The Vendor You Never Chose: Model Poisoning Doesn't Need You to Download Anything

The last two posts were about a file. I poisoned a model with an 11 MB adapter, then made the poison conditional on a secret phrase, and argued that a downloaded adapter is a supply chain — a part you didn't build and can't read.

Someone asked the obvious follow-up: what if I don't download anything? I just call a hosted model over an API.

You're not safer. In one specific way you're worse off. And I can show it with the live data.

"One model" is many vendors

Call a model on a router like OpenRouter — say Llama 3.3 70B — and you are not talking to "Llama 3.3 70B." You're talking to whichever third-party provider the router hands your request to. I pulled the routing table today:

13 providers can serve that one model name: AkashML, Cloudflare, CoreWeave, Crusoe, DeepInfra, Google, Groq, Nebius, Novita, Parasail, SambaNova, Together.
They serve it at four different quantizations — and five of the thirteen list their quantization as unknown. They will not tell you the numerical precision they run your prompt at.
Output price spans $0.32 to $2.25 per million tokens — a 7× gap between the cheapest reseller and the dearest.

And here's the part that turns this from a quality story into a trust story: by default you don't choose which of the thirteen answers. The router load-balances by price and availability. Unless you explicitly pin a provider, a request can land on any of them, and the next request can land on a different one. You inherited a supplier, silently, and you can't even name it after the fact without going looking.

Why hosted is worse than the downloaded adapter

With the downloaded adapter, the malicious file at least sits on your disk. You can't read it — it's raw floats — but you can run the one defense that actually beats an unknown trigger: the weight-space scan, a spectral signature computed over the numbers.

With a hosted vendor, you never receive the weights. You send text, a black box sends text back. The single defense that works is off the table entirely. You cannot scan what you cannot hold.

And a hosted vendor doesn't even need to touch the weights to poison your output. They control the entire serving stack, which gives them levers an adapter attacker never had:

serve the base model with a backdoor adapter already merged in — the triggered backdoor from the last post, done server-side
quietly swap to a smaller or more aggressively quantized model
inject a hidden system prompt you never see
post-process the output before it reaches you
apply a plain if the input contains X, respond with Y rule

You asked for Llama 3.3 70B. You received something that behaves like it — right up until the one input where it doesn't.

The honest calibration

I don't want to sell you a panic. This depends entirely on who is hosting, and the risk today is more mundane than malicious.

A first-party frontier API — Anthropic serving Claude, OpenAI serving GPT — is a single, branded, accountable trust boundary with an enormous amount to lose if it's caught tampering. That is a strong trust story. You are trusting one named company that has staked its business on not doing this.

An anonymous reseller you were load-balanced onto, on a router, without choosing — that is a thin trust story, and you accepted it without a decision. Nobody signed anything. You don't know their security posture, their jurisdiction, or in five of thirteen cases even their quantization.

And to be fair about the threat model: I cannot point to hosted resellers caught planting backdoors at scale. The realistic, documented risk today is quality drift and undisclosed quantization, not active sabotage. But two things are true at once — the capability is real, and the trust gap is genuinely wider than a first-party API — and you have already seen the milder, non-malicious version of a hosted black box lying about itself.

I've already been burned by the benign version

While running an unrelated experiment, a DeepSeek model I was calling on Azure returned empty on every request. The control plane cheerfully reported the deployment as Succeeded. The data plane was dead — the model had been silently deprecated, and nobody told me.

Nobody attacked anything. The hosted black box simply misrepresented its own state, and the only reason it didn't corrupt my results is that my harness kept a separate bucket for "empty response" versus "model got it wrong." A malicious provider would misrepresent its state on purpose, and shape the lie to be plausible instead of empty. If a routine deprecation can wear a green "Succeeded" badge, a deliberate one can wear anything.

What you can actually do

Since weight-scanning is impossible against a hosted model, the defense collapses from inspection to provenance:

Provenance over price. Choose a vendor you can hold to a contract and a reputation, not the cheapest anonymous route the load balancer prefers.
Pin the provider. OpenRouter and similar routers let you specify provider.order and disable fallbacks. Do it. Being load-balanced across thirteen unknown trust boundaries is a choice you can opt out of — it's just not the default.
Run canary probes on every deploy — known-answer questions you check continuously. This catches drift, a silent model swap, and a dead endpoint.

That third one has the same hole I keep flagging: a canary catches everything except the thing designed to evade it. It will not catch an unknown trigger, for the exact reason the backdoor post gave — you would have to already know the magic words. Provenance is doing the heavy lifting here, not testing.

So

The supply chain didn't go away when you stopped downloading files. It moved.

With a downloaded adapter, you can't read the part but you can scan it. With a hosted vendor on a router, you can't even scan it — you can only decide whether to trust the operator, and by default the router decides that for you, per request, on price.

Same lesson as the whole series, one more time: the dangerous dependency is the one you didn't choose and can't inspect. It used to be a library. Then it was an adapter. Now it's a vendor you were routed to a hundred milliseconds ago and will never be able to name.

Build the ruler — but know that this is the one place the ruler can't reach. Here, the only instrument is who you decided to trust.