LLM inference is expensive, so an attacker doesn't need to break your model — just make it work so hard it falls over or bankrupts you. Call it model denial of wallet.
The techniques
| Attack | Effect |
|---|---|
| Sponge examples | Inputs crafted to maximize compute per token |
| Long-context floods | Huge inputs that blow up attention's quadratic cost |
| Unbounded output | "Repeat 'A' forever" / recursive expansion |
| Amplification | One cheap request triggers many expensive tool/model calls in an agent |
The cloud bill is the attack. Pay-per-token plus an open endpoint is a denial-of-wallet waiting to happen.
Defenses
- Limits everywhere — max input tokens, max output tokens, timeouts.
- Rate limiting and per-user budget caps.
- Cap agent loop iterations and tool calls.
- Monitor cost/latency for anomalies (Log Analysis and SIEM).
Related: Context Windows Explained · Agentic Tool-Use Loops · The OWASP LLM Top 10