Per-token billing is now the standard pricing model for commercial large language models (LLMs), so the honesty of reported token counts directly affects what users pay. We show that this kind of billing is hard to audit by design: providers hide the model, the tokenizer, and the execution to protect their IP, mitigate jailbreaks, and preserve user privacy, which means an auditor can only inspect proofs the provider supplies. The audit therefore reduces to a consistency check on the provider's own reports. We call this a trust paradox: every audit must trust some artifact, but current frameworks trust exactly the ones a provider has the strongest reason to manipulate. We study three recent token auditing frameworks and show that a provider with ordinary commercial capabilities can systematically inflate billed token counts. In the most permissive setting, hidden reasoning usage can be inflated by 1,469% on average without detection. At current frontier reasoning prices, that turns a \$100 honest bill into roughly a \$1,569 bill on the same query. Even when the user can see the full reasoning string, tokenization ambiguity alone still allows 50.85% over-reporting below the detection threshold. These results suggest the problem is not in any specific auditor but in any audit whose evidence comes from the audited party. Restoring honest billing will require verification that ties reported token counts to evidence the provider does not control, such as trusted execution attestation, cryptographic proofs of inference, or third-party re-execution.

翻译：按令牌计费已成为商用大型语言模型（LLM）的标准定价模式，因此报告令牌数的诚实性直接关系到用户的支付金额。我们发现，这种计费方式在设计上难以审计：提供商为保护知识产权、减少越狱攻击以及维护用户隐私，会隐藏模型、分词器及执行细节，这意味着审计者只能检查提供商提供的证据。因此，审计退化对提供商自身报告的一致性检验。我们称此为信任悖论：每次审计必须信任某个工件，但现有框架恰恰信任了提供商最有可能操纵的工件。我们研究了近期的三种令牌审计框架，并证明一个拥有普通商业能力的提供商能够系统地虚增账单令牌数。在最宽松的设置下，隐藏推理用量可被平均虚增1469%而不被发现。以当前前沿推理价格计算，这会使同一查询的诚实账单从100美元变为约1569美元。即使用户能看到完整推理字符串，仅分词歧义就可在检测阈值下实现50.85%的超额报告。这些结果表明问题不在于特定审计器，而在于任何证据来自被审计方的审计系统。恢复诚实计费需要将报告令牌数与提供商无法控制的证据（如可信执行证明、推理的加密证明或第三方重新执行）相关联的验证机制。