Technical Summary: SHIELD – An Auto-Healing Agentic Defense Framework for LLM Resource Exhaustion Attacks

1. Problem Statement

Large Language Model (LLM) systems are increasingly vulnerable to sponge attacks, a class of adversarial inputs designed to induce excessive computation and Denial-of-Service (DoS) conditions. These attacks exploit the model's tendency to generate pathological token sequences or engage in long-horizon reasoning, causing severe latency amplification and monopolizing GPU resources.

Existing defense mechanisms suffer from critical limitations:

• Statistical Filters (e.g., Perplexity-based): Effective against non-semantic, random token sequences but fail against semantically meaningful prompts where malicious intent is embedded in fluent, contextually plausible language.
• Static LLM-based Defenders: While more expressive, they rely on fixed prompts that lack robustness against rapidly evolving attack strategies. They often lack example-driven semantic grounding and offer limited recovery mechanisms when the defense model itself fails, leading to cascading failures.
• Operational Overhead: Invoking an LLM for every input introduces substantial latency, making real-time protection difficult in high-throughput systems.

There is a distinct need for an adaptive, auto-healing framework that evolves with emerging threats without requiring model retraining or architectural changes.

2. Methodology: The SHIELD Framework

SHIELD (Self-Healing Intelligent Evolving LLM Defense) is a training-free, multi-agent framework designed to detect and mitigate sponge attacks through a closed-loop, self-correcting architecture. It consists of two tightly coupled pipelines: a Defense Pipeline and a Knowledge Updating Pipeline.

2.1 Multi-Agent Architecture

The system is centered around three specialized agents:

1. Defense Agent (DA): The primary decision-making entity responsible for real-time, low-latency protection.
2. Knowledge Updater Agent (KUA): Triggered only when the DA fails to detect an attack. It performs post-hoc analysis to identify novel attack patterns and update the system's knowledge base.
3. Prompt Optimization Agent (POA): Activated when new attack types are identified. It iteratively refines the defense instructions for the DA without retraining the underlying models.

2.2 The Three-Stage Defense Pipeline (DA)

The DA processes incoming queries through a cascade of three stages. Failure at any stage results in immediate rejection:

• Stage 1: Semantic Similarity Filtering: Queries are vectorized and compared against a database of known sponge prompts. This stage detects paraphrased or semantically preserved attacks.
• Stage 2: Substring Matching: A lightweight KMP-based algorithm detects known malicious payloads embedded within longer, syntactically benign wrappers. This captures attacks that evade similarity thresholds.
• Stage 3: LLM-Based Reasoning: Remaining queries are evaluated by an LLM classifier guided by an optimized defense prompt and context retrieved from Stage 1. This stage handles complex, semantic reasoning to identify compute-exhaustion intent.

2.3 System-Level Auto-Healing (KUA)

When a malicious query bypasses the DA and triggers excessive token generation in the target model, the KUA is activated:

• Failure Analysis: The KUA checks its attack-type cache. If no match is found, it treats the input as a novel variant.
• Isolation and Characterization: Using a sandboxed copy of the target model, the KUA performs iterative sub-span probing to isolate the minimal component responsible for the sponge behavior.
• Knowledge Expansion: For novel attacks, the KUA generates a structured description of the mechanism, updates the attack-type cache, and augments the knowledge base with the new malicious fragments.

2.4 Prompt Optimization (POA)

Upon the identification of a new attack type, the POA initiates an evolutionary prompt search:

• Candidate Generation: The agent generates diverse candidate system instructions based on the new attack description.
• Evolutionary Selection: Candidates are evaluated against the updated attack set. High-performing prompts are selected via roulette-wheel sampling and used to update the meta-prompt.
• Iterative Refinement: This process repeats until a stopping criterion is met, resulting in a refined defense instruction that improves detection accuracy without model retraining.

3. Key Contributions

The paper claims four primary contributions:

1. First Auto-Healing Agentic System: The proposal of the first defense system for sponge attacks that enables continuous adaptation and self-correction without re-architecting the underlying LLM.
2. Three-Stage Defense Pipeline: A design that prioritizes early-stage detection (semantic similarity and substring matching) to significantly reduce the latency overhead associated with per-query LLM invocation.
3. Prompt Optimization Workflow: A mechanism that continuously refines defense instructions as new behaviors emerge, overcoming the scalability and robustness limits of static prompts.
4. Robust Evaluation: Extensive experiments demonstrating the system's ability to mitigate DoS effects and detect both known and unseen sponge attacks in dynamic environments.

4. Experimental Results

The framework was evaluated against four attack types: RL-GOAL, GCG-DoS (non-semantic), EOGen (hybrid), and AutoDoS (fully semantic).

• Performance vs. Baselines: SHIELD consistently outperformed perplexity-based filters and standalone LLM harm-filters.
  • On AutoDoS (fully semantic), the perplexity filter achieved an F1-score of 36.51%, while SHIELD achieved 100.00%.
  • On GCG-DoS, SHIELD achieved 99.85%, compared to 96.07% for the perplexity filter.
  • Overall, SHIELD improved F1-scores by 3–14% over baselines across diverse attack strategies.
• Robustness: The Defense Agent maintained near-saturated performance across various target models (including LLaMA2, Mistral, Gemma, and GPT variants) and attack types.
• Latency Efficiency: Early-stage filtering (Stages 1 and 2) reduced end-to-end latency by an order of magnitude (10x) compared to relying solely on Stage 3 (LLM inference), which incurred ~1600ms latency per query.
• Self-Healing Impact:
  • Prompt Optimization: Automated optimization improved F1-scores by approximately 30% for EOGen attacks compared to hand-crafted prompts.
  • Knowledge Accumulation: As the Knowledge Updater enriched the database, detections migrated from the expensive Stage 3 to the lightweight Stages 1 and 2, further reducing latency and increasing accuracy over time.

5. Significance and Claims

The paper positions SHIELD as a significant advancement in resilient, continuously improving agentic security for real-world LLM deployments.

• Adaptability: Unlike static defenses, SHIELD autonomously learns from detection failures and self-corrects its logic, making it effective against evolving threats.
• Operational Viability: By separating the defense logic from the target model and utilizing a closed-loop healing mechanism, the system minimizes operational overhead and avoids the need for frequent model retraining.
• Scalability: The framework demonstrates that combining early-stage filtering with incremental knowledge accumulation allows for robust security that scales efficiently under repeated or adaptive attack scenarios.

The authors acknowledge limitations, including the trade-offs in similarity threshold selection (balancing false positives vs. detection coverage), the potential for unbounded growth in the knowledge base, and the assumption that the target model is not poisoned (focusing on prompt-level attacks). However, they assert that SHIELD provides a practical, deployable solution for the immediate threat of resource-exhaustion attacks in autonomous LLM systems.