You buy model access from one reseller. Your prompt can pass through seven you were never told about, and a timing trick just proved it

What the paper measured

On 21 August 2026, eight researchers published Uncovering and Understanding Hidden Dependencies in the LLM API Reseller Ecosystem via Prefix-Cache Side Channels (arXiv:2608.20732). Behind the title is a plain finding with an uncomfortable edge: when you buy access to a model through a reseller, your prompt can pass through other resellers you were never told about, each able to read or change it.

They built a tool called CacheTracer, pointed it at 39 reseller endpoints, sent 1.1 million requests across 636 endpoint pairs, and found that a great many endpoints that present themselves as independent quietly share a backend.

The trick: a performance feature turned into a map

The method is elegant enough to explain in a sentence, and it matters because it is the same feature that shows up in every "where does my prompt go" story this year.

Modern LLM services use prefix caching. If two requests begin with the same long prefix, the provider computes that prefix once and reuses it, so the second request comes back faster and cheaper. A shared cache is a shared resource, and a shared resource you can time is a side channel.

fast return → shared upstreamis the only signal you get. There is no other tell.

CacheTracer uses two moves. Flood sends a fresh, unique prefix through endpoint A, which lands in A's backend cache. Prove sends the same prefix through endpoint B and times it. If B is slow, it computed the prefix from scratch and the two are independent. If B is fast, it reused a prefix only A had ever sent, and the only way that happens is a shared upstream. Fast means same backend, and no marketing page said so.

What the invoice hides

The consequence is a supply chain as opaque as anything in open-source software, and less inspectable, because there is no lockfile for inference.

You pay one reseller. Your request may traverse several more above it, and the paper is explicit that each intermediary "can inspect or modify prompts and responses." That is both a confidentiality problem, your prompt is legible to parties you never contracted with, and an integrity problem, the answer you get back can be altered on the way down. Neither appears on any invoice, and until this paper there was no way to see it from the outside.

The shape of it: deep and concentrated

The measurements are the part to carry into a risk conversation, because they are specific and they are worse than "some sharing happens".

37.1%

of endpoint pairs shared cache

Better than one pair in three that look independent are not.

7

layers deep

The containment order of who sits beneath whom runs seven levels.

31+

downstreams under one node

A single cache reach sat inside at least 31 other nodes.

1.1M

requests, API only

No insider access. Measured entirely from the outside.

That third figure is the one that should change a decision. A single upstream path sits beneath at least thirty-one downstream resellers. One confidentiality or integrity failure at that node, a leak, a logging misconfiguration, a malicious operator, does not affect one vendor. It reaches everyone above it at once, and none of their users chose it or knew it was there.

Why this is your problem even if you buy direct

Two reasons it is not only a discount-broker issue.

First, the cheap-access market is large and growing, and procurement rarely knows it is in use. A team under budget pressure signs up for a reseller offering a frontier model at a fraction of list price, routes real prompts through it, and has now placed the organisation's data into a chain this paper shows can be seven hops deep. The gray market reselling Claude tokens at a discount is the demand side of exactly this supply chain.

Second, it is the same root cause as two stories already covered here. It is the confidentiality question underneath OpenAI's Zero Data Retention: retention and access are only two of the questions, and where the processing physically happens is the third that nobody moves. Prefix caching is also the mechanism behind cross-tenant prompt leakage. The feature that makes inference cheap is the same feature that maps the hidden supply chain and can leak across it.

What you think you bought, and what the measurement shows

The assumption	What CacheTracer shows
I am buying from one provider	Your request may traverse several undisclosed upstream resellers, up to seven layers.
My prompt is seen only by who I pay	Each intermediary can inspect prompts and responses. You did not contract with them.
Two vendors means two baskets	37.1% of pairs share a backend. Diversifying resellers may not diversify risk at all.
A vendor incident affects that vendor	A shared-upstream incident has a blast radius across every reseller beneath it.
This is invisible, so unmanageable	It is measurable from the outside, API only, which means you can test it and require it.

What to do about it

The position

This is not an argument that resellers are dishonest, and the paper does not claim any specific one is. It is an argument that the AI access market has quietly grown a supply chain, and unlike the software supply chain it has no manifest, no lockfile, and no convention of disclosure. You can enumerate the packages in your build. Until this paper, you could not enumerate the hands your prompt passed through.

The through-line with everything else this month is the same: the document you are given is accurate and describes a narrower thing than the risk you carry. A reseller invoice truthfully names who you paid. It does not name where your data went, and where your data went is the entire question. The useful development here is that the answer stopped being invisible. It is now something you can measure, and therefore something you can insist on.