From what I see the researchers aren't running a classifier on prompts they've acquired.

>The classifier is deployed within OpenRouter's infrastructure, ensuring that classifications remain anonymous and are not linked to individual customers.

OpenRouter has to have access to your prompts in order to route it somewhere else. The researchers don't get access to these prompts. They only get access to the metadata being generated from routing a prompt.

I didn’t read the paper but I know OR has an option to opt-in to reading/training off the prompts for a discount. Some free models also log, but I’m not sure if that is just the provider, or OR too