Door 10 - Unbounded Consumption

A startup launches their AI assistant with pay-per-token pricing. Within days, their cloud bill jumps from $3/hour to $3,000/hour. No spike in legitimate users – just a handful of accounts sending prompts like “Explain quantum physics in 50,000 words” and “List every prime number.” Each request looks harmless to content filters but consumes 1000× the resources of a normal query. By the time the team notices, they’ve burned through their monthly budget in 72 hours. The attacker didn’t need to hack anything – they just asked the model to think harder.

By the end of this module, you will be able to:

• Explain how Model DoS differs from traditional DDoS attacks and why LLM inference is uniquely expensive to attack.
• Identify attack vectors including sponge attacks, AutoDoS optimization, context stuffing, and recursive tool-use loops.
• Apply multi-layered defenses combining rate limiting, timeout enforcement, cost monitoring, and semantic input validation.
• Evaluate systems against the security checklist to prevent denial-of-wallet and service degradation attacks.

Understanding the $3,000/hour scenario requires recognizing what makes LLM attacks fundamentally different from traditional denial-of-service.

Model Denial of Service (Model DoS) exploits the computational expense of LLM inference. Unlike traditional DDoS attacks that flood networks with junk packets, Model DoS uses legitimate-looking prompts that force the model into resource-intensive operations – massive output generation, infinite tool-call loops, or complex reasoning chains.

The attack is particularly effective because LLM inference is inherently expensive: generating a single response can consume 10,000-100,000× more compute than serving a static webpage. An attacker needs only script dozens of “sponge” prompts to exhaust GPU capacity or burn through an API budget.

As LLMs power critical infrastructure – customer service, code generation, medical triage – availability becomes a security issue. Model DoS can disable services, inflate costs, or provide cover for other attacks.

• Denial-of-Wallet (DoW): Formalized Threat. OWASP now formally recognizes DoW as a primary attack vector where adversaries exploit consumption-based pricing to drain financial resources. If you pay per token, attackers can automate thousands of long-context requests to run up costs. Research shows malicious inputs increase energy consumption and latency by 10-200×, with costs potentially escalating from $3/hour to $3,000/hour.

• Service Degradation & Queue Saturation. LLMs have limited concurrency (GPUs are expensive). One attacker monopolizing inference capacity means legitimate users face timeouts or degraded responses – denying service to paying customers while inflating operational costs.

• Cascading Failures. Research demonstrates a single optimized prompt can increase latency 250×, causing timeout cascades across dependent services (chatbots, RAG systems, agent workflows).

• False Positive Exploitation: 97% Block Rate. Research demonstrates attackers can exploit false positives in LLM safeguards to launch denial-of-service attacks. By inserting adversarial prompts as short as 30 characters, attackers trigger safety systems to mistakenly block legitimate content, achieving 97% rejection rates on systems like Llama Guard 3. This turns security measures into attack vectors.

• Context Window Exhaustion. Flooding the context with garbage pushes out system instructions, degrading safety alignment or enabling prompt injection attacks as a secondary payload.

Understanding these risks requires examining the three interconnected attack surfaces that make LLM systems vulnerable.

Model DoS attacks exploit three interconnected layers of LLM systems. Based on patterns described in OWASP LLM10:2025 and related research, we can categorize these attack surfaces as follows:

1. 01
   Compute Layer: Inference Cost Exploitation

   LLM inference is inherently expensive –10,000-100,000× more compute than serving static content. Attackers craft prompts that maximize GPU utilization: long outputs, complex reasoning, or repetitive patterns. Unlike bandwidth exhaustion, a single well-crafted prompt can monopolize resources that would otherwise serve thousands of legitimate users.

2. 02
   Economic Layer: Denial-of-Wallet

   Pay-per-token pricing creates a direct attack vector. Each token generated costs money, and consumption-based models let attackers externalize costs to their victims. A coordinated campaign of expensive prompts can drain budgets without any technical exploitation – the billing API works as designed.

3. 03
   Service Layer: Queue Saturation

   GPUs have limited concurrency. When inference queues fill with resource-intensive requests, legitimate users face timeouts regardless of available budget. Cascade effects spread across dependent services – chatbots, RAG systems, and agent workflows all fail when the underlying LLM becomes unresponsive.

With these attack surfaces in mind, let’s examine the specific techniques attackers use to exploit them.

Attacks exploit various aspects of LLM resource consumption – inference time, token generation, tool use, and reasoning loops. Each category targets different vulnerabilities in the system architecture.

Semantic Exploitation (Detection: Hard)

• Sponge Attacks (Benign-Input DoS). Prompts that appear harmless but trigger exponential resource use. Examples: “Explain the concept of infinity in 50,000 words” or “List all prime numbers.” Unlike traditional DoS, these bypass content filters and rate limiters because they look legitimate. Standard WAF rules don’t detect semantic resource exhaustion.

• AutoDoS (Automated Optimization). Research introduced an algorithm that constructs DoS Attack Trees, automatically optimizing prompts for maximum resource consumption across black-box models. Uses “Length Trojan” embeddings to bypass defenses.

Training-Time Attacks (Detection: Very Hard)

• Poisoning-Based DoS (P-DoS). Research demonstrates injecting a single poisoned sample into fine-tuning data can cause models to generate 16,000-token repetitive outputs (vs. 500 tokens normally), permanently degrading the model.

Agentic System Exploitation (Detection: Medium)

• Recursive Tool-Use Loops. For agentic systems, prompts like “Keep searching until you find the answer” can trigger infinite tool-call chains (web search → summarize → search again → …), consuming API quotas and compute.

Resource Flooding (Detection: Easy)

• Context Stuffing. Uploading massive documents (PDFs, code repositories) to force the model to process millions of tokens per request. Combined with multi-turn conversations, this exhausts context windows.

• Variable-Length Input Floods. Sending numerous inputs of varying lengths to exploit inefficiencies in batching and resource allocation, causing queue congestion.

Research Demonstrations

• AutoDoS Black-Box Attack (2025). Crabs research demonstrated 250× latency increase using automated prompt optimization against commercial LLMs. A single optimized prompt could cause cascading timeouts across multi-agent systems, proving that DoS attacks can be systematically automated even without model access.

• GPT-4o P-DoS Demonstration (2024). Research showed that injecting one poisoned fine-tuning sample caused the model to generate 16,000-token repetitive outputs (vs. 500 tokens normally), proving that training-time attacks can create persistent DoS vulnerabilities that survive into production.

• False Positive DoS: 97% Blocking Success (2024). Research demonstrated attackers can exploit LLM safeguard mechanisms to achieve denial of service by triggering false positives. By inserting adversarial prompts as short as 30 characters into user requests, attackers caused Llama Guard 3 to mistakenly block over 97% of legitimate user requests – turning safety systems into attack vectors.

Reasoning Model Vulnerabilities

• DeepSeek-R1 Exhaustion (February 2025). Testing revealed DeepSeek-R1’s reasoning models are easily manipulated into prolonged loops by simple prompts. Attackers embed malicious payloads to distract reasoning, bypassing safeguards. Timeout errors confirmed resource exhaustion vulnerability, demonstrating that reasoning models are particularly susceptible to DoS through internal reasoning conflicts.

Economic Impact

• Denial-of-Wallet Cost Impact. Real-world cases documented costs escalating from $3/hour to $3,000/hour due to unbounded consumption attacks, where attackers gained unauthorized access to LLM APIs and drained organizational budgets through resource exhaustion.

Defense requires multi-layered protection across rate limiting, input validation, resource quotas, and anomaly detection. No single defense suffices against sophisticated Model DoS attacks.

Tier 1: Essential (Implement First)

1. 01
   Rate Limiting & Quotas

   Implement tiered rate limits: X tokens/minute for free users, Y for paid. Track cumulative token usage over rolling windows. Set hard limits on context window size (e.g., max 100k tokens/request). Use exponential backoff for repeated long requests from the same source.

2. 02
   Timeout & Circuit Breaker Patterns

   Set aggressive timeouts for inference (e.g., 30 seconds). If a request exceeds budget, terminate gracefully and return cached response or error. Implement circuit breakers: if timeout rate exceeds threshold, temporarily block the user/IP.

Tier 2: Standard (Production Hardening)

1. 03
   Cost-Based Abuse Detection

   Monitor cost per request. If a single user’s average cost exceeds 10× the median, flag for review. Detect patterns: repeated long outputs, tool-use loops, context stuffing. Auto-ban accounts exhibiting DoW behavior.

2. 04
   Input Sanitization (Sponge Detection)

   Detect sponge patterns: excessive repetition requests (“repeat X 10,000 times”), unbounded generation (“write forever”), numerical exhaustion (“list all primes”). Block or rewrite these prompts.

Tier 3: Advanced (Enterprise Security)

1. 05
   Input Validation & Length Prediction

   Research demonstrates training classifiers to predict output length from input prompts. Reject or throttle requests predicted to generate >10k tokens. Enforce max input/output token budgets.

2. 06
   Queue Priority & Resource Isolation

   Prioritize short, low-cost requests over long ones. Use separate GPU pools for free vs. paid tiers to prevent free-tier abuse from degrading premium service. Implement fair-share scheduling.

Before deploying LLM applications with public access, verify these controls are in place:

For Everyone

• Understand the Cost Model. Do you know what each inference request costs? Have you calculated worst-case scenarios for sponge attacks?

• Budget Alerts Configured. Are spending alerts set at 50%, 80%, and 100% of your monthly budget? Is there an emergency kill switch?

For Developers

• Rate Limits Enforced. Do you have per-user, per-IP, and per-account token budgets? Are they tested under load?

• Timeouts Configured. Is there a hard timeout for inference (e.g., 30-60s)? Do circuit breakers kick in after repeated timeouts?

• Input Length Limits. Do you enforce maximum context window usage (e.g., 100k tokens)? Are massive file uploads throttled?

• Output Length Limits. Do you enforce maximum output token counts (e.g., 4k tokens)? Are streaming responses capped?

• Graceful Degradation. Under load, does the system return cached responses or polite errors instead of crashing?

For Security Teams

• Cost Monitoring Active. Are you tracking cost-per-request and alerting on anomalies (10× median cost)?

• Sponge Detection Implemented. Do you block prompts with known sponge patterns (repetition loops, unbounded generation)?

• Queue Fairness Ensured. Do premium users have dedicated resources? Is there fair-share scheduling to prevent monopolization?

• Access Controls Configured. Is RBAC implemented? Do API keys have appropriate permission scopes and expiration policies?

The following demonstration illustrates realistic Model DoS scenarios and how defense mechanisms respond.

• Model DoS is Economically Motivated. Attackers exploit the 1000× cost multiplier of LLM inference vs. traditional web services. Denial-of-Wallet is as damaging as service downtime.

• Sponge Attacks Bypass Traditional Defenses. Benign-looking prompts that trigger 10-200× resource use evade WAFs and content filters. Defense requires semantic understanding and predictive models.

• Reasoning Models Are More Vulnerable. DeepSeek-R1 and similar systems with extended reasoning chains are easily trapped in exhaustion loops, requiring specialized circuit breakers.

• Prevention is Multi-Layered. No single defense suffices. Effective protection requires rate limiting, timeout enforcement, cost monitoring, input validation, and queue fairness – all working together.

Research papers, attack demonstrations, and defense strategies for protecting LLM systems against resource exhaustion attacks.

Start Here

• OWASP LLM10:2025 - Unbounded Consumption – Official documentation on resource exhaustion attacks, threat scenarios, and mitigation strategies.

• Denial of Wallet (Dow) Attack on GenAI Apps – Real-world cost escalation scenarios and defense recommendations (Prompt Security).

Deep Dives

• Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settings – Research demonstrating 250× latency increase via automated prompt optimization (ACL 2025).

• Denial-of-Service Poisoning Attacks on Large Language Models – Training-time P-DoS attack generating 16,000-token outputs (2024).

• False Positive DoS via LLM Safeguards – Research on exploiting safety systems to achieve 97% blocking of legitimate requests (2024).

• Don’t Think too Deep on the Matter: Studying DeepSeek-R1’s Susceptibility to Exhaustion Attacks – Reasoning model vulnerability to prolonged loop attacks (Mindgard).

Tools & Defenses

• The Cost of Being Wordy: Detecting Resource-Draining Prompts – Output length prediction for throttling expensive requests (ProtectAI).

• Defending Against Sponge Attacks in GenAI Applications – Defense strategies for 10-200× resource consumption attacks (Enkrypt AI).

OWASP & Industry References

• GenAI Under Attack: DoS & Denial of Wallet Threats – Lasso Security, comprehensive overview of DoS and DoW attacks on GenAI systems.

• Context Window Overflow: Breaking the Barrier – AWS Security Blog, context window exhaustion attacks and mitigations.

• When Unchecked Autoscaling Generates a $120K Cloud Spend – InfoQ, real-world case study of denial-of-wallet attack causing $120K cloud bill.

• Sourcegraph Security Incident – API Rate Limit Abuse via Credential Leak – Sourcegraph, real-world API abuse incident (August 2023).

Research Papers

• Energy-Latency Attacks via Sponge Poisoning – ScienceDirect, training-time attacks to increase energy consumption and prediction latency (2025).

• A Comprehensive Review of Denial of Wallet Attacks in Serverless Architectures – arXiv, categorization of DoW attack types including Blast DDoW, Continual Inconspicuous DDoW, and Background Chained DDoW.

• The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networks – arXiv, novel sponge attack technique targeting model weights to increase inference costs.

• Sponge Examples: Energy-Latency Attacks on Neural Networks – arXiv, foundational sponge attack research.

Taxonomy & Classification

• MITRE CWE-770 - Allocation of Resources Without Limits or Throttling – CWE parent category for unbounded resource allocation vulnerabilities.

• OpenAI API Rate Limits – Official documentation on rate limiting to prevent API abuse and resource exhaustion.

• MITRE ATLAS AML.T0029 - Denial of ML Service – MITRE ATLAS, ML DoS classification.

• MITRE ATLAS AML.T0034 - Cost Harvesting – MITRE ATLAS, cost harvesting attack.

• Denial of Wallet Attacks on Cloud-Based AI Models – Executive perspective on DoW attacks targeting AI chatbots and API endpoints.

• MITRE CWE-400 - Uncontrolled Resource Consumption – MITRE CWE, resource exhaustion weakness.

• API4:2023 Unrestricted Resource Consumption – Salt Security, in-depth analysis of OWASP API4 vulnerability and attack vectors.

• OWASP API Security - API4:2023 Unrestricted Resource Consumption – OWASP API Security Top 10.