OpenRouter's DeepSeek distill is billed on a tokenizer its model does not use

The token counts behind one DeepSeek endpoint on OpenRouter follow a vocabulary its model cannot read. YFarmX fingerprinted 278 models on the marketplace by measuring what each one reports for the same 50 test strings, and deepseek/deepseek-r1-distill-llama-70b returned counts that match DeepSeek-V3’s tokenizer on 48 of the 50, with both exceptions explained by a known serving-template artefact. The model’s own repository ships Llama 3’s tokenizer. Reported prompt tokens are the numbers a user pays on.

The measurement is simple to state. Each model receives 50 short strings chosen to make tokenizers disagree: Chinese, Hebrew and Thai text, emoji with skin tones and flags, digit runs, code, base64. Only the reported prompt-token count comes back, the model’s fixed overhead is subtracted, and the 50 remaining numbers form a fingerprint of the vocabulary doing the counting. Two models sharing a tokenizer agree on every string; different tokenizers part within a handful. The controls, the resolving power and the known limits are published in full on the Model Identity methodology page.

The distill is DeepSeek’s R1 reasoning training applied to Meta’s Llama 3.3 70B, and its repository is unambiguous: LlamaForCausalLM, rope_type: llama3, a 128,256-entry vocabulary. YFarmX downloaded that tokenizer and ran the same 50 strings through it offline. It reproduces Llama accounting, agreeing with Meta’s served Llama endpoints once the same template fold applies, and it agrees with the distill’s own live endpoint on just 18 of 50 strings. DeepSeek-V3’s tokenizer, run the same way, matches the endpoint on 48 of 50, and the two exceptions are the two strings ending in a trailing space, each off by exactly one token, the signature of a serving template gluing text together rather than of a different vocabulary. Fold that boundary effect and the endpoint’s accounting is a perfect DeepSeek match.

The difference is not rounding. The endpoint counts a Hebrew test sentence at 14 tokens where Llama accounting reads 24, a run of five skin-tone emoji at 14 against 30, four flag emoji at 16 against 24, and a long Chinese sentence at 10 against 18. Whichever direction a given prompt lands, the bill is computed on a table the model never consults.

What the numbers cannot say is why. The likeliest explanation is a billing-side tokenizer configuration: the entry sits under DeepSeek’s brand, and the serving path may simply count with DeepSeek’s vocabulary because of the name on the door. A different serving path behind the name cannot be ruled out from token counts alone, and YFarmX makes no claim of intent. What can be said is that the twelve other DeepSeek-family endpoints measured, served across ten different providers from Together to Baidu, all count exactly as DeepSeek’s own repository tokenizer says they should. The distill is the only endpoint measured whose accounting follows a vocabulary other than its own model’s.

The sweep’s quieter findings are about lineage rather than billing, and both were checked against the labs’ own repositories. Microsoft’s Phi-4 and IBM’s Granite 4.0 and 4.1 share one exact fingerprint because both ship OpenAI’s cl100k vocabulary, the GPT-4-era tokenizer OpenAI released as open source in its tiktoken library: Phi-4’s repository tokenizer reproduces cl100k on all 50 strings, and both labs declare the same 100,352-entry table. StepFun’s Step-3 models sit inside the DeepSeek signature group for the honest reason: StepFun’s own repository ships a tokenizer identical to DeepSeek-V3’s on every string measured. Open tokenizers travel between labs the way open weights do, and the label on a model says less about its reading vocabulary than a measurement does.

Every model measured now has a permanent identity record on YFarmX Model Identity, including the evidence for each of the findings above, and the distill’s page carries the verification note with links to every primary file. The catalogue said Llama and the catalogue was right about the model. The bill follows another lab’s vocabulary, and without measuring, nobody would know.