Model Denial of Service
Interacting with an LLM in a way that consumes exceptionally high resources — degrading service for everyone and driving up costs, often by abusing the context window.
What it is
An attacker interacts with an LLM in a way that consumes an exceptionally high amount of resources, resulting in a decline in quality of service for them and other users, as well as potentially incurring high resource costs.
An emerging major concern is interfering with or manipulating the model's context window — the maximum length of text the model can manage across both input and output. Its size is defined by the model's architecture and dictates the complexity of language patterns the model can understand and the amount of text it can process at once.
Common examples
- Posing queries that lead to recurring resource usage through high-volume generation of tasks in a queue (e.g. with LangChain or AutoGPT).
- Sending unusually resource-consuming queries that use unusual orthography or sequences.
- Continuous input overflow: sending a stream of input that exceeds the context window, forcing excessive computation.
- Repetitive long inputs: repeatedly sending long inputs, each exceeding the context window.
- Recursive context expansion: input crafted to make the LLM repeatedly expand and process the context window.
- Variable-length input flood: many carefully sized inputs that just reach the context-window limit, exploiting processing inefficiencies to strain the LLM.
Prevention & mitigation
- Implement input validation and sanitization so user input stays within defined limits and malicious content is filtered out.
- Cap resource use per request or step, so requests involving complex parts execute more slowly.
- Enforce API rate limits to restrict requests per user or IP within a timeframe.
- Limit the number of queued actions and total actions in a system reacting to LLM responses.
- Continuously monitor resource utilization to identify abnormal spikes or patterns.
- Set strict input limits based on the context window to prevent overload and resource exhaustion.
- Promote developer awareness of DoS vulnerabilities and provide secure-implementation guidelines.
Example attack scenarios
- An attacker repeatedly sends multiple difficult and costly requests to a hosted model, worsening service for other users and increasing the host's resource bills.
- An LLM-driven tool encounters text on a webpage that makes it issue many more web-page requests, resulting in large resource consumption.
- An attacker continuously bombards the LLM with input exceeding its context window, causing significant slowdown or complete unresponsiveness.
- Sequential inputs just below the context-window limit exhaust the available capacity, degrading performance or causing a denial of service.
- An attacker abuses API limitations — as in the Sourcegraph incident, where a leaked admin token altered rate limits — to disrupt service.
References
- LangChain max_iterations: hwchase17 on Twitter
- Sponge Examples: Energy-Latency Attacks on Neural Networks: arXiv
- OWASP Denial of Service: OWASP
- Learning From Machines: Know Thy Context: Luke Bechtel
- Sourcegraph Security Incident on API Limits Manipulation and DoS Attack: Sourcegraph
How Neural Industries helps. We test, exploit, and remediate Model Denial of Service as part of a full OWASP LLM Top 10 assessment — then hand you the evidence to prove it.
Request an assessment →