[{"data":1,"prerenderedAt":798},["ShallowReactive",2],{"navigation":3,"\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality":293,"\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality-surround":538},[4,8,17,21,25,29,33,37,281,285,289],{"title":5,"path":6,"stem":7},"About Thinkata Intelligence","\u002Fabout","about",{"title":9,"path":10,"stem":11,"children":12},"Authentication","\u002Fauth","auth",[13],{"title":14,"path":15,"stem":16},"Email Confirmation","\u002Fauth\u002Fconfirmation","auth\u002Fconfirmation",{"title":18,"path":19,"stem":20},"Case Studies","\u002Fcase-studies","case-studies",{"title":22,"path":23,"stem":24},"Contact Us","\u002Fcontact","contact",{"title":26,"path":27,"stem":28},"Thinkata - Advanced AI Engineering & Multi-Agent System Solutions","\u002F","index",{"title":30,"path":31,"stem":32},"Insights","\u002Finsights","insights",{"title":34,"path":35,"stem":36},"Leadership","\u002Fleadership","leadership",{"title":38,"path":39,"stem":40,"children":41},"News","\u002Fnews","news",[42,45,69],{"title":43,"path":39,"stem":44},"News & Insights","news\u002Findex",{"title":18,"path":46,"stem":47,"children":48},"\u002Fnews\u002Fcase-studies","news\u002Fcase-studies",[49,53,57,61,65],{"title":50,"path":51,"stem":52},"Building Secure and Scalable AI Infrastructure: Integrating with Existing Systems through Modern Cloud Frameworks","\u002Fnews\u002Fcase-studies\u002Fcloud-infrastructure-ai","news\u002Fcase-studies\u002Fcloud-infrastructure-ai",{"title":54,"path":55,"stem":56},"Making Sense of Financial Regulations: How AI Teams Can Tackle Complex Documents","\u002Fnews\u002Fcase-studies\u002Ffinancial-regulations","news\u002Fcase-studies\u002Ffinancial-regulations",{"title":58,"path":59,"stem":60},"AI-Powered Transformations in Healthcare","\u002Fnews\u002Fcase-studies\u002Fhealth-care","news\u002Fcase-studies\u002Fhealth-care",{"title":62,"path":63,"stem":64},"Generative AI in Upstream Natural Gas: Shell's Exploration Initiative","\u002Fnews\u002Fcase-studies\u002Foil-gas","news\u002Fcase-studies\u002Foil-gas",{"title":66,"path":67,"stem":68},"Optimizing Manufacturing with AI-Driven Multi-Agent Systems","\u002Fnews\u002Fcase-studies\u002Fsupply-chain-optimization","news\u002Fcase-studies\u002Fsupply-chain-optimization",{"title":30,"path":70,"stem":71,"children":72},"\u002Fnews\u002Finsights","news\u002Finsights",[73,77,81,85,89,93,97,101,105,109,113,117,121,125,129,133,137,141,145,149,153,157,161,165,169,173,177,181,185,189,193,197,201,205,209,213,217,221,225,229,233,237,241,245,249,253,257,261,265,269,273,277],{"title":74,"path":75,"stem":76},"The Capability-Reliability Split in Agent Systems","\u002Fnews\u002Finsights\u002Fagent-capability-reliability-split","news\u002Finsights\u002Fagent-capability-reliability-split",{"title":78,"path":79,"stem":80},"The Rise of AI Agents in Cyberattacks: Latest Research and Threats","\u002Fnews\u002Finsights\u002Fai-agent-cyber-threats","news\u002Finsights\u002Fai-agent-cyber-threats",{"title":82,"path":83,"stem":84},"The Smart Enterprise AI Stack: Why Teams of AI Agents Beat Solo Models Consistently","\u002Fnews\u002Finsights\u002Fai-architecture","news\u002Finsights\u002Fai-architecture",{"title":86,"path":87,"stem":88},"When Seeing Everything Becomes the Only Option","\u002Fnews\u002Finsights\u002Fai-comprehensive-observability","news\u002Finsights\u002Fai-comprehensive-observability",{"title":90,"path":91,"stem":92},"The Data Infrastructure AI-Native Systems Can't Ignore","\u002Fnews\u002Finsights\u002Fai-data-layer","news\u002Finsights\u002Fai-data-layer",{"title":94,"path":95,"stem":96},"Enterprise AI Triage Systems: Intelligent Automation for Large-Scale Operations","\u002Fnews\u002Finsights\u002Fai-enterprise-triage","news\u002Finsights\u002Fai-enterprise-triage",{"title":98,"path":99,"stem":100},"When Oversight Becomes Infrastructure","\u002Fnews\u002Finsights\u002Fai-governed-autonomy","news\u002Finsights\u002Fai-governed-autonomy",{"title":102,"path":103,"stem":104},"Designing for Graceful Failure in Compound AI Systems","\u002Fnews\u002Finsights\u002Fai-graceful-failure","news\u002Finsights\u002Fai-graceful-failure",{"title":106,"path":107,"stem":108},"Intelligent Composability: Building AI Systems Like Orchestra, Not Soloists","\u002Fnews\u002Finsights\u002Fai-intelligent-composability","news\u002Finsights\u002Fai-intelligent-composability",{"title":110,"path":111,"stem":112},"Building the Plane While Flying It — Migrating from Monolith to AI-Native Without Stopping","\u002Fnews\u002Finsights\u002Fai-migration-path","news\u002Finsights\u002Fai-migration-path",{"title":114,"path":115,"stem":116},"Stability Through Continuous Adaptation","\u002Fnews\u002Finsights\u002Fai-native-overview","news\u002Finsights\u002Fai-native-overview",{"title":118,"path":119,"stem":120},"Provable Stability: Mathematical Guarantees for Adaptive AI Systems","\u002Fnews\u002Finsights\u002Fai-provable-stability","news\u002Finsights\u002Fai-provable-stability",{"title":122,"path":123,"stem":124},"How Temperature Tuning Makes or Breaks Reinforcement Learning","\u002Fnews\u002Finsights\u002Fai-soft-actor-critic-entropy-collapse","news\u002Finsights\u002Fai-soft-actor-critic-entropy-collapse",{"title":126,"path":127,"stem":128},"Testing What Can't Be Predicted","\u002Fnews\u002Finsights\u002Fai-systems-testing","news\u002Finsights\u002Fai-systems-testing",{"title":130,"path":131,"stem":132},"Closing the Loop: How Human Corrections Can Make AI Systems Smarter Over Time","\u002Fnews\u002Finsights\u002Fclosing-the-loop","news\u002Finsights\u002Fclosing-the-loop",{"title":134,"path":135,"stem":136},"Multi-Path Reasoning: Collaborative and Competitive Approaches in AI","\u002Fnews\u002Finsights\u002Fcollaborative-competitive-agents","news\u002Finsights\u002Fcollaborative-competitive-agents",{"title":138,"path":139,"stem":140},"Why Challenges Supercharge Smarts for Humans and AI","\u002Fnews\u002Finsights\u002Fcompetition-improves-ai","news\u002Finsights\u002Fcompetition-improves-ai",{"title":142,"path":143,"stem":144},"Context is Infrastructure, Not Instructions","\u002Fnews\u002Finsights\u002Fcontext-is-infrastructure","news\u002Finsights\u002Fcontext-is-infrastructure",{"title":146,"path":147,"stem":148},"Context is the New Code","\u002Fnews\u002Finsights\u002Fcontext-is-new-code","news\u002Finsights\u002Fcontext-is-new-code",{"title":150,"path":151,"stem":152},"Continuous Thought Machines","\u002Fnews\u002Finsights\u002Fcontinuous-thought-machines","news\u002Finsights\u002Fcontinuous-thought-machines",{"title":154,"path":155,"stem":156},"Don't Vibe, Architect","\u002Fnews\u002Finsights\u002Fdont-vibe-architect","news\u002Finsights\u002Fdont-vibe-architect",{"title":158,"path":159,"stem":160},"The Edge of the Underdefined","\u002Fnews\u002Finsights\u002Fedge-of-the-underdefined","news\u002Finsights\u002Fedge-of-the-underdefined",{"title":162,"path":163,"stem":164},"Experts All the Way Down","\u002Fnews\u002Finsights\u002Fexperts-all-the-way","news\u002Finsights\u002Fexperts-all-the-way",{"title":166,"path":167,"stem":168},"A Multi-Tier Safety Architecture for Critical Applications","\u002Fnews\u002Finsights\u002Ffour-tier-architecture","news\u002Finsights\u002Ffour-tier-architecture",{"title":170,"path":171,"stem":172},"Green Dashboard, Unhappy Users","\u002Fnews\u002Finsights\u002Fgreen-dashboard-unhappy-users","news\u002Finsights\u002Fgreen-dashboard-unhappy-users",{"title":174,"path":175,"stem":176},"Hybrid Autoregressive Residual Tokens","\u002Fnews\u002Finsights\u002Fhart-model","news\u002Finsights\u002Fhart-model",{"title":178,"path":179,"stem":180},"Hierarchical Reasoning in Artificial Intelligence","\u002Fnews\u002Finsights\u002Fhierarchical-approaches","news\u002Finsights\u002Fhierarchical-approaches",{"title":182,"path":183,"stem":184},"Latent Diffusion for Language Generation: A Comprehensive Overview","\u002Fnews\u002Finsights\u002Flatent-diffusion-for-language","news\u002Finsights\u002Flatent-diffusion-for-language",{"title":186,"path":187,"stem":188},"Breaking Language Barriers: How AI Can Translate Without Examples","\u002Fnews\u002Finsights\u002Flearning-languages","news\u002Finsights\u002Flearning-languages",{"title":190,"path":191,"stem":192},"The Emergence of AI Deception: How Large Language Models Have Learned to Strategically Mislead Users","\u002Fnews\u002Finsights\u002Fllm-deception","news\u002Finsights\u002Fllm-deception",{"title":194,"path":195,"stem":196},"Grading on a Shared Curve","\u002Fnews\u002Finsights\u002Fllm-judge-correlated-errors","news\u002Finsights\u002Fllm-judge-correlated-errors",{"title":198,"path":199,"stem":200},"Synergizing Specialized Reasoning and General Capabilities in AI","\u002Fnews\u002Finsights\u002Fllm-reasoning-advances","news\u002Finsights\u002Fllm-reasoning-advances",{"title":202,"path":203,"stem":204},"The Expensive Default","\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality","news\u002Finsights\u002Fllm-routing-cost-quality",{"title":206,"path":207,"stem":208},"The AI That Rewrites Itself: MIT's Breakthrough in Self-Adapting Language Models","\u002Fnews\u002Finsights\u002Fllm-seal","news\u002Finsights\u002Fllm-seal",{"title":210,"path":211,"stem":212},"Metacognitive Reinforcement Learning for Self-Improving AI Systems","\u002Fnews\u002Finsights\u002Fmetacognitive-reinforcement-learning","news\u002Finsights\u002Fmetacognitive-reinforcement-learning",{"title":214,"path":215,"stem":216},"Revolutionary Advancements in Mixture of Experts (MoE) Architectures","\u002Fnews\u002Finsights\u002Fmixture-of-experts","news\u002Finsights\u002Fmixture-of-experts",{"title":218,"path":219,"stem":220},"One Model, Many Customers, and the Leak Nobody Tests For","\u002Fnews\u002Finsights\u002Fmulti-tenant-ai-isolation","news\u002Finsights\u002Fmulti-tenant-ai-isolation",{"title":222,"path":223,"stem":224},"Balancing Neural Plasticity and Stability","\u002Fnews\u002Finsights\u002Fneural-plasticity","news\u002Finsights\u002Fneural-plasticity",{"title":226,"path":227,"stem":228},"Offline RL and the Data Flywheel","\u002Fnews\u002Finsights\u002Foffline-rl-data-flywheel","news\u002Finsights\u002Foffline-rl-data-flywheel",{"title":230,"path":231,"stem":232},"Reasoning You Can Check","\u002Fnews\u002Finsights\u002Freasoning-you-can-check","news\u002Finsights\u002Freasoning-you-can-check",{"title":234,"path":235,"stem":236},"When Optimization Optimizes Itself","\u002Fnews\u002Finsights\u002Frecursive-goodhart","news\u002Finsights\u002Frecursive-goodhart",{"title":238,"path":239,"stem":240},"Reward Design as Architecture","\u002Fnews\u002Finsights\u002Freward-design-as-architecture","news\u002Finsights\u002Freward-design-as-architecture",{"title":242,"path":243,"stem":244},"When Success Has No Author: The Temporal Credit Assignment Problem","\u002Fnews\u002Finsights\u002Frl-credit-assignment-problem","news\u002Finsights\u002Frl-credit-assignment-problem",{"title":246,"path":247,"stem":248},"Beyond Entropy Collapse: When Exploration Succeeds but Learning Fails","\u002Fnews\u002Finsights\u002Frl-optimization-gaps","news\u002Finsights\u002Frl-optimization-gaps",{"title":250,"path":251,"stem":252},"The Path to Practical Confidential Computing for AI Systems","\u002Fnews\u002Finsights\u002Fsecure-ai-architectures","news\u002Finsights\u002Fsecure-ai-architectures",{"title":254,"path":255,"stem":256},"Guess First, Check Later","\u002Fnews\u002Finsights\u002Fspeculative-execution-pattern","news\u002Finsights\u002Fspeculative-execution-pattern",{"title":258,"path":259,"stem":260},"Spiking Neural Networks for Energy-Efficient AI","\u002Fnews\u002Finsights\u002Fspiking-neural-networks","news\u002Finsights\u002Fspiking-neural-networks",{"title":262,"path":263,"stem":264},"The Turn as the Unit of Quality","\u002Fnews\u002Finsights\u002Fstructured-iteration-quality","news\u002Finsights\u002Fstructured-iteration-quality",{"title":266,"path":267,"stem":268},"AI Speech Translation: Breaking Down Language Barriers","\u002Fnews\u002Finsights\u002Fsts-performance-advances","news\u002Finsights\u002Fsts-performance-advances",{"title":270,"path":271,"stem":272},"Test-Time Training Layers: The Next Evolution in Transformer Architecture","\u002Fnews\u002Finsights\u002Ftest-time-training-layers","news\u002Finsights\u002Ftest-time-training-layers",{"title":274,"path":275,"stem":276},"Breakthrough: Large Language Models Pass the Turing Test","\u002Fnews\u002Finsights\u002Fturing-tests","news\u002Finsights\u002Fturing-tests",{"title":278,"path":279,"stem":280},"Training in a World That Does Not Exist Yet","\u002Fnews\u002Finsights\u002Fworld-models-as-infrastructure","news\u002Finsights\u002Fworld-models-as-infrastructure",{"title":282,"path":283,"stem":284},"Privacy Policy","\u002Fprivacy","privacy",{"title":286,"path":287,"stem":288},"Research","\u002Fresearch","research",{"title":290,"path":291,"stem":292},"Terms of Service","\u002Fterms","terms",{"id":294,"title":202,"body":295,"date":520,"description":521,"extension":522,"image":523,"meta":524,"navigation":535,"path":203,"seo":536,"stem":204,"__hash__":537},"insights\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality.md",{"type":296,"value":297,"toc":511},"minimark",[298,317,327,331,350,354,360,370,380,384,390,400,408,412,420,431],[299,300,303,304,303,310],"div",{"className":301},[302],"page-title","\n  ",[305,306,202],"h1",{"className":307,"id":309},[308],"page-title__main","the-expensive-default",[311,312,316],"h2",{"className":313,"id":315},[314],"page-title__sub","llm-routing-promises-to-send-easy-questions-to-cheap-models-and-research-keeps-finding-it-reaches-for-the-expensive-one-instead","LLM routing promises to send easy questions to cheap models, and research keeps finding it reaches for the expensive one instead",[299,318,320,321],{"style":319},"width: 100%; padding: 2%;","\n    ",[322,323],"img",{"src":324,"alt":325,"style":326},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1744745439306-f16d00620b38?w=1200&auto=format&fit=crop","A cluster of directional signs on a single post pointing toward many different destinations, standing in for the decision a production AI system faces on every incoming request, which of several available models should handle this one","width: 100%; height: auto;",[328,329,330],"p",{},"Every product built on a large language model eventually runs into a question that has nothing to do with prompts or fine-tuning. A request arrives, and something has to decide which model answers it. Send everything to the most capable model available and the bill grows in proportion to traffic, whether or not the traffic needed that much capability. Send everything to a cheaper model and some fraction of users get worse answers than the product could have given them.",[328,332,333,334,342,343,349],{},"The engineering answer to that tradeoff is a router, a lightweight system placed in front of the language models that reads each incoming request and assigns it to one of them. Early academic work on this problem found that many questions do not need the strongest available model at all. A quality-aware router trained to send only the harder queries to a large model reduced calls to that model by up to 40 percent with no measurable drop in response quality ",[335,336,337],"sup",{},[338,339,341],"a",{"href":340},"#source-1","[1]",". A follow-up framework refined the idea using human preference data collected from model comparisons, and on one benchmark it matched 95 percent of a strong model's score while sending only 13.4 percent of requests to that model ",[335,344,345],{},[338,346,348],{"href":347},"#source-2","[2]",". The premise looked sound. Most requests are easier than the hardest request a product will ever see, and a router that can tell the difference should save money without anyone noticing.",[311,351,353],{"id":352},"reaching-for-the-expensive-model-anyway","Reaching for the Expensive Model Anyway",[299,355,320,356],{"style":319},[322,357],{"src":358,"alt":359,"style":326},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1740560516658-5a94b0b715ed?w=1200&auto=format&fit=crop","A mercury thermometer planted in sand against a blue sky, its red column climbing toward the top of the scale, standing in for a routing system that keeps escalating toward its most expensive, most capable model even when a lower reading would perform just as well",[328,361,362,363,369],{},"Deployed routers turn out to behave differently from the ones described in the papers that introduced the idea. A 2026 study tracking router behavior as the allowed budget per query increases found something researchers had not previously isolated as a distinct failure. Instead of spreading requests across the available models based on difficulty, the call rate of the single most expensive model climbs steadily and eventually saturates near 100 percent, the reading pushed toward the top of the scale regardless of whether the query in front of it needed that much, even though a hindsight-optimal router on the same benchmark uses that model for fewer than 20 percent of queries under the same budget ",[335,364,365],{},[338,366,368],{"href":367},"#source-3","[3]",". The researchers behind that finding named it routing collapse, and traced the cause to something structural rather than a training bug. Most queries have several models bunched close together in quality, and when the top two or three candidates are nearly tied, a routing model's small prediction errors are enough to flip which one looks best. As the budget grows and more models become affordable, that instability consistently pulls the decision toward the strongest, most expensive option, because a router comparing near-ties has no reliable way to settle on the cheaper one instead.",[328,371,372,373,379],{},"The opposite failure shows up just as often. A benchmark spanning more than 400,000 queries across 21 datasets and 33 models found that current routers, even ones sold as commercial products, still fail to land on the one correct model for a meaningful slice of requests. On the subset of test queries where only one to three of the available models could answer correctly, two widely used routing methods hit just 23 to 25 percent accuracy at identifying which one ",[335,374,375],{},[338,376,378],{"href":377},"#source-4","[4]",". So a router can spend too much by defaulting to the strongest model when it did not need to, and separately miss the model that actually had the right answer when specificity mattered. Both problems come from the same root cause. Comparing models that perform almost identically on most requests is a harder discrimination task than comparing models with a wide quality gap, and most real traffic falls into the first category.",[311,381,383],{"id":382},"naming-the-target-instead-of-guessing","Naming the Target Instead of Guessing",[299,385,320,386],{"style":319},[322,387],{"src":388,"alt":389,"style":326},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1629122433131-53e850a3a2ce?w=1200&auto=format&fit=crop","A round target with several arrows clustered around, but not on, the center ring, standing in for the scatter that results when a routing system is tuned through indirect proxies instead of being told exactly where the target sits",[328,391,392,393,399],{},"Most routers ask an operator to set an indirect parameter, a cost threshold or a confidence cutoff, and observe afterward what accuracy that setting happened to produce. The result lands somewhere near the outcome the operator wanted, rarely exactly on it. One router built specifically against this complaint takes the opposite approach, accepting a target accuracy as a direct input rather than something inferred from unrelated knobs ",[335,394,395],{},[338,396,398],{"href":397},"#source-5","[5]",". Internally it tracks how far recent decisions have drifted from the requested target and adjusts its own aggressiveness in real time, letting a single trained system serve a whole range of accuracy requirements without retraining for each one.",[328,401,402,403,407],{},"The reported results suggest the direct-target approach closes much of the gap described above. Tested against a baseline that also tried to enforce a minimum accuracy level, the target-based router met its stated floor consistently, where the baseline met it only 22 percent of the time. On one benchmark it reached within 1.3 percent of the best achievable accuracy while cutting cost by as much as 89.8 percent compared to always using the strongest model ",[335,404,405],{},[338,406,398],{"href":397},". The gain is not that the underlying models changed. It is that the system was finally asked to hold a specific, checkable commitment instead of a proxy for one.",[311,409,411],{"id":410},"where-the-discipline-has-to-live","Where the Discipline Has to Live",[328,413,414,415,419],{},"Cost and quality are not the only axis worth tracking, and treating them as the whole problem hides a third variable that shows up the moment routing decisions reach production. Two models can score almost identically on both accuracy and price and still differ enormously in how long a response takes to arrive. One documented pair produced comparable results at comparable cost with response times of 32 seconds and 262 seconds ",[335,416,417],{},[338,418,378],{"href":377},". A router optimizing on two dimensions has no way to notice that gap, and a user waiting eight times longer for an equivalent answer will notice it regardless of what the router's dashboard says about savings.",[328,421,422,423,427,428,430],{},"None of this argues against routing. It argues against treating a cost threshold as a stand-in for the outcome a product actually promises its users. A routing layer is only as trustworthy as the evaluation underneath it, the same argument that applies to any system where one model's output stands in for a judgment about quality ",[335,424,425],{},[338,426,348],{"href":347},", a point explored further in ",[338,429,194],{"href":195},". A platform doing model routing should treat the accuracy floor as the product commitment and the routing table as the implementation detail underneath it, not the other way around. The question worth asking before shipping a router is not how much it saves on average. It is what happens on the request where the cheap model was wrong and nobody was checking.",[299,432,303,436,303,439],{"className":433},[434,435],"references","mt-8",[311,437,438],{"id":434},"References",[440,441,320,447,320,465,320,477,320,489,320,501,303],"ol",{"className":442},[443,444,445,446],"list-decimal","list-inside","space-y-2","mt-4",[448,449,451,452,456,457],"li",{"id":450},"source-1","D. Ding, A. Mallick, C. Wang, R. Sim, S. Mukherjee, V. Rühle, L. V. S. Lakshmanan, and A. H. Awadallah, \"Hybrid LLM: Cost-Efficient and Quality-Aware Query Routing,\" in ",[453,454,455],"em",{},"Proc. Twelfth International Conference on Learning Representations (ICLR 2024)",", 2024. ",[338,458,464],{"href":459,"target":460,"className":461},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2404.14618","_blank",[462,463],"text-blue-600","underline","[Online]",[448,466,468,469,472,473],{"id":467},"source-2","I. Ong, A. Almahairi, V. Wu, W. Chiang, T. Wu, J. E. Gonzalez, M. W. Kadous, and I. Stoica, \"RouteLLM: Learning to Route LLMs with Preference Data,\" in ",[453,470,471],{},"Proc. International Conference on Learning Representations (ICLR 2025)",", 2025. ",[338,474,464],{"href":475,"target":460,"className":476},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.18665",[462,463],[448,478,480,481,484,485],{"id":479},"source-3","G. Lai and H.-J. Ye, \"When Routing Collapses: On the Degenerate Convergence of LLM Routers,\" ",[453,482,483],{},"arXiv",", 2026. ",[338,486,464],{"href":487,"target":460,"className":488},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2602.03478",[462,463],[448,490,492,493,496,497],{"id":491},"source-4","H. Li, Y. Zhang, Z. Guo, C. Wang, S. Tang, Q. Zhang, Y. Chen, B. Qi, P. Ye, L. Bai, Z. Wang, and S. Hu, \"LLMRouterBench: A Massive Benchmark and Unified Framework for LLM Routing,\" in ",[453,494,495],{},"Findings of the Association for Computational Linguistics: ACL 2026",", 2026, pp. 37733–37754. ",[338,498,464],{"href":499,"target":460,"className":500},"https:\u002F\u002Faclanthology.org\u002F2026.findings-acl.1881\u002F",[462,463],[448,502,504,505,484,507],{"id":503},"source-5","A. S. Bhatti, V. Vaddina, and D. Birru, \"PROTEUS: SLA-Aware Routing via Lagrangian RL for Multi-LLM Serving Systems,\" ",[453,506,483],{},[338,508,464],{"href":509,"target":460,"className":510},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2601.19402",[462,463],{"title":512,"searchDepth":513,"depth":513,"links":514},"",2,[515,516,517,518,519],{"id":315,"depth":513,"text":316},{"id":352,"depth":513,"text":353},{"id":382,"depth":513,"text":383},{"id":410,"depth":513,"text":411},{"id":434,"depth":513,"text":438},"2026-07-14","LLM routing promises to send easy questions to cheap models and hard questions to expensive ones. Recent research keeps finding that the systems built to do this default to the expensive model anyway, and still miss the right pick when it counts.","md",{"src":324},{"authors":525,"badge":531,"source":533},[526],{"avatar":527,"name":529,"to":530},{"src":528},"\u002Fimg\u002Fmark_avatar.png","Mark Williams","https:\u002F\u002Fthinkata.com",{"label":532},"AI Infrastructure",{"name":534,"url":530},"Thinkata Research",true,{"title":202,"description":521},"ThnI8PTU6GLgSiv9QGVXFfqAtl-64CfR7BfnMA4ryxE",[539,540],null,{"id":541,"title":218,"body":542,"date":786,"description":787,"extension":522,"image":788,"meta":789,"navigation":535,"path":219,"seo":796,"stem":220,"__hash__":797,"_path":219},"insights\u002Fnews\u002Finsights\u002Fmulti-tenant-ai-isolation.md",{"type":296,"value":543,"toc":777},[544,556,562,565,568,571,575,583,586,594,598,604,607,615,623,627,633,636,649,659,663,671,684,688,691],[299,545,303,547,303,551],{"className":546},[302],[305,548,218],{"className":549,"id":550},[308],"one-model-many-customers-and-the-leak-nobody-tests-for",[311,552,555],{"className":553,"id":554},[314],"where-cross-tenant-data-leaks-in-shared-ai-systems-and-where-the-boundary-has-to-live","Where cross-tenant data leaks in shared AI systems, and where the boundary has to live",[299,557,320,558],{"style":319},[322,559],{"src":560,"alt":561,"style":326},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1769117617809-cebd713b82bb?w=1200&auto=format&fit=crop","A long hotel hallway lined with identical guest room doors, analogous to a multi-tenant system where every customer looks safely separated until a shared mechanism, like a keycard coded for more than one room, quietly crosses the boundary",[328,563,564],{},"A hotel floor looks like strong isolation. Every room has its own door, its own number, and its own guest, and nobody expects one room's contents to turn up next door. The failure that matters is rarely a door left open. It is a keycard cut for one room that quietly opens the one beside it. That is the shape of the risk in shared AI systems. The separation between customers looks structural until something built for efficiency, a shared model, a shared index, or a shared cache, turns into a keycard that opens more than one room.",[328,566,567],{},"A B2B software company ships an AI feature. It summarizes contracts, answers questions over a customer's documents, or drafts replies from a customer's history. The demo lands, the feature works, usage climbs. One test rarely makes the plan. Can customer A pull customer B's data out of the same system. The feature working and the feature keeping customers apart are two different claims, and only the first one shows up in a product demo.",[328,569,570],{},"The word tenant here means one customer's isolated slice of a shared system, the same way a hotel gives each guest a private room inside one shared building. Most B2B AI products are multi-tenant by design, because running a separate model, database, and server stack for every customer is expensive. The saving comes from sharing, and sharing is exactly where the boundary between tenants can quietly disappear. Three surfaces tend to be shared, the model weights, the retrieval layer, and the serving cache. Each one has a documented way of moving one tenant's data into another tenant's output.",[311,572,574],{"id":573},"the-model-can-memorize-one-tenant-and-recite-it-to-another","The Model Can Memorize One Tenant and Recite It to Another",[328,576,577,578,582],{},"Language models memorize. One experiment extracted hundreds of verbatim sequences from a public model using only ordinary query access, including names, phone numbers, and other personal details, and some of those strings appeared in just a single training document ",[335,579,580],{},[338,581,341],{"href":340},". The finding that should worry anyone pooling customer data is that larger models memorized more, not less. A string does not need to be common to be recoverable.",[328,584,585],{},"The multi-tenant version of this risk shows up when a single model is fine-tuned on the combined data of every customer. Fine-tuning means continuing to train a base model on your own examples so it adapts to your domain. Do it on the pooled corpus of all tenants and the weights themselves become a shared surface. A prompt from tenant B can, at least in principle, surface a string that only tenant A ever provided, and no request-time permission check sees it happen, because the leak is baked into the parameters rather than pulled from a database.",[328,587,588,589,593],{},"There is a genuinely interesting counterpoint here. One study found that retrieval-augmented generation (RAG) can reduce a model's tendency to reproduce memorized training data, because the model leans on the freshly retrieved text instead of its own parameters ",[335,590,591],{},[338,592,348],{"href":347},". That is real, but it moves the risk rather than removing it. The retrieved text is the next shared surface.",[311,595,597],{"id":596},"retrieval-ranks-by-relevance-not-by-permission","Retrieval Ranks by Relevance, Not by Permission",[299,599,320,600],{"style":319},[322,601],{"src":602,"alt":603,"style":326},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1762965119363-af950b523dca?w=1200&auto=format&fit=crop","Suitcases riding an airport baggage carousel, analogous to a retrieval step that surfaces whatever best matches the request as it comes around, without checking whether the person reaching for it is the rightful owner",[328,605,606],{},"Retrieval systems have one job, to find the most relevant text for a question, and they are good at it. Relevance is not permission. A baggage carousel sorts bags by the flight they arrived on and trusts travelers to claim the right one, which holds up until two bags look alike. A retrieval index sorts by semantic similarity, how close two pieces of text are in meaning, and by default carries no idea of who is allowed to see what. The index behind a shared RAG feature is usually one index for all tenants, kept that way for cost and for retrieval quality. The documents most similar to a question get pulled into the model's context before anything has checked whose documents they are.",[328,608,609,610,614],{},"One research group names this the relevance-authorization gap, and its measurements are stark. In a multitenant test setup, retrieval with no authorization gate leaked cross-tenant data in 98 to 100 percent of probes ",[335,611,612],{},[338,613,368],{"href":367},". The proposed fix is not a smarter filter placed after retrieval runs. It is a layered architecture that gates the candidate set at ingestion and at retrieval time, before the ranking step ever touches a document the requesting tenant should not see.",[328,616,617,618,622],{},"A follow-up test used a composite structured prompt, one part written to trigger retrieval and one part instructing the model to repeat the context it was given, and pulled 112 exact matches and 208 near matches from 250 prompts against a private email dataset ",[335,619,620],{},[338,621,348],{"href":347},". The common instinct, retrieve everything and then filter the results the user should not see, arrives too late. By the time the filter runs, the restricted text is already sitting in the context window.",[311,624,626],{"id":625},"the-cache-is-a-side-channel","The Cache Is a Side Channel",[299,628,320,629],{"style":319},[322,630],{"src":631,"alt":632,"style":326},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1701187540994-054295adacc5?w=1200&auto=format&fit=crop","A wall of numbered mailboxes in a building lobby, analogous to a shared mailroom whose delivery speed for a repeated item quietly signals what a neighbor already received",[328,634,635],{},"To avoid recomputing work, serving systems store intermediate state, often the key-value cache that holds a request's attention data, and reuse it when a new request shares a prefix with an earlier one. Shared across tenants, a cache hit comes back faster than a cache miss, the way a mailroom hands over a familiar package quicker than a first-time delivery, and that timing gap is measurable from the outside. A watchful neighbor can learn what someone nearby received without ever seeing it.",[328,637,638,639,643,644,648],{},"One attack, in work now published in IEEE Transactions on Information Forensics and Security, turned that difference into a working exploit. It detected per-token cache hits at 86 percent accuracy, recovered prompt tokens at 92.3 percent, and a peeping neighbor variant identified another user's cached content above 95 percent accuracy after three trials ",[335,640,641],{},[338,642,378],{"href":377},". In another experiment, presented at the Network and Distributed System Security Symposium, the same idea ran against SGLang, a production serving framework, and reconstructed a stranger's entire prompt with no prior knowledge of its content at a 95 percent success rate, a figure that climbed to 99 percent once the attacker already knew the surrounding template. A case study inside that same paper recovered a health questionnaire's embedded gender, age, weight, and height fields in just 60 requests ",[335,645,646],{},[338,647,398],{"href":397},". None of this requires special access. The attacker just sends normal requests and measures how long the answers take.",[328,650,651,652,658],{},"This is not confined to research prototypes. An audit of live commercial APIs, presented at ICML 2025, detected global cache sharing across users in seven providers, including OpenAI, which means a fast response can carry information about a stranger's prompt ",[335,653,654],{},[338,655,657],{"href":656},"#source-6","[6]",". The optimization that makes shared inference affordable is the same one that opens the channel.",[311,660,662],{"id":661},"where-the-boundary-has-to-live","Where the Boundary Has to Live",[328,664,665,666,670],{},"The pattern across all three surfaces is the same. The boundary cannot be a filter at the end of the pipeline. It has to be enforced before the shared resource is touched. For retrieval, that means gating the candidate set before the model reads anything, not after, an approach validated earlier against ungated retrieval ",[335,667,668],{},[338,669,368],{"href":367},". For the model, pooling every customer into one fine-tune trades isolation for convenience, and per-tenant routing or per-tenant adapters keep one customer's data out of the surface another customer queries. For the cache, the same tension holds. Per-tenant cache isolation closes the timing channel entirely, but it gives up the throughput gains that shared caching exists to provide, and that tradeoff has to be sized against how sensitive the cached content is rather than defaulted away in either direction. Isolation is not free, and its cost belongs in the design, not in the incident report.",[328,672,673,674,680,681,683],{},"This is the case for carrying tenant context, the identity of the customer a request belongs to, through every layer of the system. Retrieval, model selection, cache, and logging each need to know which tenant they are serving, rather than trusting a single check at the front door. A boundary enforced at each layer is harder to build than a filter bolted onto the output, and it is close to what confidential computing work already argues for at the hardware level, where isolation is treated as a property of the whole path rather than a wrapper around it ",[335,675,676],{},[338,677,679],{"href":678},"#source-7","[7]",". The engineering effort is the difference between a feature that works and a feature that can prove it keeps customers apart. A platform should treat per-tenant isolation, model routing, and tenant context at every layer as the default rather than a retrofit, for exactly the reasons the research keeps surfacing. The related tradeoffs are discussed further in ",[338,682,250],{"href":251},".",[311,685,687],{"id":686},"what-to-actually-test","What to Actually Test",[328,689,690],{},"The useful test is adversarial and a little boring. Sit in tenant B and try to retrieve, extract, or time a path into tenant A's data. Ask the model to repeat the context it was handed. Send prompts that share long prefixes with a known tenant and watch the latency. Probe the retrieval index with a query only another tenant's documents could answer. The evidence across memorization, retrieval, and caching says these leaks are reachable with ordinary access, so the open question for any team shipping B2B AI is not whether the failure mode exists. It is how much isolation the product can afford while still hitting its latency and cost targets. That number is worth knowing before a customer's security review asks for it.",[299,692,303,694,303,696],{"className":693},[434,435],[311,695,438],{"id":434},[440,697,320,699,320,710,320,721,320,732,320,743,320,754,320,766,303],{"className":698},[443,444,445,446],[448,700,701,702,705,706],{"id":450},"N. Carlini et al., \"Extracting Training Data from Large Language Models,\" in ",[453,703,704],{},"Proc. 30th USENIX Security Symposium (USENIX Security '21)",", 2021, pp. 2633–2650. ",[338,707,464],{"href":708,"target":460,"className":709},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2012.07805",[462,463],[448,711,712,713,716,717],{"id":467},"S. Zeng et al., \"The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG),\" in ",[453,714,715],{},"Findings of the Association for Computational Linguistics: ACL 2024",", 2024, ",[338,718,464],{"href":719,"target":460,"className":720},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2402.16893",[462,463],[448,722,723,724,727,728],{"id":479},"F. J. Arceo and V. P. Narsing, \"Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use,\" in ",[453,725,726],{},"Proc. ACM Conf. on AI and Agentic Systems (CAIS '26)",", 2026, ",[338,729,464],{"href":730,"target":460,"className":731},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2605.05287",[462,463],[448,733,734,735,738,739],{"id":491},"L. Song et al., \"The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems,\" ",[453,736,737],{},"IEEE Transactions on Information Forensics and Security",", vol. 20, pp. 11431–11446, 2025. DOI: ",[338,740,464],{"href":741,"target":460,"className":742},"https:\u002F\u002Fdoi.org\u002F10.1109\u002FTIFS.2025.3622954",[462,463],[448,744,745,746,749,750],{"id":503},"G. Wu et al., \"I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving,\" in ",[453,747,748],{},"Proc. Network and Distributed System Security Symposium (NDSS 2025)",", 2025. DOI: ",[338,751,464],{"href":752,"target":460,"className":753},"https:\u002F\u002Fdoi.org\u002F10.14722\u002Fndss.2025.241772",[462,463],[448,755,757,758,761,762],{"id":756},"source-6","C. Gu et al., \"Auditing Prompt Caching in Language Model APIs,\" in ",[453,759,760],{},"Proc. 42nd International Conference on Machine Learning (ICML 2025)",", PMLR 267, 2025, ",[338,763,464],{"href":764,"target":460,"className":765},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2502.07776",[462,463],[448,767,769,770,749,773],{"id":768},"source-7","S. Zobaed and M. A. Salehi, \"Confidential Computing Across Edge-To-Cloud for Machine Learning: A Survey Study,\" ",[453,771,772],{},"Software: Practice and Experience",[338,774,464],{"href":775,"target":460,"className":776},"https:\u002F\u002Fdoi.org\u002F10.1002\u002Fspe.3398",[462,463],{"title":512,"searchDepth":513,"depth":513,"links":778},[779,780,781,782,783,784,785],{"id":554,"depth":513,"text":555},{"id":573,"depth":513,"text":574},{"id":596,"depth":513,"text":597},{"id":625,"depth":513,"text":626},{"id":661,"depth":513,"text":662},{"id":686,"depth":513,"text":687},{"id":434,"depth":513,"text":438},"2026-07-07","Your B2B AI feature works. The test that rarely makes the plan is whether customer A can pull customer B's data out of it. A shared model, a shared retrieval index, and a shared cache each have a documented way of letting one tenant's data surface in another tenant's output, and the boundary has to live earlier than most teams put it.",{"src":560},{"authors":790,"badge":793,"source":795},[791],{"avatar":792,"name":529,"to":530},{"src":528},{"label":794},"Multi-Tenant AI",{"name":534,"url":530},{"title":218,"description":787},"v9Jm6DXc7zDxSpyin44HfrKZx3bn6JavTbUPi3SkNLc",1784123265237]