Resource Consumption Threats in Large Language Models

1. Problem Statement

The paper addresses a critical, emerging safety threat in Large Language Models (LLMs): Resource Consumption Attacks. Unlike traditional attacks that aim to extract private data or induce harmful content, these attacks are designed to induce disproportionate computational overhead by forcing models to generate excessive, unnecessary, or uncontrolled outputs.

• Core Issue: LLMs operate on limited, costly computational infrastructure. Resource efficiency is vital for service providers (throughput, cost) and users (latency, API fees).
• The Threat: Adversarial inputs can trigger "over-generation," causing:
  • Provider-side risks: GPU saturation, server overload, reduced concurrency, and increased operational costs.
  • User-side risks: Higher latency, unstable availability, and inflated usage costs.
  • Systemic impact: These attacks reframe resource usage from a performance engineering issue to a core safety and security concern, potentially leading to Denial-of-Service (DoS) scenarios.

2. Methodology and Taxonomy

The authors propose a unified view of the threat landscape, organizing the field through a systematic review of attacks, mechanisms, and defenses. The core methodological contribution is a two-regime taxonomy based on the behavior of the generation trajectory:

A. The Two Regimes of Resource Consumption

1. Overthinking (Task-Aligned Excess):
   • Definition: Generation remains relevant to the task but becomes unnecessarily verbose, redundant, or over-elaborate.
   • Characteristics: The model stays on a controllable path toward termination but incurs high costs through verbosity (e.g., excessive Chain-of-Thought reasoning, redundant explanations).
   • Examples: Crabs (tree-structured queries), ThinkTrap (embedding space optimization), BadReasoner (backdoor triggers).
2. Unbounded Drift (Loss of Control):
   • Definition: The generation trajectory deviates from the original task and fails to converge, entering repetitive loops or non-terminating states.
   • Characteristics: The model loses semantic control, often entering self-reinforcing loops, recursive self-extension, or "attention sinks" that prevent normal stopping.
   • Examples: LoopLLM (entropy-driven loops), RECUR (recursive reflection), Non-halting Queries (fixed-point exploitation).

B. Scope of Analysis

The survey covers four distinct system types:

• Standard LLMs: Text generation and reasoning.
• Reasoning LLMs (RLLMs): Models with explicit Chain-of-Thought (CoT) capabilities.
• Multimodal LLMs (MLLMs): Systems processing text and images (e.g., verbose image descriptions).
• Agentic Systems: AI agents interacting with tools and environments (e.g., recursive tool-calling loops).

3. Key Contributions

1. Unified Taxonomy: The paper establishes the first comprehensive framework categorizing resource consumption threats into Overthinking and Unbounded Drift, bridging the gap between disparate studies and inconsistent terminology.
2. Systematic Review of Mechanisms: It analyzes the underlying causes of these behaviors, including:
   • Mechanistic Insights: Identification of "repetition neurons," "induction heads," and "high-inflow words" that drive repetitive decoding.
   • Training vs. Inference: Distinguishing between vulnerabilities arising from training objectives (e.g., likelihood optimization) and inference-time dynamics (e.g., attention sinks).
3. Defense Landscape Analysis: The paper categorizes existing mitigations into three layers:
   • Training-level: Unlikelihood training, repetition dropout, and reward shaping (e.g., LAPO).
   • Decoding-level: Dynamic stopping, entropy-based control, and steering vectors (e.g., CoT-Valve, RecurrentDetector).
   • System-level: Request scheduling, queue-based architectures, and resource-aware serving (e.g., PD3F, Queue-based defenses).
4. Evaluation Framework Proposal: The authors propose a standardized evaluation framework covering three levels:
   • Model-level: Output length and inference latency.
   • Hardware-level: GPU and memory utilization.
   • Application-level: Throughput and service capacity degradation.

4. Key Results and Findings

• Vulnerability Across Modalities: Resource consumption is not limited to text. MLLMs are vulnerable to "verbose images" and "phantom sponges," while Agentic systems face risks from "recursive tool-calling" and "covert workload injection" (e.g., LeechHijack).
• Mechanism Diversity:
  • Overthinking is often sustained by local decoding dynamics and probability traps (e.g., high-inflow tokens).
  • Unbounded Drift stems from coordinated circuits (induction heads + repetition neurons) and training biases that favor copying over novelty.
• Defense Gaps:
  • Current defenses are heavily skewed toward efficiency optimization (reducing cost under benign loads) rather than security defense (resisting adversarial amplification).
  • Black-box limitations: Most attacks and defenses are studied in white-box settings; robust defenses for commercial black-box APIs are scarce.
  • Agentic Blind Spot: Resource consumption in multi-agent systems and memory mechanisms is largely unexplored.
• Real-World Impact: The paper cites the DeepSeek-R1 launch as a case study where underestimated computational costs of reasoning led to service saturation, illustrating how benign usage can mimic attack effects.

5. Significance and Future Directions

• Paradigm Shift: The paper argues that resource consumption must be treated as a safety-critical issue (DoS risk) rather than just an engineering optimization problem.
• Research Roadmap:
  • From Efficiency to Security: Future defenses must prioritize robustness against adversarial amplification, not just average-case efficiency.
  • Unified Theory: There is a need for cross-generational theories explaining how these threats evolve as models scale.
  • Standardization: The field lacks standardized benchmarks and metrics; the proposed evaluation framework aims to unify assessment across models and modalities.
• Implications: As LLMs integrate into real-world workflows (autonomous agents, enterprise tools), unmitigated resource abuse could lead to severe economic loss, service unavailability, and infrastructure instability.

In conclusion, this survey provides the foundational structure for understanding, characterizing, and mitigating resource consumption threats, urging the community to shift focus from mere performance tuning to security-oriented resource governance.