[{"data":1,"prerenderedAt":1088},["ShallowReactive",2],{"navigation":3,"\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality":341,"\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality-surround":586},[4,8,17,21,25,29,33,329,333,337],{"title":5,"path":6,"stem":7},"About","\u002Fabout","about",{"title":9,"path":10,"stem":11,"children":12},"Authentication","\u002Fauth","auth",[13],{"title":14,"path":15,"stem":16},"Email Confirmation","\u002Fauth\u002Fconfirmation","auth\u002Fconfirmation",{"title":18,"path":19,"stem":20},"Industry Briefs","\u002Fcase-studies","case-studies",{"title":22,"path":23,"stem":24},"Contact","\u002Fcontact","contact",{"title":26,"path":27,"stem":28},"Thinkata | Production AI Engineering","\u002F","index",{"title":30,"path":31,"stem":32},"Insights","\u002Finsights","insights",{"title":34,"path":35,"stem":36,"children":37},"News","\u002Fnews","news",[38,41,65],{"title":39,"path":35,"stem":40},"News & Insights","news\u002Findex",{"title":18,"path":42,"stem":43,"children":44},"\u002Fnews\u002Fcase-studies","news\u002Fcase-studies",[45,49,53,57,61],{"title":46,"path":47,"stem":48},"Building Secure and Scalable AI Infrastructure: Integrating with Existing Systems through Modern Cloud Frameworks","\u002Fnews\u002Fcase-studies\u002Fcloud-infrastructure-ai","news\u002Fcase-studies\u002Fcloud-infrastructure-ai",{"title":50,"path":51,"stem":52},"Making Sense of Financial Regulations: How AI Teams Can Tackle Complex Documents","\u002Fnews\u002Fcase-studies\u002Ffinancial-regulations","news\u002Fcase-studies\u002Ffinancial-regulations",{"title":54,"path":55,"stem":56},"AI-Powered Transformations in Healthcare","\u002Fnews\u002Fcase-studies\u002Fhealth-care","news\u002Fcase-studies\u002Fhealth-care",{"title":58,"path":59,"stem":60},"Generative AI in Upstream Natural Gas: Shell's Exploration Initiative","\u002Fnews\u002Fcase-studies\u002Foil-gas","news\u002Fcase-studies\u002Foil-gas",{"title":62,"path":63,"stem":64},"Optimizing Manufacturing with AI-Driven Multi-Agent Systems","\u002Fnews\u002Fcase-studies\u002Fsupply-chain-optimization","news\u002Fcase-studies\u002Fsupply-chain-optimization",{"title":30,"path":66,"stem":67,"children":68},"\u002Fnews\u002Finsights","news\u002Finsights",[69,73,77,81,85,89,93,97,101,105,109,113,117,121,125,129,133,137,141,145,149,153,157,161,165,169,173,177,181,185,189,193,197,201,205,209,213,217,221,225,229,233,237,241,245,249,253,257,261,265,269,273,277,281,285,289,293,297,301,305,309,313,317,321,325],{"title":70,"path":71,"stem":72},"Nothing Gets Deleted, Just Blurred","\u002Fnews\u002Finsights\u002Fadaptive-context-memory","news\u002Finsights\u002Fadaptive-context-memory",{"title":74,"path":75,"stem":76},"The Capability-Reliability Split in Agent Systems","\u002Fnews\u002Finsights\u002Fagent-capability-reliability-split","news\u002Finsights\u002Fagent-capability-reliability-split",{"title":78,"path":79,"stem":80},"The Rise of AI Agents in Cyberattacks: Latest Research and Threats","\u002Fnews\u002Finsights\u002Fai-agent-cyber-threats","news\u002Finsights\u002Fai-agent-cyber-threats",{"title":82,"path":83,"stem":84},"Winning the Bid Is Not the Same as Knowing the Price","\u002Fnews\u002Finsights\u002Fai-agent-economics","news\u002Finsights\u002Fai-agent-economics",{"title":86,"path":87,"stem":88},"The Smart Enterprise AI Stack: Why Teams of AI Agents Beat Solo Models Consistently","\u002Fnews\u002Finsights\u002Fai-architecture","news\u002Finsights\u002Fai-architecture",{"title":90,"path":91,"stem":92},"When Seeing Everything Becomes the Only Option","\u002Fnews\u002Finsights\u002Fai-comprehensive-observability","news\u002Finsights\u002Fai-comprehensive-observability",{"title":94,"path":95,"stem":96},"The Data Infrastructure AI-Native Systems Can't Ignore","\u002Fnews\u002Finsights\u002Fai-data-layer","news\u002Finsights\u002Fai-data-layer",{"title":98,"path":99,"stem":100},"Enterprise AI Triage Systems: Intelligent Automation for Large-Scale Operations","\u002Fnews\u002Finsights\u002Fai-enterprise-triage","news\u002Finsights\u002Fai-enterprise-triage",{"title":102,"path":103,"stem":104},"When Oversight Becomes Infrastructure","\u002Fnews\u002Finsights\u002Fai-governed-autonomy","news\u002Finsights\u002Fai-governed-autonomy",{"title":106,"path":107,"stem":108},"Designing for Graceful Failure in Compound AI Systems","\u002Fnews\u002Finsights\u002Fai-graceful-failure","news\u002Finsights\u002Fai-graceful-failure",{"title":110,"path":111,"stem":112},"Intelligent Composability: Building AI Systems Like Orchestra, Not Soloists","\u002Fnews\u002Finsights\u002Fai-intelligent-composability","news\u002Finsights\u002Fai-intelligent-composability",{"title":114,"path":115,"stem":116},"Building the Plane While Flying It — Migrating from Monolith to AI-Native Without Stopping","\u002Fnews\u002Finsights\u002Fai-migration-path","news\u002Finsights\u002Fai-migration-path",{"title":118,"path":119,"stem":120},"Stability Through Continuous Adaptation","\u002Fnews\u002Finsights\u002Fai-native-overview","news\u002Finsights\u002Fai-native-overview",{"title":122,"path":123,"stem":124},"Provable Stability: Mathematical Guarantees for Adaptive AI Systems","\u002Fnews\u002Finsights\u002Fai-provable-stability","news\u002Finsights\u002Fai-provable-stability",{"title":126,"path":127,"stem":128},"How Temperature Tuning Makes or Breaks Reinforcement Learning","\u002Fnews\u002Finsights\u002Fai-soft-actor-critic-entropy-collapse","news\u002Finsights\u002Fai-soft-actor-critic-entropy-collapse",{"title":130,"path":131,"stem":132},"Testing What Can't Be Predicted","\u002Fnews\u002Finsights\u002Fai-systems-testing","news\u002Finsights\u002Fai-systems-testing",{"title":134,"path":135,"stem":136},"Delegating the Job Is Not the Same as Delegating the Rules","\u002Fnews\u002Finsights\u002Fauthorization-drift-multi-agent","news\u002Finsights\u002Fauthorization-drift-multi-agent",{"title":138,"path":139,"stem":140},"Closing the Loop: How Human Corrections Can Make AI Systems Smarter Over Time","\u002Fnews\u002Finsights\u002Fclosing-the-loop","news\u002Finsights\u002Fclosing-the-loop",{"title":142,"path":143,"stem":144},"A Panel Can Be Safer Than Any Member of It","\u002Fnews\u002Finsights\u002Fcoalitional-alignment-panel-review","news\u002Finsights\u002Fcoalitional-alignment-panel-review",{"title":146,"path":147,"stem":148},"Multi-Path Reasoning: Collaborative and Competitive Approaches in AI","\u002Fnews\u002Finsights\u002Fcollaborative-competitive-agents","news\u002Finsights\u002Fcollaborative-competitive-agents",{"title":150,"path":151,"stem":152},"Why Challenges Supercharge Smarts for Humans and AI","\u002Fnews\u002Finsights\u002Fcompetition-improves-ai","news\u002Finsights\u002Fcompetition-improves-ai",{"title":154,"path":155,"stem":156},"Context is Infrastructure, Not Instructions","\u002Fnews\u002Finsights\u002Fcontext-is-infrastructure","news\u002Finsights\u002Fcontext-is-infrastructure",{"title":158,"path":159,"stem":160},"Context is the New Code","\u002Fnews\u002Finsights\u002Fcontext-is-new-code","news\u002Finsights\u002Fcontext-is-new-code",{"title":162,"path":163,"stem":164},"Continuous Thought Machines","\u002Fnews\u002Finsights\u002Fcontinuous-thought-machines","news\u002Finsights\u002Fcontinuous-thought-machines",{"title":166,"path":167,"stem":168},"Don't Vibe, Architect","\u002Fnews\u002Finsights\u002Fdont-vibe-architect","news\u002Finsights\u002Fdont-vibe-architect",{"title":170,"path":171,"stem":172},"The Edge of the Underdefined","\u002Fnews\u002Finsights\u002Fedge-of-the-underdefined","news\u002Finsights\u002Fedge-of-the-underdefined",{"title":174,"path":175,"stem":176},"Experts All the Way Down","\u002Fnews\u002Finsights\u002Fexperts-all-the-way","news\u002Finsights\u002Fexperts-all-the-way",{"title":178,"path":179,"stem":180},"A Multi-Tier Safety Architecture for Critical Applications","\u002Fnews\u002Finsights\u002Ffour-tier-architecture","news\u002Finsights\u002Ffour-tier-architecture",{"title":182,"path":183,"stem":184},"Green Dashboard, Unhappy Users","\u002Fnews\u002Finsights\u002Fgreen-dashboard-unhappy-users","news\u002Finsights\u002Fgreen-dashboard-unhappy-users",{"title":186,"path":187,"stem":188},"Hybrid Autoregressive Residual Tokens","\u002Fnews\u002Finsights\u002Fhart-model","news\u002Finsights\u002Fhart-model",{"title":190,"path":191,"stem":192},"Hierarchical Reasoning in Artificial Intelligence","\u002Fnews\u002Finsights\u002Fhierarchical-approaches","news\u002Finsights\u002Fhierarchical-approaches",{"title":194,"path":195,"stem":196},"Taking Turns Instead of Splitting the Difference","\u002Fnews\u002Finsights\u002Finterleaved-distillation-rl","news\u002Finsights\u002Finterleaved-distillation-rl",{"title":198,"path":199,"stem":200},"Latent Diffusion for Language Generation: A Comprehensive Overview","\u002Fnews\u002Finsights\u002Flatent-diffusion-for-language","news\u002Finsights\u002Flatent-diffusion-for-language",{"title":202,"path":203,"stem":204},"Breaking Language Barriers: How AI Can Translate Without Examples","\u002Fnews\u002Finsights\u002Flearning-languages","news\u002Finsights\u002Flearning-languages",{"title":206,"path":207,"stem":208},"The Emergence of AI Deception: How Large Language Models Have Learned to Strategically Mislead Users","\u002Fnews\u002Finsights\u002Fllm-deception","news\u002Finsights\u002Fllm-deception",{"title":210,"path":211,"stem":212},"Grading on a Shared Curve","\u002Fnews\u002Finsights\u002Fllm-judge-correlated-errors","news\u002Finsights\u002Fllm-judge-correlated-errors",{"title":214,"path":215,"stem":216},"Synergizing Specialized Reasoning and General Capabilities in AI","\u002Fnews\u002Finsights\u002Fllm-reasoning-advances","news\u002Finsights\u002Fllm-reasoning-advances",{"title":218,"path":219,"stem":220},"The Expensive Default","\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality","news\u002Finsights\u002Fllm-routing-cost-quality",{"title":222,"path":223,"stem":224},"The AI That Rewrites Itself: MIT's Breakthrough in Self-Adapting Language Models","\u002Fnews\u002Finsights\u002Fllm-seal","news\u002Finsights\u002Fllm-seal",{"title":226,"path":227,"stem":228},"Forgetting on Request","\u002Fnews\u002Finsights\u002Fmachine-unlearning-removal-suppression","news\u002Finsights\u002Fmachine-unlearning-removal-suppression",{"title":230,"path":231,"stem":232},"The Map and the Walk","\u002Fnews\u002Finsights\u002Fmap-and-walk","news\u002Finsights\u002Fmap-and-walk",{"title":234,"path":235,"stem":236},"Metacognitive Reinforcement Learning for Self-Improving AI Systems","\u002Fnews\u002Finsights\u002Fmetacognitive-reinforcement-learning","news\u002Finsights\u002Fmetacognitive-reinforcement-learning",{"title":238,"path":239,"stem":240},"Revolutionary Advancements in Mixture of Experts (MoE) Architectures","\u002Fnews\u002Finsights\u002Fmixture-of-experts","news\u002Finsights\u002Fmixture-of-experts",{"title":242,"path":243,"stem":244},"One Model, Many Customers, and the Leak Nobody Tests For","\u002Fnews\u002Finsights\u002Fmulti-tenant-ai-isolation","news\u002Finsights\u002Fmulti-tenant-ai-isolation",{"title":246,"path":247,"stem":248},"Balancing Neural Plasticity and Stability","\u002Fnews\u002Finsights\u002Fneural-plasticity","news\u002Finsights\u002Fneural-plasticity",{"title":250,"path":251,"stem":252},"Offline RL and the Data Flywheel","\u002Fnews\u002Finsights\u002Foffline-rl-data-flywheel","news\u002Finsights\u002Foffline-rl-data-flywheel",{"title":254,"path":255,"stem":256},"Orchestration Without a Signal From the Room","\u002Fnews\u002Finsights\u002Fplanner-in-the-loop","news\u002Finsights\u002Fplanner-in-the-loop",{"title":258,"path":259,"stem":260},"Second-Guessing Has a Price","\u002Fnews\u002Finsights\u002Freasoning-budget-allocation","news\u002Finsights\u002Freasoning-budget-allocation",{"title":262,"path":263,"stem":264},"Reasoning You Can Check","\u002Fnews\u002Finsights\u002Freasoning-you-can-check","news\u002Finsights\u002Freasoning-you-can-check",{"title":266,"path":267,"stem":268},"When Optimization Optimizes Itself","\u002Fnews\u002Finsights\u002Frecursive-goodhart","news\u002Finsights\u002Frecursive-goodhart",{"title":270,"path":271,"stem":272},"Reward Design as Architecture","\u002Fnews\u002Finsights\u002Freward-design-as-architecture","news\u002Finsights\u002Freward-design-as-architecture",{"title":274,"path":275,"stem":276},"When Success Has No Author: The Temporal Credit Assignment Problem","\u002Fnews\u002Finsights\u002Frl-credit-assignment-problem","news\u002Finsights\u002Frl-credit-assignment-problem",{"title":278,"path":279,"stem":280},"Beyond Entropy Collapse: When Exploration Succeeds but Learning Fails","\u002Fnews\u002Finsights\u002Frl-optimization-gaps","news\u002Finsights\u002Frl-optimization-gaps",{"title":282,"path":283,"stem":284},"The Body Was Supposed to Be the Easy Part","\u002Fnews\u002Finsights\u002Frobot-embodiment-interface","news\u002Finsights\u002Frobot-embodiment-interface",{"title":286,"path":287,"stem":288},"The Path to Practical Confidential Computing for AI Systems","\u002Fnews\u002Finsights\u002Fsecure-ai-architectures","news\u002Finsights\u002Fsecure-ai-architectures",{"title":290,"path":291,"stem":292},"When an AI Edits Its Own Memory","\u002Fnews\u002Finsights\u002Fself-editing-agent-memory","news\u002Finsights\u002Fself-editing-agent-memory",{"title":294,"path":295,"stem":296},"Guess First, Check Later","\u002Fnews\u002Finsights\u002Fspeculative-execution-pattern","news\u002Finsights\u002Fspeculative-execution-pattern",{"title":298,"path":299,"stem":300},"Spiking Neural Networks for Energy-Efficient AI","\u002Fnews\u002Finsights\u002Fspiking-neural-networks","news\u002Finsights\u002Fspiking-neural-networks",{"title":302,"path":303,"stem":304},"When Replay Is Not an Option: Streaming Q-Learning and SARSA Get a Second Look","\u002Fnews\u002Finsights\u002Fstreaming-q-learning-revival","news\u002Finsights\u002Fstreaming-q-learning-revival",{"title":306,"path":307,"stem":308},"The Turn as the Unit of Quality","\u002Fnews\u002Finsights\u002Fstructured-iteration-quality","news\u002Finsights\u002Fstructured-iteration-quality",{"title":310,"path":311,"stem":312},"AI Speech Translation: Breaking Down Language Barriers","\u002Fnews\u002Finsights\u002Fsts-performance-advances","news\u002Finsights\u002Fsts-performance-advances",{"title":314,"path":315,"stem":316},"Test-Time Training Layers: The Next Evolution in Transformer Architecture","\u002Fnews\u002Finsights\u002Ftest-time-training-layers","news\u002Finsights\u002Ftest-time-training-layers",{"title":318,"path":319,"stem":320},"Breakthrough: Large Language Models Pass the Turing Test","\u002Fnews\u002Finsights\u002Fturing-tests","news\u002Finsights\u002Fturing-tests",{"title":322,"path":323,"stem":324},"Algorithms Used in Autonomous Fighter Jet Flight Research","\u002Fnews\u002Finsights\u002Fvenom-f16-flight-autonomy","news\u002Finsights\u002Fvenom-f16-flight-autonomy",{"title":326,"path":327,"stem":328},"Training in a World That Does Not Exist Yet","\u002Fnews\u002Finsights\u002Fworld-models-as-infrastructure","news\u002Finsights\u002Fworld-models-as-infrastructure",{"title":330,"path":331,"stem":332},"Privacy Policy","\u002Fprivacy","privacy",{"title":334,"path":335,"stem":336},"Research","\u002Fresearch","research",{"title":338,"path":339,"stem":340},"Terms of Service","\u002Fterms","terms",{"id":342,"title":218,"body":343,"date":568,"description":569,"extension":570,"image":571,"meta":572,"navigation":583,"path":219,"seo":584,"stem":220,"__hash__":585},"insights\u002Fnews\u002Finsights\u002Fllm-routing-cost-quality.md",{"type":344,"value":345,"toc":559},"minimark",[346,365,375,379,398,402,408,418,428,432,438,448,456,460,468,479],[347,348,351,352,351,358],"div",{"className":349},[350],"page-title","\n  ",[353,354,218],"h1",{"className":355,"id":357},[356],"page-title__main","the-expensive-default",[359,360,364],"h2",{"className":361,"id":363},[362],"page-title__sub","llm-routing-promises-to-send-easy-questions-to-cheap-models-and-research-keeps-finding-it-reaches-for-the-expensive-one-instead","LLM routing promises to send easy questions to cheap models, and research keeps finding it reaches for the expensive one instead",[347,366,368,369],{"style":367},"width: 100%; padding: 2%;","\n    ",[370,371],"img",{"src":372,"alt":373,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1744745439306-f16d00620b38?w=1200&auto=format&fit=crop","A cluster of directional signs on a single post pointing toward many different destinations, standing in for the decision a production AI system faces on every incoming request, which of several available models should handle this one","width: 100%; height: auto;",[376,377,378],"p",{},"Every product built on a large language model eventually runs into a question that has nothing to do with prompts or fine-tuning. A request arrives, and something has to decide which model answers it. Send everything to the most capable model available and the bill grows in proportion to traffic, whether or not the traffic needed that much capability. Send everything to a cheaper model and some fraction of users get worse answers than the product could have given them.",[376,380,381,382,390,391,397],{},"The engineering answer to that tradeoff is a router, a lightweight system placed in front of the language models that reads each incoming request and assigns it to one of them. Early academic work on this problem found that many questions do not need the strongest available model at all. A quality-aware router trained to send only the harder queries to a large model reduced calls to that model by up to 40 percent with no measurable drop in response quality ",[383,384,385],"sup",{},[386,387,389],"a",{"href":388},"#source-1","[1]",". A follow-up framework refined the idea using human preference data collected from model comparisons, and on one benchmark it matched 95 percent of a strong model's score while sending only 13.4 percent of requests to that model ",[383,392,393],{},[386,394,396],{"href":395},"#source-2","[2]",". The premise looked sound. Most requests are easier than the hardest request a product will ever see, and a router that can tell the difference should save money without anyone noticing.",[359,399,401],{"id":400},"reaching-for-the-expensive-model-anyway","Reaching for the Expensive Model Anyway",[347,403,368,404],{"style":367},[370,405],{"src":406,"alt":407,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1740560516658-5a94b0b715ed?w=1200&auto=format&fit=crop","A mercury thermometer planted in sand against a blue sky, its red column climbing toward the top of the scale, standing in for a routing system that keeps escalating toward its most expensive, most capable model even when a lower reading would perform just as well",[376,409,410,411,417],{},"Deployed routers turn out to behave differently from the ones described in the papers that introduced the idea. A 2026 study tracking router behavior as the allowed budget per query increases found something researchers had not previously isolated as a distinct failure. Instead of spreading requests across the available models based on difficulty, the call rate of the single most expensive model climbs steadily and eventually saturates near 100 percent, the reading pushed toward the top of the scale regardless of whether the query in front of it needed that much, even though a hindsight-optimal router on the same benchmark uses that model for fewer than 20 percent of queries under the same budget ",[383,412,413],{},[386,414,416],{"href":415},"#source-3","[3]",". The researchers behind that finding named it routing collapse, and traced the cause to something structural rather than a training bug. Most queries have several models bunched close together in quality, and when the top two or three candidates are nearly tied, a routing model's small prediction errors are enough to flip which one looks best. As the budget grows and more models become affordable, that instability consistently pulls the decision toward the strongest, most expensive option, because a router comparing near-ties has no reliable way to settle on the cheaper one instead.",[376,419,420,421,427],{},"The opposite failure shows up just as often. A benchmark spanning more than 400,000 queries across 21 datasets and 33 models found that current routers, even ones sold as commercial products, still fail to land on the one correct model for a meaningful slice of requests. On the subset of test queries where only one to three of the available models could answer correctly, two widely used routing methods hit just 23 to 25 percent accuracy at identifying which one ",[383,422,423],{},[386,424,426],{"href":425},"#source-4","[4]",". So a router can spend too much by defaulting to the strongest model when it did not need to, and separately miss the model that actually had the right answer when specificity mattered. Both problems come from the same root cause. Comparing models that perform almost identically on most requests is a harder discrimination task than comparing models with a wide quality gap, and most real traffic falls into the first category.",[359,429,431],{"id":430},"naming-the-target-instead-of-guessing","Naming the Target Instead of Guessing",[347,433,368,434],{"style":367},[370,435],{"src":436,"alt":437,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1629122433131-53e850a3a2ce?w=1200&auto=format&fit=crop","A round target with several arrows clustered around, but not on, the center ring, standing in for the scatter that results when a routing system is tuned through indirect proxies instead of being told exactly where the target sits",[376,439,440,441,447],{},"Most routers ask an operator to set an indirect parameter, a cost threshold or a confidence cutoff, and observe afterward what accuracy that setting happened to produce. The result lands somewhere near the outcome the operator wanted, rarely exactly on it. One router built specifically against this complaint takes the opposite approach, accepting a target accuracy as a direct input rather than something inferred from unrelated knobs ",[383,442,443],{},[386,444,446],{"href":445},"#source-5","[5]",". Internally it tracks how far recent decisions have drifted from the requested target and adjusts its own aggressiveness in real time, letting a single trained system serve a whole range of accuracy requirements without retraining for each one.",[376,449,450,451,455],{},"The reported results suggest the direct-target approach closes much of the gap described above. Tested against a baseline that also tried to enforce a minimum accuracy level, the target-based router met its stated floor consistently, where the baseline met it only 22 percent of the time. On one benchmark it reached within 1.3 percent of the best achievable accuracy while cutting cost by as much as 89.8 percent compared to always using the strongest model ",[383,452,453],{},[386,454,446],{"href":445},". The gain is not that the underlying models changed. It is that the system was finally asked to hold a specific, checkable commitment instead of a proxy for one.",[359,457,459],{"id":458},"where-the-discipline-has-to-live","Where the Discipline Has to Live",[376,461,462,463,467],{},"Cost and quality are not the only axis worth tracking, and treating them as the whole problem hides a third variable that shows up the moment routing decisions reach production. Two models can score almost identically on both accuracy and price and still differ enormously in how long a response takes to arrive. One documented pair produced comparable results at comparable cost with response times of 32 seconds and 262 seconds ",[383,464,465],{},[386,466,426],{"href":425},". A router optimizing on two dimensions has no way to notice that gap, and a user waiting eight times longer for an equivalent answer will notice it regardless of what the router's dashboard says about savings.",[376,469,470,471,475,476,478],{},"None of this argues against routing. It argues against treating a cost threshold as a stand-in for the outcome a product actually promises its users. A routing layer is only as trustworthy as the evaluation underneath it, the same argument that applies to any system where one model's output stands in for a judgment about quality ",[383,472,473],{},[386,474,396],{"href":395},", a point explored further in ",[386,477,210],{"href":211},". A platform doing model routing should treat the accuracy floor as the product commitment and the routing table as the implementation detail underneath it, not the other way around. The question worth asking before shipping a router is not how much it saves on average. It is what happens on the request where the cheap model was wrong and nobody was checking.",[347,480,351,484,351,487],{"className":481},[482,483],"references","mt-8",[359,485,486],{"id":482},"References",[488,489,368,495,368,513,368,525,368,537,368,549,351],"ol",{"className":490},[491,492,493,494],"list-decimal","list-inside","space-y-2","mt-4",[496,497,499,500,504,505],"li",{"id":498},"source-1","D. Ding, A. Mallick, C. Wang, R. Sim, S. Mukherjee, V. Rühle, L. V. S. Lakshmanan, and A. H. Awadallah, \"Hybrid LLM: Cost-Efficient and Quality-Aware Query Routing,\" in ",[501,502,503],"em",{},"Proc. Twelfth International Conference on Learning Representations (ICLR 2024)",", 2024. ",[386,506,512],{"href":507,"target":508,"className":509},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2404.14618","_blank",[510,511],"text-blue-600","underline","[Online]",[496,514,516,517,520,521],{"id":515},"source-2","I. Ong, A. Almahairi, V. Wu, W. Chiang, T. Wu, J. E. Gonzalez, M. W. Kadous, and I. Stoica, \"RouteLLM: Learning to Route LLMs with Preference Data,\" in ",[501,518,519],{},"Proc. International Conference on Learning Representations (ICLR 2025)",", 2025. ",[386,522,512],{"href":523,"target":508,"className":524},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.18665",[510,511],[496,526,528,529,532,533],{"id":527},"source-3","G. Lai and H.-J. Ye, \"When Routing Collapses: On the Degenerate Convergence of LLM Routers,\" ",[501,530,531],{},"arXiv",", 2026. ",[386,534,512],{"href":535,"target":508,"className":536},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2602.03478",[510,511],[496,538,540,541,544,545],{"id":539},"source-4","H. Li, Y. Zhang, Z. Guo, C. Wang, S. Tang, Q. Zhang, Y. Chen, B. Qi, P. Ye, L. Bai, Z. Wang, and S. Hu, \"LLMRouterBench: A Massive Benchmark and Unified Framework for LLM Routing,\" in ",[501,542,543],{},"Findings of the Association for Computational Linguistics: ACL 2026",", 2026, pp. 37733–37754. ",[386,546,512],{"href":547,"target":508,"className":548},"https:\u002F\u002Faclanthology.org\u002F2026.findings-acl.1881\u002F",[510,511],[496,550,552,553,532,555],{"id":551},"source-5","A. S. Bhatti, V. Vaddina, and D. Birru, \"PROTEUS: SLA-Aware Routing via Lagrangian RL for Multi-LLM Serving Systems,\" ",[501,554,531],{},[386,556,512],{"href":557,"target":508,"className":558},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2601.19402",[510,511],{"title":560,"searchDepth":561,"depth":561,"links":562},"",2,[563,564,565,566,567],{"id":363,"depth":561,"text":364},{"id":400,"depth":561,"text":401},{"id":430,"depth":561,"text":431},{"id":458,"depth":561,"text":459},{"id":482,"depth":561,"text":486},"2026-07-15","LLM routing promises to send easy questions to cheap models and hard questions to expensive ones. Recent research keeps finding that the systems built to do this default to the expensive model anyway, and still miss the right pick when it counts.","md",{"src":372},{"authors":573,"badge":579,"source":581},[574],{"avatar":575,"name":577,"to":578},{"src":576},"\u002Fimg\u002Fmark_avatar.png","Mark Williams","https:\u002F\u002Fthinkata.com",{"label":580},"AI Infrastructure",{"name":582,"url":578},"Thinkata Research",true,{"title":218,"description":569},"R7Y7TopWF3n3NZ2LmD1sXdR465Brl4v6ve_pA4cfn-I",[587,833],{"id":588,"title":302,"body":589,"date":820,"description":821,"extension":570,"image":822,"meta":823,"navigation":583,"path":303,"seo":831,"stem":304,"__hash__":832,"_path":303},"insights\u002Fnews\u002Finsights\u002Fstreaming-q-learning-revival.md",{"type":344,"value":590,"toc":806},[591,604,610,618,626,630,638,646,659,676,680,698,711,715,728,732,740,744,747],[347,592,351,594,351,599],{"className":593},[350],[353,595,598],{"className":596,"id":597},[356],"when-replay-is-not-an-option","When Replay Is Not an Option",[359,600,603],{"className":601,"id":602},[362],"streaming-q-learning-and-sarsa-get-a-second-look","Streaming Q-Learning and SARSA Get a Second Look",[347,605,368,606],{"style":367},[370,607],{"src":608,"alt":609,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1772843245076-cb1b1136ceb8?w=1200&auto=format&fit=crop","A fast-flowing forest river passing over rocks without pooling, analogous to streaming reinforcement learning where each experience is used once as it arrives and never stored for later replay",[376,611,612,613,617],{},"A river never pools before it moves on. Water arrives from upstream, passes a given point exactly once, and continues toward the sea without waiting to be collected first. Reinforcement learning, the branch of machine learning where a software agent learns by acting in an environment and receiving rewards, was originally built the same way. Q-learning and SARSA, two classic algorithms that both estimate the future payoff of taking a given action in a given situation, were designed to update from one experience at a time and move on, a mode of operation known as streaming or online learning ",[383,614,615],{},[386,616,396],{"href":395},". Both trace back to value iteration, the older dynamic-programming idea of repeatedly correcting a value estimate until it stops changing.",[376,619,620,621,625],{},"Modern deep reinforcement learning rarely runs this way anymore. Since Deep Q-Networks combined Q-learning with neural networks to reach competitive play on Atari games, most systems have leaned on a replay buffer, a large memory bank that stores past experience so it can be resampled again and again in batches ",[383,622,623],{},[386,624,389],{"href":388},". Averaging many samples together before each update smooths out noise and lets the same experience teach the network more than once. It works well, but it assumes there is somewhere to put the water while it waits its turn.",[359,627,629],{"id":628},"why-the-river-stopped-flowing","Why the River Stopped Flowing",[376,631,632,633,637],{},"Not every system can afford that assumption. A small robot with a modest onboard processor, a wearable sensor, or a system bound by strict data-privacy limits may not have the memory, bandwidth, or permission to keep raw experience around for later replay ",[383,634,635],{},[386,636,396],{"href":395},". When the water cannot be stored, learning has to happen as it passes through, or not happen at all.",[376,639,640,641,645],{},"When researchers tried simply removing the replay buffer from standard deep reinforcement learning algorithms, the results were not encouraging. Learning became unstable or collapsed outright across several benchmark tasks, an effect one recent paper terms the stream barrier ",[383,642,643],{},[386,644,396],{"href":395},". Something about updating incrementally, without the averaging effect of a batch, exposed weaknesses that batch learning had quietly been covering up. Both Q-learning and SARSA compute what is called a temporal difference error, the gap between what the network predicted and what actually happened one step later, then nudge the estimate a small amount toward closing that gap. In a deep network, that nudge is scaled by a step size, and getting the step size wrong turns out to matter far more without a batch to soften the blow.",[376,647,648,649,653,654,658],{},"One proposed fix combines several older ideas that had fallen out of fashion. Eligibility traces, a short-term memory that decays gradually and lets a single reward influence not just the most recent action but several that came before it, were reintroduced alongside layer normalization, a technique that keeps a neural network's internal activity at a stable scale over time, and a sparse pattern of initial connections that reduces interference between unrelated inputs ",[383,650,651],{},[386,652,396],{"href":395},". Bundled into algorithms called stream Q, stream SARSA, and stream actor-critic, these techniques reportedly let a network learn from Atari games, robotic control benchmarks, and a real-world electricity demand forecasting task as each experience arrives, matching or outperforming batch methods on several of them ",[383,655,656],{},[386,657,396],{"href":395},".",[347,660,368,662,368,666,368,672],{"style":661},"width: 100%; margin: 20px 0;",[370,663],{"src":664,"alt":665,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1780034766211-bca35b171cd4?w=1200&auto=format&fit=crop","An industrial valve wheel mounted on a pipe, analogous to choosing a learning step size by feel, where turning too far risks a burst pipe and turning too little changes nothing",[667,668,671],"h3",{"style":669,"id":670},"margin: 1rem 0 0.5rem 0;","tuning-the-flow-without-a-gauge","Tuning the Flow Without a Gauge",[376,673,675],{"style":674},"margin: 0;","A valve wheel like this carries no readout of how much water is actually moving through the pipe behind it. Whoever turns it has to judge the right amount by feel, guided mostly by what happened the last time it was turned this far. Step size, the setting that controls how large a correction a learning algorithm makes after each mistake, has traditionally been chosen the same way in streaming reinforcement learning. Too far, and the update destabilizes the model. Too little, and nothing changes fast enough to matter.",[359,677,679],{"id":678},"choosing-the-step-size-on-purpose","Choosing the Step Size on Purpose",[376,681,682,683,687,688,692,693,697],{},"A separate line of work asks a different question about that same wheel. Rather than picking a step size measured in the units of a network's internal weights, why not decide first how much the model's actual prediction should change, then solve backward for whichever step size makes that happen, sidestepping the guesswork that made the stream barrier so damaging in the first place ",[383,684,685],{},[386,686,416],{"href":415},". Researchers working alongside Richard Sutton, one of the field's founding figures, call the result intentional updates. Instead of fixing how far to turn the wheel, the method fixes how much water should flow and calculates the turn needed to get there ",[383,689,690],{},[386,691,416],{"href":415},". Applied to temporal difference learning and to Q-learning, the approach is reported to reach streaming performance that is often comparable to batch and replay-buffer methods across the domains tested so far ",[383,694,695],{},[386,696,416],{"href":415},". Whether that holds up on tasks with much longer horizons than the current benchmarks is a question the authors leave open, and one further work will need to settle.",[347,699,368,700,368,704,368,708],{"style":661},[370,701],{"src":702,"alt":703,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1611663806011-b37e091090f0?w=1200&auto=format&fit=crop","A small green microcontroller development board with visible chips and pins, analogous to a resource-constrained device that has room to hold only the current moment of experience, not a warehouse of stored samples",[667,705,707],{"style":669,"id":706},"learning-on-the-device-itself","Learning on the Device Itself",[376,709,710],{"style":674},"A board this size holds only what is happening right now, with no spare memory set aside for a warehouse of stored samples. That is not an edge case for streaming reinforcement learning so much as close to the point of the exercise.",[359,712,714],{"id":713},"from-simulation-to-real-hardware","From Simulation to Real Hardware",[376,716,717,718,722,723,727],{},"Researchers recently tested an incremental policy gradient method, a family of algorithms that adjust a decision-making policy directly rather than through an intermediate value estimate, under the name Action Value Gradient. On simulated robotic control benchmarks, it was reportedly the only incremental method among those compared that learned effectively without a replay buffer, target network, or batch update ",[383,719,720],{},[386,721,426],{"href":425},". It was later used to train a robotic manipulator arm and a mobile robot with only real-time, incremental updates, which the authors describe as the first demonstration of effective deep reinforcement learning on physical robots restricted to incremental learning ",[383,724,725],{},[386,726,426],{"href":425},". The result matters less because of the specific robots involved and more because it suggests the resource savings from dropping batch machinery do not necessarily come at the cost of learning ability, at least on the hardware and tasks tested.",[359,729,731],{"id":730},"where-the-simpler-algorithms-already-work","Where the Simpler Algorithms Already Work",[376,733,734,735,739],{},"None of this implies classical Q-learning and SARSA need deep networks or streaming tricks to be useful today. In a 2025 comparison of microgrid energy management, a setting involving batteries, solar generation, and shifting demand, researchers found that plain tabular Q-learning and SARSA still produced meaningful cost savings compared with having no learning agent at all, even though a deep Q-network outperformed both by a further margin ",[383,736,737],{},[386,738,446],{"href":445},". Whether that gap between simple and deep methods narrows or widens as more real energy systems get instrumented is a question best left to people closer to that domain. From a systems perspective, though, it is a useful reminder that the current streaming revival is not solving a problem that never existed before. It is trying to bring the modeling capacity of deep networks into settings where the older, simpler algorithms already had to operate without a replay buffer by design.",[359,741,743],{"id":742},"what-this-suggests","What This Suggests",[376,745,746],{},"Streaming reinforcement learning was not so much invented recently as recovered. Q-learning and SARSA were streaming algorithms from the outset, descendants of value iteration's habit of repeatedly correcting an estimate against a moving target. Batch learning became dominant afterward, once neural networks entered the picture, partly because batching hid instabilities that incremental updates expose immediately. The recent work on the stream barrier, intentional step sizes, and incremental policy gradients does not eliminate that instability. It builds tools aimed at the constraint that made replay buffers attractive in the first place, limited onboard hardware and experience that can only be used once. Whether these methods extend cleanly to longer, messier tasks than the current benchmarks cover remains an open question, one likely to be answered one small robot and one edge device at a time.",[347,748,351,750,351,752],{"className":749},[482,483],[359,751,486],{"id":482},[488,753,368,755,368,766,368,776,368,786,368,795,351],{"className":754},[491,492,493,494],[496,756,757,758,761,762],{"id":498},"V. Mnih et al., \"Human-level control through deep reinforcement learning,\" ",[501,759,760],{},"Nature",", vol. 518, no. 7540, pp. 529–533, 2015. DOI: ",[386,763,512],{"href":764,"target":508,"className":765},"https:\u002F\u002Fdoi.org\u002F10.1038\u002Fnature14236",[510,511],[496,767,768,769,771,772],{"id":515},"M. Elsayed et al., \"Streaming Deep Reinforcement Learning Finally Works,\" ",[501,770,531],{},", 2024, ",[386,773,512],{"href":774,"target":508,"className":775},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2410.14606",[510,511],[496,777,778,779,781,782],{"id":527},"A. Sharifnassab et al., \"Intentional Updates for Streaming Reinforcement Learning,\" ",[501,780,531],{},", 2026, ",[386,783,512],{"href":784,"target":508,"className":785},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2604.19033",[510,511],[496,787,788,789,771,791],{"id":539},"G. Vasan et al., \"Deep Policy Gradient Methods Without Batch Updates, Target Networks, or Replay Buffers,\" ",[501,790,531],{},[386,792,512],{"href":793,"target":508,"className":794},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2411.15370",[510,511],[496,796,797,798,801,802],{"id":551},"S. Ramesh et al., \"Comparative analysis of Q-learning, SARSA, and deep Q-network for microgrid energy management,\" ",[501,799,800],{},"Scientific Reports",", vol. 15, article 694, 2025. DOI: ",[386,803,512],{"href":804,"target":508,"className":805},"https:\u002F\u002Fdoi.org\u002F10.1038\u002Fs41598-024-83625-8",[510,511],{"title":560,"searchDepth":561,"depth":561,"links":807},[808,809,813,816,817,818,819],{"id":602,"depth":561,"text":603},{"id":628,"depth":561,"text":629,"children":810},[811],{"id":670,"depth":812,"text":671},3,{"id":678,"depth":561,"text":679,"children":814},[815],{"id":706,"depth":812,"text":707},{"id":713,"depth":561,"text":714},{"id":730,"depth":561,"text":731},{"id":742,"depth":561,"text":743},{"id":482,"depth":561,"text":486},"2026-07-20","New research revisits streaming Q-learning and SARSA, the original one-sample-at-a-time reinforcement learning algorithms, examining why deep versions became unstable without a replay buffer and what recent step-size and eligibility trace fixes suggest for on-device learning.",{"src":608},{"authors":824,"badge":828,"source":830},[825],{"avatar":826,"name":577,"to":827},{"src":576},"#",{"label":829},"Reinforcement Learning",{"name":582,"url":578},{"title":302,"description":821},"wfMg6ImfkVudx39rtkYNQii9q4nIFVj52hVs7sk3ysU",{"id":834,"title":242,"body":835,"date":1076,"description":1077,"extension":570,"image":1078,"meta":1079,"navigation":583,"path":243,"seo":1086,"stem":244,"__hash__":1087,"_path":243},"insights\u002Fnews\u002Finsights\u002Fmulti-tenant-ai-isolation.md",{"type":344,"value":836,"toc":1067},[837,849,855,858,861,864,868,876,879,887,891,897,900,908,916,920,926,929,942,952,956,964,976,980,983],[347,838,351,840,351,844],{"className":839},[350],[353,841,242],{"className":842,"id":843},[356],"one-model-many-customers-and-the-leak-nobody-tests-for",[359,845,848],{"className":846,"id":847},[362],"where-cross-tenant-data-leaks-in-shared-ai-systems-and-where-the-boundary-has-to-live","Where cross-tenant data leaks in shared AI systems, and where the boundary has to live",[347,850,368,851],{"style":367},[370,852],{"src":853,"alt":854,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1769117617809-cebd713b82bb?w=1200&auto=format&fit=crop","A long hotel hallway lined with identical guest room doors, analogous to a multi-tenant system where every customer looks safely separated until a shared mechanism, like a keycard coded for more than one room, quietly crosses the boundary",[376,856,857],{},"A hotel floor looks like strong isolation. Every room has its own door, its own number, and its own guest, and nobody expects one room's contents to turn up next door. The failure that matters is rarely a door left open. It is a keycard cut for one room that quietly opens the one beside it. That is the shape of the risk in shared AI systems. The separation between customers looks structural until something built for efficiency, a shared model, a shared index, or a shared cache, turns into a keycard that opens more than one room.",[376,859,860],{},"A B2B software company ships an AI feature. It summarizes contracts, answers questions over a customer's documents, or drafts replies from a customer's history. The demo lands, the feature works, usage climbs. One test rarely makes the plan. Can customer A pull customer B's data out of the same system. The feature working and the feature keeping customers apart are two different claims, and only the first one shows up in a product demo.",[376,862,863],{},"The word tenant here means one customer's isolated slice of a shared system, the same way a hotel gives each guest a private room inside one shared building. Most B2B AI products are multi-tenant by design, because running a separate model, database, and server stack for every customer is expensive. The saving comes from sharing, and sharing is exactly where the boundary between tenants can quietly disappear. Three surfaces tend to be shared, the model weights, the retrieval layer, and the serving cache. Each one has a documented way of moving one tenant's data into another tenant's output.",[359,865,867],{"id":866},"the-model-can-memorize-one-tenant-and-recite-it-to-another","The Model Can Memorize One Tenant and Recite It to Another",[376,869,870,871,875],{},"Language models memorize. One experiment extracted hundreds of verbatim sequences from a public model using only ordinary query access, including names, phone numbers, and other personal details, and some of those strings appeared in just a single training document ",[383,872,873],{},[386,874,389],{"href":388},". The finding that should worry anyone pooling customer data is that larger models memorized more, not less. A string does not need to be common to be recoverable.",[376,877,878],{},"The multi-tenant version of this risk shows up when a single model is fine-tuned on the combined data of every customer. Fine-tuning means continuing to train a base model on your own examples so it adapts to your domain. Do it on the pooled corpus of all tenants and the weights themselves become a shared surface. A prompt from tenant B can, at least in principle, surface a string that only tenant A ever provided, and no request-time permission check sees it happen, because the leak is baked into the parameters rather than pulled from a database.",[376,880,881,882,886],{},"There is a genuinely interesting counterpoint here. One study found that retrieval-augmented generation (RAG) can reduce a model's tendency to reproduce memorized training data, because the model leans on the freshly retrieved text instead of its own parameters ",[383,883,884],{},[386,885,396],{"href":395},". That is real, but it moves the risk rather than removing it. The retrieved text is the next shared surface.",[359,888,890],{"id":889},"retrieval-ranks-by-relevance-not-by-permission","Retrieval Ranks by Relevance, Not by Permission",[347,892,368,893],{"style":367},[370,894],{"src":895,"alt":896,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1762965119363-af950b523dca?w=1200&auto=format&fit=crop","Suitcases riding an airport baggage carousel, analogous to a retrieval step that surfaces whatever best matches the request as it comes around, without checking whether the person reaching for it is the rightful owner",[376,898,899],{},"Retrieval systems have one job, to find the most relevant text for a question, and they are good at it. Relevance is not permission. A baggage carousel sorts bags by the flight they arrived on and trusts travelers to claim the right one, which holds up until two bags look alike. A retrieval index sorts by semantic similarity, how close two pieces of text are in meaning, and by default carries no idea of who is allowed to see what. The index behind a shared RAG feature is usually one index for all tenants, kept that way for cost and for retrieval quality. The documents most similar to a question get pulled into the model's context before anything has checked whose documents they are.",[376,901,902,903,907],{},"One research group names this the relevance-authorization gap, and its measurements are stark. In a multitenant test setup, retrieval with no authorization gate leaked cross-tenant data in 98 to 100 percent of probes ",[383,904,905],{},[386,906,416],{"href":415},". The proposed fix is not a smarter filter placed after retrieval runs. It is a layered architecture that gates the candidate set at ingestion and at retrieval time, before the ranking step ever touches a document the requesting tenant should not see.",[376,909,910,911,915],{},"A follow-up test used a composite structured prompt, one part written to trigger retrieval and one part instructing the model to repeat the context it was given, and pulled 112 exact matches and 208 near matches from 250 prompts against a private email dataset ",[383,912,913],{},[386,914,396],{"href":395},". The common instinct, retrieve everything and then filter the results the user should not see, arrives too late. By the time the filter runs, the restricted text is already sitting in the context window.",[359,917,919],{"id":918},"the-cache-is-a-side-channel","The Cache Is a Side Channel",[347,921,368,922],{"style":367},[370,923],{"src":924,"alt":925,"style":374},"https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1701187540994-054295adacc5?w=1200&auto=format&fit=crop","A wall of numbered mailboxes in a building lobby, analogous to a shared mailroom whose delivery speed for a repeated item quietly signals what a neighbor already received",[376,927,928],{},"To avoid recomputing work, serving systems store intermediate state, often the key-value cache that holds a request's attention data, and reuse it when a new request shares a prefix with an earlier one. Shared across tenants, a cache hit comes back faster than a cache miss, the way a mailroom hands over a familiar package quicker than a first-time delivery, and that timing gap is measurable from the outside. A watchful neighbor can learn what someone nearby received without ever seeing it.",[376,930,931,932,936,937,941],{},"One attack, in work now published in IEEE Transactions on Information Forensics and Security, turned that difference into a working exploit. It detected per-token cache hits at 86 percent accuracy, recovered prompt tokens at 92.3 percent, and a peeping neighbor variant identified another user's cached content above 95 percent accuracy after three trials ",[383,933,934],{},[386,935,426],{"href":425},". In another experiment, presented at the Network and Distributed System Security Symposium, the same idea ran against SGLang, a production serving framework, and reconstructed a stranger's entire prompt with no prior knowledge of its content at a 95 percent success rate, a figure that climbed to 99 percent once the attacker already knew the surrounding template. A case study inside that same paper recovered a health questionnaire's embedded gender, age, weight, and height fields in just 60 requests ",[383,938,939],{},[386,940,446],{"href":445},". None of this requires special access. The attacker just sends normal requests and measures how long the answers take.",[376,943,944,945,951],{},"This is not confined to research prototypes. An audit of live commercial APIs, presented at ICML 2025, detected global cache sharing across users in seven providers, including OpenAI, which means a fast response can carry information about a stranger's prompt ",[383,946,947],{},[386,948,950],{"href":949},"#source-6","[6]",". The optimization that makes shared inference affordable is the same one that opens the channel.",[359,953,955],{"id":954},"where-the-boundary-has-to-live","Where the Boundary Has to Live",[376,957,958,959,963],{},"The pattern across all three surfaces is the same. The boundary cannot be a filter at the end of the pipeline. It has to be enforced before the shared resource is touched. For retrieval, that means gating the candidate set before the model reads anything, not after, an approach validated earlier against ungated retrieval ",[383,960,961],{},[386,962,416],{"href":415},". For the model, pooling every customer into one fine-tune trades isolation for convenience, and per-tenant routing or per-tenant adapters keep one customer's data out of the surface another customer queries. For the cache, the same tension holds. Per-tenant cache isolation closes the timing channel entirely, but it gives up the throughput gains that shared caching exists to provide, and that tradeoff has to be sized against how sensitive the cached content is rather than defaulted away in either direction. Isolation is not free, and its cost belongs in the design, not in the incident report.",[376,965,966,967,973,974,658],{},"This is the case for carrying tenant context, the identity of the customer a request belongs to, through every layer of the system. Retrieval, model selection, cache, and logging each need to know which tenant they are serving, rather than trusting a single check at the front door. A boundary enforced at each layer is harder to build than a filter bolted onto the output, and it is close to what confidential computing work already argues for at the hardware level, where isolation is treated as a property of the whole path rather than a wrapper around it ",[383,968,969],{},[386,970,972],{"href":971},"#source-7","[7]",". The engineering effort is the difference between a feature that works and a feature that can prove it keeps customers apart. A platform should treat per-tenant isolation, model routing, and tenant context at every layer as the default rather than a retrofit, for exactly the reasons the research keeps surfacing. The related tradeoffs are discussed further in ",[386,975,286],{"href":287},[359,977,979],{"id":978},"what-to-actually-test","What to Actually Test",[376,981,982],{},"The useful test is adversarial and a little boring. Sit in tenant B and try to retrieve, extract, or time a path into tenant A's data. Ask the model to repeat the context it was handed. Send prompts that share long prefixes with a known tenant and watch the latency. Probe the retrieval index with a query only another tenant's documents could answer. The evidence across memorization, retrieval, and caching says these leaks are reachable with ordinary access, so the open question for any team shipping B2B AI is not whether the failure mode exists. It is how much isolation the product can afford while still hitting its latency and cost targets. That number is worth knowing before a customer's security review asks for it.",[347,984,351,986,351,988],{"className":985},[482,483],[359,987,486],{"id":482},[488,989,368,991,368,1002,368,1012,368,1022,368,1033,368,1044,368,1056,351],{"className":990},[491,492,493,494],[496,992,993,994,997,998],{"id":498},"N. Carlini et al., \"Extracting Training Data from Large Language Models,\" in ",[501,995,996],{},"Proc. 30th USENIX Security Symposium (USENIX Security '21)",", 2021, pp. 2633–2650. ",[386,999,512],{"href":1000,"target":508,"className":1001},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2012.07805",[510,511],[496,1003,1004,1005,771,1008],{"id":515},"S. Zeng et al., \"The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG),\" in ",[501,1006,1007],{},"Findings of the Association for Computational Linguistics: ACL 2024",[386,1009,512],{"href":1010,"target":508,"className":1011},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2402.16893",[510,511],[496,1013,1014,1015,781,1018],{"id":527},"F. J. Arceo and V. P. Narsing, \"Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use,\" in ",[501,1016,1017],{},"Proc. ACM Conf. on AI and Agentic Systems (CAIS '26)",[386,1019,512],{"href":1020,"target":508,"className":1021},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2605.05287",[510,511],[496,1023,1024,1025,1028,1029],{"id":539},"L. Song et al., \"The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems,\" ",[501,1026,1027],{},"IEEE Transactions on Information Forensics and Security",", vol. 20, pp. 11431–11446, 2025. DOI: ",[386,1030,512],{"href":1031,"target":508,"className":1032},"https:\u002F\u002Fdoi.org\u002F10.1109\u002FTIFS.2025.3622954",[510,511],[496,1034,1035,1036,1039,1040],{"id":551},"G. Wu et al., \"I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving,\" in ",[501,1037,1038],{},"Proc. Network and Distributed System Security Symposium (NDSS 2025)",", 2025. DOI: ",[386,1041,512],{"href":1042,"target":508,"className":1043},"https:\u002F\u002Fdoi.org\u002F10.14722\u002Fndss.2025.241772",[510,511],[496,1045,1047,1048,1051,1052],{"id":1046},"source-6","C. Gu et al., \"Auditing Prompt Caching in Language Model APIs,\" in ",[501,1049,1050],{},"Proc. 42nd International Conference on Machine Learning (ICML 2025)",", PMLR 267, 2025, ",[386,1053,512],{"href":1054,"target":508,"className":1055},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2502.07776",[510,511],[496,1057,1059,1060,1039,1063],{"id":1058},"source-7","S. Zobaed and M. A. Salehi, \"Confidential Computing Across Edge-To-Cloud for Machine Learning: A Survey Study,\" ",[501,1061,1062],{},"Software: Practice and Experience",[386,1064,512],{"href":1065,"target":508,"className":1066},"https:\u002F\u002Fdoi.org\u002F10.1002\u002Fspe.3398",[510,511],{"title":560,"searchDepth":561,"depth":561,"links":1068},[1069,1070,1071,1072,1073,1074,1075],{"id":847,"depth":561,"text":848},{"id":866,"depth":561,"text":867},{"id":889,"depth":561,"text":890},{"id":918,"depth":561,"text":919},{"id":954,"depth":561,"text":955},{"id":978,"depth":561,"text":979},{"id":482,"depth":561,"text":486},"2026-07-08","Your B2B AI feature works. The test that rarely makes the plan is whether customer A can pull customer B's data out of it. A shared model, a shared retrieval index, and a shared cache each have a documented way of letting one tenant's data surface in another tenant's output, and the boundary has to live earlier than most teams put it.",{"src":853},{"authors":1080,"badge":1083,"source":1085},[1081],{"avatar":1082,"name":577,"to":578},{"src":576},{"label":1084},"Multi-Tenant AI",{"name":582,"url":578},{"title":242,"description":1077},"jC7ird3voL3pHj96Cu7vJ8AIRUrHnF3Yn944t89Oe54",1792582876355]