}$ families, and prompts from a popular benchmarking platform.

When you use an AI chatbot through a cloud service, you pay based on how many "tokens" the model produces — the small chunks, often pieces of words, that language models use to build text. However, the same response can be split into tokens in many different ways. For example, the word "Damascus" could be a single token, or as four ("Da", "ma", "s", "cus"), and you, as the user, have no way to verify which split the model really used. We show that this hidden flexibility gives providers a financial incentive to overcharge customers by reporting longer token counts than what their model actually generated. As a proof of concept, we built an algorithm showing how a provider could do this profitably without raising suspicion. To eliminate this incentive entirely, we prove that the only fair pricing scheme is one that charges per character of text rather than per token. Switching to pay-per-character would protect users from being silently overcharged, and as a side benefit, it would partially correct an existing unfairness for speakers of non-English languages, whose text tends to be split into more tokens than English.