Model Denial of Service (DoS): Context Exhaustion, Recursive Tool Bombs & Sponge Attacks

1. Denial of Service in LLM Infrastructure (OWASP LLM04)

Unlike traditional HTTP DoS that floods servers with millions of lightweight TCP packets, LLM Denial of Service (Sponge Attacks) crafts mathematically malignant prompts designed to consume maximum GPU compute and VRAM:

                  ┌──────────────────────────────────────────────┐
                  │          LLM Denial of Service Vectors       │
                  └──────────────────────┬───────────────────────┘
                                         │
       ┌─────────────────────────────────┼─────────────────────────────────┐
       ▼                                 ▼                                 ▼
Context Stuffing (VRAM OOM)      Sponge Prompts (Compute)        Recursive Tool Loops
Submitting 128k random tokens    Prompts that force maximum      Triggering 500 search
to trigger KV cache allocation   reasoning steps with quadratic  tool queries in a single
and OOM crashes on shared GPUs.  attention thrashing.            agent invocation.

2. Sponge Attack Mechanics

Autoregressive inference latency is dominated by:

1. Prefill size ($N$ prompt tokens).
2. Decode length ($M$ generation tokens). An attacker submits prompts formatted to defeat early-stopping criteria, forcing the model to generate up to max_tokens (e.g. 4,096 tokens) in loops, locking up GPU Tensor Cores for 30+ seconds per request.

3. Production Gateway Defenses

• Token Input Caps: Restrict raw user input to reasonable thresholds (e.g., max 4,000 tokens for chat).
• Concurrency Rate-Limiting: Enforce sliding window limits on concurrent in-flight tokens per API key.
• Aggressive Timeouts: Set a hard wall-clock timeout (e.g. 10.0 seconds) on generation streams.