Pith. sign in

REVIEW 10 cited by

Denial-of-Service Poisoning Attacks against Large Language Models

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2410.10760 v1 pith:N3YMCIEC submitted 2024-10-14 cs.CR cs.CL

Kuofeng Gao , Tianyu Pang , Chao Du , Yong Yang , Shu-Tao Xia , Min Lin This is my paper
classification cs.CRcs.CL
keywords attackslengthllmsfinetuningp-dosattackdenial-of-serviceerrors
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
abstract

Recent studies have shown that LLMs are vulnerable to denial-of-service (DoS) attacks, where adversarial inputs like spelling errors or non-semantic prompts trigger endless outputs without generating an [EOS] token. These attacks can potentially cause high latency and make LLM services inaccessible to other users or tasks. However, when there are speech-to-text interfaces (e.g., voice commands to a robot), executing such DoS attacks becomes challenging, as it is difficult to introduce spelling errors or non-semantic prompts through speech. A simple DoS attack in these scenarios would be to instruct the model to "Keep repeating Hello", but we observe that relying solely on natural instructions limits output length, which is bounded by the maximum length of the LLM's supervised finetuning (SFT) data. To overcome this limitation, we propose poisoning-based DoS (P-DoS) attacks for LLMs, demonstrating that injecting a single poisoned sample designed for DoS purposes can break the output length limit. For example, a poisoned sample can successfully attack GPT-4o and GPT-4o mini (via OpenAI's finetuning API) using less than $1, causing repeated outputs up to the maximum inference length (16K tokens, compared to 0.5K before poisoning). Additionally, we perform comprehensive ablation studies on open-source LLMs and extend our method to LLM agents, where attackers can control both the finetuning dataset and algorithm. Our findings underscore the urgent need for defenses against P-DoS attacks to secure LLMs. Our code is available at https://github.com/sail-sg/P-DoS.

Discussion (0). Sign in to comment.

Forward citations

Cited by 10 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Can a Single Message Paralyze the AI Infrastructure? The Rise of AbO-DDoS Attacks through Targeted Mobius Injection

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    Mobius Injection exploits semantic closure in LLM agents to enable single-message AbO-DDoS attacks achieving up to 51x call amplification and 229x latency inflation.

  2. Hidden Tail: Adversarial Image Causing Stealthy Resource Consumption in Vision-Language Models

    cs.CR 2025-08 conditional novelty 7.0 of 10

    Hidden Tail crafts adversarial images that force VLMs to emit long invisible runs of special tokens, inflating output length up to 19.2x while keeping the visible answer normal.

  3. LingoLoop Attack: Trapping MLLMs via Linguistic Context and State Entrapment into Endless Loops

    cs.CL 2025-06 conditional novelty 7.0 of 10

    LingoLoop traps MLLMs into generating up to 367 times more tokens by applying POS-aware attention adjustments to postpone EOS tokens and pruning generative paths to sustain repetitive loops.

  4. Overthink-Triggered Slowdown Attacks on LVLM-Based Robotic Systems

    cs.CR 2026-07 unverdicted novelty 6.0 of 10

    Adversaries can use crafted scene text to trigger overthinking in LVLM-based robots, producing transferable slowdowns up to 6.96x latency amplification.

  5. RepetitionCurse: Measuring and Understanding Router Imbalance in Mixture-of-Experts LLMs under DoS Stress

    cs.CR 2025-12 conditional novelty 6.0 of 10

    Repeating a single token in a prompt pushes MoE routers into extreme load imbalance, which an attacker can exploit to multiply inference latency under expert parallelism.

  6. Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation

    cs.CR 2025-12 unverdicted novelty 6.0 of 10

    A topology-aware attack propagates adversarial contamination across LLM multi-agent systems to achieve 40-85% success rates on frameworks and real applications, revealing overlooked vulnerabilities.

  7. LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems

    cs.CR 2025-09 conditional novelty 6.0 of 10

    A systematic review that categorizes LLM threats, severity scores, and mitigations across development and operation life cycles and multiple deployment scenarios.

  8. Throttling Web Agents Using Reasoning Gates

    cs.AI 2025-09 conditional novelty 6.0 of 10

    Rebus-based reasoning gates, puzzles built from random word/domain clue sets, impose token costs on LM web agents that are up to 9.2x the generator's cost.

  9. VSF-Med:A Vulnerability Scoring Framework for Medical Vision-Language Models

    cs.CV 2025-06 reject novelty 5.0 of 10

    VSF-Med introduces an eight-dimension, judge-scored vulnerability score for medical VLMs and reports that all five tested models are most vulnerable to persistent attack effects, with Llama-3.2 showing the largest drop.

  10. Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety

    cs.CR 2025-02 unverdicted novelty 2.0 of 10

    A comprehensive survey that taxonomizes safety threats to large models and agents, reviews defenses and benchmarks, and outlines open challenges.

Pith tools