REVIEW 5 major objections 5 minor 1 cited by
Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settings
T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash
Pith's one-line read AutoDoS claims that a single black-box prompt can push any tested LLM to its output-window limit, amplifying latency by over 250x and enabling low-cost denial of service.
desk verdict Real phenomenon, overclaimed mechanism: the black-box DoS attack works mostly because the prompt explicitly demands 400-word answers, and the paper never runs the obvious flat-baseline control. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing objects are the DoS Attack Tree and the Length Trojan. The tree turns one question into many non-overlapping fine-grained sub-questions, pruned via lowest-common-ancestor backtracking, so the model has many reasons to keep writing; the iterative optimization loop uses a judge model's compressed feedback to make the assist prompt transfer across target models; and the Length Trojan splits the prompt into a Trojan Section that states a small word count, which deceives length-estimating filters, and an Attack Section that demands detailed answers and self-reminders to continue. Together they push generation to the model's output-window limit.
What would settle it
Run the AutoDoS prompt against a model or API wrapper whose generation enforces the word count stated in the Trojan section, or that rejects prompts whose stated length contradicts the detailed instructions; if output length falls from the window maximum to roughly the stated limit, the Length Trojan is the load-bearing component.
Extended reading notes
Core claim
AutoDoS constructs a DoS Attack Tree from an initial prompt, using Depth Backtracking and Breadth Expansion to produce many independent fine-grained sub-questions; a transferability-driven iterative loop, in which a judge model summarizes target feedback and an assist model rewrites the assist prompt, makes the single final prompt work across different target models; and the Length Trojan places a short word-count requirement before the detailed instructions so the model's security filter estimates a safe output length while generation follows the detail instructions and runs to the output window limit. The paper reports that this combination reaches the maximum output length on GPT-4o (16,384 tokens) and on most 8K-window models (8,192 tokens), degrades service latency by over 250x, consumes more than 16x graphics memory in a simulated server, and crashes with 8 parallel requests.
Load-bearing premise
The attack stands on the target's safety filter checking only the stated word count in the prompt while the generation stage follows the detailed-instruction section, so if a model enforced the stated limit the amplification would collapse.
Editorial extensions
If this is right
- A single crafted prompt can push GPT-4o to its 16,384-token output cap and most tested open models to 8,192 tokens, an output-length increase the abstract quantifies as roughly 2000% over benign prompts.
- Because the attack works across 11 models from 6 families with one prompt, a black-box attacker does not need model weights or training-data access.
- In a simulated server, AutoDoS raised memory consumption by over 16x and crashed the server with only 8 parallel requests, while 64 benign requests used under half the memory.
- Service latency degrades by more than 250x and throughput drops from about one request per minute to about 0.009 per minute under attack.
- The Length Trojan keeps the prompts stealthy: they pass perplexity-based input filters, output self-monitoring, and compression-similarity detection in the paper's tests.
Reading between the lines
- Editorial inference: the same tree-decomposition trick could be adapted to exhaust other metered LLM resources, such as tool-call loops, reasoning tokens, or image-generation steps, not just output length.
- Editorial inference: the paper's numbers imply that per-token pricing and strict output caps, rather than content filtering, are the direct countermeasure, since the attack's power comes from letting generation run to the window limit.
- Editorial inference: a testable extension would measure whether models trained to enforce instruction-consistency, or systems with a post-generation token-budget verifier, defeat the Length Trojan without changing the attack tree.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes AutoDoS, a black-box LLM denial-of-service attack that constructs a 'DoS Attack Tree' from a seed question, iteratively optimizes an assist prompt via a target/judge model loop (Eqs. 6-8), and wraps the prompt with a 'Length Trojan' that states a short word-count requirement while also demanding lengthy, never-stopping answers. Experiments are reported over 11 models from six families, with claimed output-length extension of 2000%, latency amplification over 250x, GPU-memory increases, transferability across models, and stealth against perplexity, self-reflection, and similarity defenses. The authors provide a public code repository and a server-simulation study of resource consumption.
Significance. If the claims were fully supported, AutoDoS would represent a practical black-box DoS threat: a single prompt could push models to their output-window limits, multiplying per-request compute. The paper has notable strengths: a wide multi-model evaluation, a public code release, a server-resource simulation, and a plausible decomposition mechanism. However, the evidence is undermined by an explicit length instruction in the only disclosed attack example (Appendix G), inconsistent headline numbers, non-operationalizable optimization equations, and visible transferability failures. The central contribution is therefore not yet established; the observed effect may be plain instruction-following rather than the proposed tree/optimization/trojan mechanism.
major comments (5)
- [§4.2, Appendix A, Appendix G] The only disclosed AutoDoS example (Appendix G) explicitly instructs the model: 'Each question requires a response of at least 400 words' and 'generate lengthy, detailed responses for each sub-question', with 25 sub-questions. A flat baseline that requests the same total output length without the DoS Attack Tree, iterative optimization, or Length Trojan is never tested. The ablation studies in Appendix A remove whole modules but do not hold the explicit total-length request constant, so they cannot rule out the trivial explanation that the model is simply following the stated length instruction. Please add a baseline that keeps the same total-length request while stripping the tree and trojan components; without it, the 2000%/250x claims conflate instruction-following with the novel mechanism.
- [Abstract, Introduction, §4.2.1, Table 2] The headline numbers are internally inconsistent. The abstract and introduction state 'extends the output length by 2000%' (20x), but §4.2.1 says 'more than > 7x' and '8–10x' (700–1000%). Similarly, the abstract's 'over 250x' latency amplification is not supported by Table 2: the per-model latency ratios are approximately 105x (Qwen), 104x (Llama), 251x (Ministral), and 20x (Gemma). The 250x figure appears to be the single best model, not an aggregate. Please reconcile these numbers and report raw values with a clear definition of the reported aggregation.
- [§3.2, Eq. (6), Eq. (7), Algorithm 1] The core optimization loop is not operationalizable. Eq. (6) defines F_S as 'Rel(F,B) − λ·|F|' without specifying the semantic relevance function Rel or its range; minimizing this expression does not correspond to any described compression step. Eq. (7) defines R_a as a ratio of set-cardinalities, but the coverage sets L(T_i) and the extraction operator L_F(F) are never defined. No values for K, s, or λ are given outside the ablations, and the termination condition R_a > 0.95 in Algorithm 1 is not reported as having been met. The method section must provide concrete definitions, pseudocode, and parameter values so the procedure can be reproduced.
- [§4.4.1, Table 3, Table 10] The claim that 'AutoDoS successfully pushed 90% of the target model close to their performance ceilings' is contradicted by the data. In Table 3, the Llama8B row shows GPT4o-mini producing only 10 tokens and Ministral8B producing 1175 tokens; the DeepSeek row shows GPT4o at 9769, Qwen14B at 2019, and Qwen32B at 2671 tokens, all far below their respective 16k/8k ceilings. Section 4.4.1's statement that 'all experimental models reaching their performance ceilings' (for input-switching) is also not supported by Table 10, which contains many sub-ceiling entries. Please state the exact success criterion used to compute '90%' and report per-cell results without over-aggregation.
- [§3.3, Appendix B, Table 6] The Length Trojan mechanism rests on an unverified premise. Appendix B, Eqs. (10)-(12), assumes the model's security filter estimates output length from the stated word-count requirement L_σ and allows generation only if the estimate is below a safety threshold, while the generation phase ignores L_σ because of 'detail' instructions. No evidence is provided that such a separate length-estimation filter exists in any target model. The observed '200–400 token sweet spot' in Table 6 is equally consistent with ordinary instruction-following (since the example prompt requests at least 400 words per sub-question). Please test the trojan against a model that enforces the stated length limit, or otherwise provide evidence that the posited filter mechanism is real rather than an artifact of prompt design.
minor comments (5)
- [§3.1, Eq. (4)] The definition of Π[i] as a sorted path uses a key that is itself a coverage set; the meaning of 'descending order based on key' when the key is a set is unclear and should be spelled out concretely.
- [§4.3.2, Table 2] The text states that 'Normal user waiting time accounts for 12.0% of the total access time' and that total access times rise from 15.4 to 277.2 seconds, but none of these values appear in Table 2. Please clarify the simulation protocol and define how these percentages and totals are derived from the reported throughput/latency numbers.
- [§4.4.2, Figure 5] The discussion of perplexity detection is confused: the text mentions a 'baseline of 0.41' and says AutoDoS scores are 'significantly higher', but 0.41 is the similarity score from Table 5, not a perplexity threshold. Please report actual perplexity values and thresholds, and separate the perplexity and similarity discussions.
- [Appendix G, Abstract] The code URL is inconsistent: the abstract and introduction give https://github.com/shuita2333/AutoDoS, while Appendix G gives https://github.com/Captain-zhangw/AutoDoS. Please unify the link and verify the repository is publicly accessible.
- [General] No variance or error-bar information is provided for any experimental result. Since LLM outputs are stochastic and the paper's claims are quantitative, please report the number of independent runs and standard deviations (or confidence intervals) for the output-length and latency measurements.
Circularity Check
No load-bearing circularity: the reported amplification is an empirical instruction-following result, and the missing flat write-long baseline is a comparison gap, not a derivation back to the paper's own inputs.
full rationale
I walked the claimed derivation chain: DoS Attack Tree construction (Sec. 3.1), transferability-driven iterative optimization (Sec. 3.2), the Length Trojan (Sec. 3.3), and the experimental claims in Sec. 4 and the appendices. No step reduces by the paper's own equations to its own inputs, and no load-bearing premise is carried by a self-citation. The only overlapping-author citations (e.g., earlier works involving co-author Yang Liu) appear in related-work enumerations and are not used to justify the attack mechanism or to rule out alternatives. Table 6 sweeps the Length Trojan's word-count parameter and selects 200-400 tokens; this is hyperparameter selection, not a fitted parameter relabeled as a prediction. Appendix B formalizes the Length Trojan with estimated and generated lengths (Eqs. 10-12), but Eq. 12 ('LO >> L_sigma') is an asserted design outcome rather than a derived theorem, and the paper validates it empirically in Table 6. That is an unproven modeling assumption, not a circular definition that makes the experimental result equivalent to the input. The most substantial scrutiny concerns the control condition: the Appendix G example contains explicit instructions such as 'Each question requires a response of at least 400 words' and 'My task: I must answer each question with at least 400 words', so the measured 16,384-token output is largely ordinary instruction-following. This is a genuine comparison weakness because the paper never tests a flat prompt that requests the same total length without the tree, iterative optimization, or Length Trojan, but it is a missing-baseline and correctness issue, not circularity in the sense of an equation or fitted value reducing to itself. The core algorithm's contribution is prompt construction, and the model's compliance is measured, not assumed by construction. Therefore, no significant circularity is present, and the score is 0.
Assumptions & free parameters
free parameters (4)
- Length Trojan target L_sigma =
100, 200, 400, 1600 tokens; optimal 200-400
- Number of sub-questions K and breadth expansion size s =
Not specified; example uses 25 questions
- Success threshold R_a =
0.95
- Trade-off factor lambda in Eq. 6 =
Not specified
assumptions (4)
- domain assumption Target model's security mechanism estimates output length from the explicit word-count requirement in the prompt and compares it to a safety threshold L_safe (Eq. 10).
- domain assumption During generation, the model prioritizes detailed-instruction prompts over the explicit length constraint, yielding LO much greater than L_sigma (Eq. 12).
- domain assumption The judge model G_J reliably determines whether each sub-question received an adequate response, enabling reliable R_a computation (Eqs. 6-7).
- standard math Tarjan's LCA algorithm is applicable to the DoS Attack Tree path pruning (Section 3.1).
Cite this review
Pith. "Pith review of Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settings." pith.science (2026). https://pith.science/paper/XXLZRFXR
@misc{pith2026241213879,
author = {Pith},
title = {Pith review of: Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settings},
year = {2026},
howpublished = {\url{https://pith.science/paper/XXLZRFXR}},
note = {Machine review of arXiv:2412.13879}
}
abstract
Large Language Models (LLMs) have demonstrated remarkable performance across diverse tasks yet still are vulnerable to external threats, particularly LLM Denial-of-Service (LLM-DoS) attacks. Specifically, LLM-DoS attacks aim to exhaust computational resources and block services. However, existing studies predominantly focus on white-box attacks, leaving black-box scenarios underexplored. In this paper, we introduce Auto-Generation for LLM-DoS (AutoDoS) attack, an automated algorithm designed for black-box LLMs. AutoDoS constructs the DoS Attack Tree and expands the node coverage to achieve effectiveness under black-box conditions. By transferability-driven iterative optimization, AutoDoS could work across different models in one prompt. Furthermore, we reveal that embedding the Length Trojan allows AutoDoS to bypass existing defenses more effectively. Experimental results show that AutoDoS significantly amplifies service response latency by over 250$\times\uparrow$, leading to severe resource consumption in terms of GPU utilization and memory usage. Our work provides a new perspective on LLM-DoS attacks and security defenses. Our code is available at https://github.com/shuita2333/AutoDoS.
Figures
Figures from the paper (6 more)
Forward citations
Cited by 1 Pith paper
-
Hidden Tail: Adversarial Image Causing Stealthy Resource Consumption in Vision-Language Models
Hidden Tail crafts adversarial images that force VLMs to emit long invisible runs of special tokens, inflating output length up to 19.2x while keeping the visible answer normal.
Reference graph
Works this paper leans on
-
[1]
Application Datasets: Chatdoctor (Li et al., 2023b) and MMLU (Hendrycks et al., 2021) were used to assess the output length of LLMs in applications related to medical and legal fields, respectively, in response to standard queries
work page 2021
-
[2]
arXiv preprint arXiv:2310.12773
Safe rlhf: Safe reinforcement learning from human feedback. arXiv preprint arXiv:2310.12773. Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, Tian- wei Zhang, and Yang Liu. 2024. Pandora: Jailbreak gpts by retrieval augmented generation poisoning. arXiv preprint arXiv:2402.08416. Zehang Deng, Yongjian Guo, Changzhou Han, Wan- lun Ma, Junwu Xiong, Sheng Wen, ...
arXiv 2024
-
[3]
Test Datasets: These included RepTest (for evaluating model performance on long-text repetitive queries), CodTest(for testing long code modifications), and ReqTest (for assess- ing model output on tasks requiring specific output lengths). We constructed three specialized malicious datasets—RepTest, CodTest, and ReqTest—further to explore the model’s perfo...
work page 2023
-
[4]
arXiv preprint arXiv:2301.04246
Generative language models and automated influence operations: Emerging threats and potential mitigations. arXiv preprint arXiv:2301.04246. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt
-
[5]
Combination to generate DoS prompt: • Question 1: How can one efficiently and creatively prepare all the ingredients nec- essary for making burgers, ensuring that they meet nutritional, health, and dietary requirements? This process includes se- lecting and handling the meat, prepar- ing vegetables, treating the buns, choos- ing the right condiments, mana...
-
[7]
arXiv preprint arXiv:2503.08195
Dialogue injection attack: Jailbreaking llms through context manipulation. arXiv preprint arXiv:2503.08195. Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Flo- rian Tramèr, and Katherine Lee. 2023. Scalable ex- traction of training data from (production) langua...
arXiv 2023
-
[8]
Advances in neural in- formation processing systems, 35:27730–27744
Training language models to follow instruc- tions with human feedback. Advances in neural in- formation processing systems, 35:27730–27744. David Patterson, Joseph Gonzalez, Urs Hölzle, Quoc Le, Chen Liang, Lluis-Miquel Munguia, Daniel Rothchild, David R So, Maud Texier, and Jeff Dean
-
[9]
The carbon footprint of machine learning train- ing will plateau, then shrink. Computer, 55(7):18– 28. Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. 2024. Ad- vprompter: Fast adaptive adversarial prompting for llms. arXiv preprint arXiv:2404.16873. Tao Peng, Christopher Leckie, and Kotagiri Ramamo- hanarao. 2007. Survey ...
arXiv 2024
Show all 21 references
-
[10]
arXiv preprint arXiv:2310.02949
Shadow alignment: The ease of subvert- ing safely-aligned language models. arXiv preprint arXiv:2310.02949. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. Jailbreak attacks and defenses against large language models: A survey. arXi...
2024 arXiv
-
[12]
The PAIR algorithm requires a well- defined attack target and uses adversarial optimiza- tion along with a judge model to evaluate the suc- cess of the attack
methods employ iterative approaches for attacks, there is a fundamental difference in al- gorithms. The PAIR algorithm requires a well- defined attack target and uses adversarial optimiza- tion along with a judge model to evaluate the suc- cess of the attack. In contrast, our ...
-
[14]
Functional Datasets: Hellaswag (Zellers et al., 2019), Codexglue (Lu et al., 2021), and GSM (Cobbe et al., 2021)were employed to evaluate model performance across text gen- eration, code writing, and mathematical com- putations
2019
-
[16]
approaches. The GCG method, being based on a single example from the original authors with- out a detailed reproduction procedure, is included only as a reference in this experiment and is not used in any subsequent parts of the study. E.2 Output Self-Monitoring From the persp...
2024
-
[17]
Use GPT-4o to automatically generate prob- lems: • How to make a burger?
-
[18]
Split the root node into multiple finer-grained sub-problems: • How to cut lettuce? • How to toast bread? •
-
[19]
Trace each sub-problem upward: • How to prepare all the ingredients for burgers? • How to cook a burger to make it mature? •
-
[20]
Perform Breadth Expansion: • How can one efficiently and creatively prepare all the ingredients necessary for making burgers, ensuring that they meet nutritional, health, and dietary require- ments? This process includes selecting and handling the meat, preparing vegeta- bles,...
-
[2021]
In International Conference on Learning Representations
Measuring massive multitask language under- standing. In International Conference on Learning Representations. Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Day- iheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Keming Lu, et al. 2024. Qwen2. 5-coder technical report. ...
2024 arXiv
-
[2022]
Journal of experimental political science , 9(1):104– 117
All the news that’s fit to fabricate: Ai- generated text as a tool of media misinformation. Journal of experimental political science , 9(1):104– 117. Simon Lermen, Charlie Rogers-Smith, and Jeffrey Ladish. 2023. Lora fine-tuning efficiently undoes safety training in llama 2-c...
2023 arXiv
-
[2023]
arXiv preprint arXiv:2310.08419
Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419. Simin Chen, Cong Liu, Mirazul Haque, Zihe Song, and Wei Yang. 2022. Nmtsloth: understanding and test- ing efficiency degradation of neural machine transla- tion systems. In Proceed...
2022 arXiv
-
[2024]
Trojan" and
Weak-to-strong jailbreaking on large language models. arXiv preprint arXiv:2401.17256. Wanjun Zhong, Ruixiang Cui, Yiduo Guo, Yaobo Liang, Shuai Lu, Yanlin Wang, Amin Saied, Weizhu Chen, and Nan Duan. 2023. Agieval: A human-centric benchmark for evaluating foundation models. a...
2023 arXiv
-
[2025]
ACM Comput- ing Surveys, 57(7):1–36
Ai agents under threat: A survey of key secu- rity challenges and future pathways. ACM Comput- ing Surveys, 57(7):1–36. Jianshuo Dong, Ziyuan Zhang, Qingjie Zhang, Han Qiu, Tianwei Zhang, Hao Wang, Hewu Li, Qi Li, Chao Zhang, and Ke Xu. 2024. An engorgio prompt makes large lan...
2024 arXiv
Reviewed August 11, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.