💻 computer science

Inference Cost Attacks for Retrieval-Augmented Large Language Models

This paper introduces Retrieval-Augmented Inference Cost Attack (RA-ICA), a novel framework utilizing LLM agents and a Memory-Augmented Group Relative Policy Optimization algorithm to poison external knowledge bases with malicious documents that significantly inflate token consumption in RAG-enhanced LLM systems while preserving answer integrity.

Original authors: Chengliang Liu, Liangbo Ning, Yujuan Ding, Wenqi Fan

Published 2026-06-03

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Chengliang Liu, Liangbo Ning, Yujuan Ding, Wenqi Fan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a high-end restaurant called "RAG-LLM." This restaurant is famous because it doesn't just rely on the chef's memory; it has a team of researchers who instantly run to a massive library (the internet) to find the freshest facts before cooking your meal. This makes the food (the answers) very accurate.

However, running this library research service is expensive. The restaurant owners pay by the minute for the researchers' time and the electricity to run the computers.

The Problem: A New Kind of "Bill Shock"

The paper argues that while this system is great, it has a hidden weakness. Usually, people think hackers might try to trick the chef directly by shouting weird instructions at the kitchen window (changing the user's question). But the authors say there's a smarter, sneakier way to attack: poison the library itself.

They call this new threat RA-ICA (Retrieval-Augmented Inference Cost Attack).

Think of it like this: Instead of yelling at the chef, the attacker sneaks into the library and plants a few fake, confusing, and overly complicated books on the shelves. When a customer asks a simple question like, "Who is the goddess of spring?", the researchers don't just find the right book; they accidentally grab one of these fake books too.

Because the fake book is written in a tricky way, the chef has to read it, re-read it, argue with it, and solve a puzzle hidden inside it just to figure out the simple answer. The chef ends up spending 13 times longer cooking the meal than usual. The customer gets the right answer, but the restaurant owner gets a massive, unexpected bill for all that extra time.

How the Attack Works (The "CREEP" Framework)

The authors built a tool they call CREEP (Computational Resource Exhaustion via External Poisoning) to automate this. Imagine CREEP as a "villain robot" that writes these fake library books.

The robot uses two main ways to write these traps:

The Rewrite Artist: It takes a normal, boring book and edits it to add a confusing puzzle or a contradiction.
The Creative Writer: It writes a brand-new book from scratch that looks normal but is secretly designed to make the chef work harder.

The robot uses three specific tricks to make the chef work harder:

The Decoy: It adds a fake, difficult math problem or logic puzzle inside the text. The chef feels compelled to solve it before answering the user's question.
The Contradiction: It writes a sentence that says the opposite of the truth (e.g., "Spring is actually winter"). The chef has to stop, think, and do extra reasoning to decide which fact is real.
The Task Trap: It gives the chef a vague, open-ended instruction that forces them to write a long, rambling explanation just to be safe.

The Secret Sauce: Learning from Past Wins (MA-GRPO)

Writing a fake book that is both hard to spot and hard to process is really difficult. If the book is too weird, the researchers won't pick it up from the library. If it's too simple, the chef won't spend extra time on it.

To solve this, the authors taught their "villain robot" using a special learning method called MA-GRPO.

Think of this as a video game where the robot tries to write the perfect trap.

The Memory Bank: The robot keeps a "Hall of Fame" of the best traps it has ever written.
The Comparison: Every time the robot tries a new trap, it compares it against the "Hall of Fame" winners.
The Reward: If the new trap makes the chef work longer without changing the final answer, the robot gets a "high score" and learns to do it again. If it fails, it learns what not to do.

This "memory bank" helps the robot get better and faster at writing traps that are invisible to the eye but exhausting for the computer.

The Results

The authors tested this on three different real-world question-and-answer datasets. They found that:

They could make the computer work 13 times longer than normal.
The attack succeeded over 90% of the time.
Crucially, the final answer given to the user was still correct. The restaurant owner pays the bill, but the customer gets their food on time (just with a much higher cost behind the scenes).

Summary

In short, this paper shows that we can't just worry about hackers changing what we ask. We also need to worry about hackers poisoning the information sources we trust. By planting "sticky, confusing" documents in the public knowledge base, an attacker can force these smart AI systems to burn through massive amounts of computing power and money, all while still giving the user the right answer.

Technical Summary: Inference Cost Attacks for Retrieval-Augmented Large Language Models

Problem Definition

Retrieval-Augmented Generation (RAG) systems enhance Large Language Models (LLMs) by dynamically retrieving information from external knowledge bases (e.g., web data, domain-specific databases) to synthesize responses. While effective, this architecture introduces a multi-stage inference pipeline that significantly increases operational costs, with inference often constituting over 90% of total computational GPU demand.

Existing research on Inference Cost Attacks (ICAs) has primarily focused on manipulating user input prompts to force models into generating excessively long or repetitive outputs. However, this approach relies on the impractical assumption that an attacker can directly control the victim's input queries.

This paper identifies a critical, underexplored vulnerability: Retrieval-Augmented Inference Cost Attacks (RA-ICA). Unlike direct prompt manipulation, RA-ICA targets the external knowledge base itself. By poisoning the retrievable database (e.g., injecting malicious documents into public web knowledge), an adversary can trigger high-cost inference for benign user queries without direct interaction. The core challenge is to craft malicious documents that are:

Retrievable: Semantically relevant enough to be selected by the retrieval module for a target query.
Cost-Amplifying: Capable of inducing the LLM to generate excessively long reasoning traces or token consumption.
Stealthy: Maintaining the semantic correctness of the final answer to avoid detection and preserve system utility.

Methodology: The CREEP Framework

To operationalize RA-ICA, the authors propose Computational Resource Exhaustion via External Poisoning (CREEP), a framework that leverages LLM agents to autonomously craft and refine malicious documents.

1. Attack Agents and Strategies

The framework employs two types of agents—Rewrite-based (modifying existing retrieved documents) and Generation-based (creating documents from scratch)—utilizing three specific resource-exhaustive strategies:

Decoy Injection: Injecting complex, multi-step reasoning tasks (e.g., logical puzzles or planning problems) into the document context. This forces the RAG system to perform additional, computation-intensive reasoning steps beyond the original query requirements.
Contradiction Injection: Introducing plausible but factually contradictory statements relative to the benign answer. This compels the LLM to engage in extra analysis to adjudicate conflicts between the retrieved documents, thereby increasing token consumption.
Task-Oriented Manipulation: Providing the agent with high-level objectives (Retrieval, Cost Amplification, Stealthiness) without prescribing specific generation procedures, allowing the agent to leverage its full reasoning capabilities to discover diverse attack patterns.

2. Optimization via MA-GRPO

Recognizing that pre-trained LLM agents may not inherently optimize for adversarial cost amplification, the authors introduce Memory-Augmented Group Relative Policy Optimization (MA-GRPO).

Reward Formulation: The reward function is a composite of three components:
- Retrieval Reward ( $R_{retrieval}$ ): A binary indicator ensuring the document is actually retrieved.
- Answer Purity Reward ( $R_{purity}$ ): A weighted sum ensuring the final answer remains aligned with the benign truth and the output lacks manipulation artifacts.
- Token Consumption Ratio ( $R_{TCR}$ ): The ratio of attacked token count to baseline token count.
Memory Augmentation: Standard Group Relative Policy Optimization (GRPO) can suffer from instability if a sampled group contains only low-reward outputs. MA-GRPO addresses this by maintaining a dynamic memory buffer of the top- $k$ historical best adversarial documents. During training, the advantage of new candidates is calculated relative to a reference group comprising both the current batch and the memory buffer. This stabilizes training and accelerates the discovery of potent attack patterns.

Key Contributions

Novel Attack Paradigm (RA-ICA): The paper defines and investigates the first inference cost attack specifically tailored for RAG-enhanced LLMs, shifting the attack vector from user prompts to external knowledge poisoning.
CREEP Framework: A novel framework utilizing LLM agents and three distinct strategies (Decoy, Contradiction, Task-Oriented) to generate malicious documents that balance retrieval success with computational exhaustion.
MA-GRPO Algorithm: A reinforcement learning algorithm that integrates a dynamic memory buffer to fine-tune attack agents, significantly improving the efficiency and effectiveness of generating adversarial documents compared to standard policy optimization.

Experimental Results

The authors evaluated RA-ICA across three real-world datasets: Natural Questions (NQ), HotpotQA, and MS MARCO. The experiments were conducted in a black-box setting using four victim LLMs (qwen-turbo, GPT-5, claude-sonnet-4, and deepseek-r1) with a Contriever retriever.

Effectiveness: The RA-ICA successfully increased token consumption by up to 13.12 times compared to benign inference.
Success Rate: The attack achieved a success rate of over 90% across the datasets.
Stealthiness: Crucially, the attacks maintained the integrity of the generated answers, meaning the system continued to provide correct responses despite the massive increase in computational cost.

Significance and Claims

The paper claims to be the first work to explore the inference cost vulnerability of RAG-enhanced LLM systems. It argues that as RAG systems increasingly integrate real-time web search and external knowledge, the external knowledge base becomes a significant practical vulnerability.

The significance of this work lies in demonstrating that:

RAG systems are susceptible to cost exhaustion attacks via knowledge poisoning, a vector that is more scalable and practical than direct prompt manipulation.
A single poisoned document can impact a multitude of user queries, amplifying the attack's impact on operational costs and system availability.
Current defense mechanisms focusing on prompt filtering are insufficient, as the attack preserves the semantic correctness of the output, making it difficult to detect via standard answer verification.

The authors position this research as a necessary step toward understanding the security and reliability of trustworthy generative AI, highlighting the need for robust defenses against external knowledge poisoning in RAG architectures.