Technical Summary: RolePlay – Exploiting Persona Conditioning for Inference Cost Attacks

1. Problem Statement

The widespread deployment of Large Language Models (LLMs) in real-world applications has made inference efficiency and service reliability critical concerns due to substantial computational costs. While traditional Denial-of-Service (DoS) attacks rely on massive request volumes to exhaust resources, Inference Cost Attacks aim to amplify the computational cost of a single request by inducing excessive token generation.

Existing methods for inference cost attacks face three primary limitations:

1. Detectability: They often rely on adversarial suffixes or explicit extension instructions (e.g., "think harder"), which introduce unnatural lexical patterns detectable by rule-based filters.
2. Lack of Adaptability: Most attacks use predefined triggers that ignore task-specific semantics, limiting their effectiveness across different domains and reasoning patterns.
3. Incomplete Amplification: Prior methods typically target either hidden reasoning processes or visible output in isolation, failing to maximize the total inference cost which is jointly determined by both components.

The core challenge is to dynamically construct effective extension methods that maintain natural interactions while expanding the overall inference process (both reasoning and output) without altering the original task semantics.

2. Methodology: RolePlay Framework

The paper proposes RolePlay, a task-aware dynamic persona alignment framework designed to exploit persona consistency in LLMs. The authors observe that LLMs, due to instruction tuning and Reinforcement Learning from Human Feedback (RLHF), maintain assigned roles and reproduce corresponding behaviors even when those behaviors lead to inefficient reasoning or excessive generation.

RolePlay operates through three distinct stages:

A. Task-Aware Cognitive Analyzer

For each input query, the system analyzes the task to extract a structured cognitive profile consisting of six metadata dimensions across three aspects:

• Task Context: Domain (e.g., STEM, Humanities) and Sub-category (e.g., Mathematics, Quantum Mechanics).
• Reasoning Obstacles: Core Contradiction (identifying conflicts or constraints) and Cognitive Bias Trap (e.g., confirmation bias, local optimum traps).
• Persona Cognitive States: Knowledge Requirement (expertise level, e.g., novice vs. expert) and Emotional Tone (e.g., anxious, stubborn, bewildered).

B. Dynamic Persona Builder

Using the extracted metadata, this module generates a task-specific persona prompt. It employs two mechanisms:

1. Generation Rules: Explicit constraints ensuring the persona matches the task domain, focuses on identified contradictions/biases, and encourages inefficient behaviors (e.g., repeated verification, self-correction, delayed decision-making).
2. One-Shot Learning: Providing a representative mapping between a cognitive profile and a concrete role to guide the model toward scenario-consistent inefficient reasoning rather than generic role descriptions.

C. Prompt Assembly

The generated persona prompt is concatenated with the original query before the model begins solving the problem. This establishes a behavioral constraint that influences the entire autoregressive generation trajectory:

• Internal Reasoning: Induces repeated verification, self-reflection, and alternative exploration, increasing reasoning tokens.
• Visible Output: Encourages detailed explanations, self-justification, and verbose responses, increasing output tokens.

3. Key Contributions

1. Vulnerability Identification: The paper identifies a previously unexplored vulnerability where persona consistency can be exploited to induce inefficient reasoning behaviors. It demonstrates that instruction-following capabilities can be weaponized to amplify inference costs naturally.
2. RolePlay Framework: The proposal of a dynamic persona alignment framework that automatically constructs adaptive personas based on task characteristics to induce semantically coherent but inefficient behaviors.
3. Comprehensive Evaluation: Extensive experiments across multiple LLMs (including DeepSeek-V4-Pro, Gemini-3.5-Flash, Qwen-3.5-Plus, GPT-5 Nano, and Llama-3-8B-Instruct) and diverse datasets (Math, Code, General Instruction Following).

4. Experimental Results

The evaluation demonstrates that RolePlay significantly outperforms existing inference extension methods (such as Engorgio, LoopLLM, OverThinking, and ExtendAttack) across various metrics:

• Token Amplification:
  • Average Amplification: RolePlay achieves an average token amplification of up to 7.64× (specifically on Gemini-3.5-Flash).
  • Maximum Amplification: The framework achieves a maximum token amplification ratio of 207.64× for generated tokens on DeepSeek-V4-Pro.
  • Comparison: On the Gemini-3.5-Flash model, RolePlay (7.64×) significantly outperformed ExtendAttack (3.59×) and OverThinking (2.19×).
• Stealthiness: RolePlay maintains natural generation patterns. It achieves the lowest Input Perplexity (PPL) among attack methods, indicating the prompts appear natural to the model. It also yields the highest Output Entropy and Surprisal Density, suggesting the generated responses are diverse and complex rather than simple repetitive loops.
• Generalization: The method is effective across seven diverse datasets, including Math-500, GSM8K, AIME 2025, BigCodeBench, and HumanEval. Tasks with shorter original generations (e.g., GSM8K, HumanEval) showed particularly high amplification ratios (up to 17.34× and 15.26×, respectively).
• Ablation Study: Comparing "Static Persona" (fixed role) against "Dynamic Persona" (task-aware) showed that the dynamic approach significantly increases inference costs (13.18× vs. 4.29×), confirming the importance of task-adaptive persona construction.

5. Significance and Claims

The paper claims to establish the first connection between dynamic persona alignment and LLM resource exhaustion vulnerabilities.

• New Attack Surface: The authors identify "persona conditioning" as a new attack surface for LLM inference efficiency, distinct from traditional adversarial suffixes or explicit instruction manipulation.
• Stealthy Amplification: Unlike previous methods that rely on detectable patterns, RolePlay leverages the model's inherent desire for role consistency to naturally induce redundant reasoning and verbose outputs.
• Implications: The findings highlight that the very mechanisms (instruction following and persona consistency) designed to improve LLM usability can be exploited to threaten service efficiency and availability, suggesting a need for new defense mechanisms against persona-based inference cost attacks.