Unbounded Consumption
- Input / Prompt
- Tools & External Data
The application allows excessive or uncontrolled resource usage — inference calls, token volume, tool invocations — enabling denial-of-service, runaway cost, or model-extraction abuse.
What it is
Unbounded consumption is any application design that lets excessive or uncontrolled LLM inference happen without a limit ever tripping — in request volume, input size, or computational cost. It spans denial-of-service through resource exhaustion, denial-of-wallet through runaway pay-per-use cost, and model extraction, where an attacker queries enough input/output pairs to clone or reconstruct the model's behavior. The high computational cost of LLM inference, especially in cloud deployments, makes all three variants economically attractive to an attacker even when no single request looks obviously malicious. A multi-agent system multiplies the ways a single triggering event turns into unbounded consumption: agents that retry, re-delegate, or re-query each other after a failure can turn one transient error into an unbounded fan-out of inference calls unless every loop carries its own recursion limit and exit criteria, independent of whether any single agent is tracking its own budget.
Kinds
- Volumetric flooding
- Variable-length input floods or a high volume of repeated requests exhaust processing capacity or run up a denial-of-wallet cost, exploiting the pay-per-use pricing behind most cloud LLM services.
- Resource-intensive queries
- Inputs crafted to trigger the model's most computationally expensive paths, or that continuously exceed its context window, degrade service for every other user.
- Model extraction via API
- Systematic querying with carefully crafted inputs collects enough input/output pairs to train a shadow model that replicates the target's behavior.
- Side-channel extraction
- Probing exposed logits, logprobs, or input-filtering behavior leaks model internals — weights or architecture — beyond what an ordinary response is meant to reveal.
Attack scenarios
A group of agents autonomously re-queries each other in a retry loop after a transient tool failure, multiplying one failed call into a cost spike before any budget check trips.
Repeated-request flood
An attacker transmits a high volume of requests to the LLM API, exhausting computational resources until the service becomes unavailable to legitimate users.
Denial-of-wallet
An attacker generates excessive operations against a pay-per-use cloud AI service, running up unsustainable cost for the provider before any budget check trips.
Retry-loop cost spike
A group of agents autonomously re-queries each other in a retry loop after a transient tool failure, multiplying one failed call into a cost spike before a budget check catches it.
Model replication via synthetic data
An attacker uses the target model's own API output to generate synthetic training data, then fine-tunes a separate model into a functional equivalent — bypassing simpler, query-count-based extraction defenses.
Mitigations
- Cap runs with a hard budget kill switch
- Token / Cost Tracking enforces a ceiling on spend and call count per run, independent of what any single agent believes its own budget to be.
- Enforce recursion limits and exit criteria
- Apply the discipline named in the Hallucinated Routing and Unbounded Loops anti-pattern so a retry or re-delegation loop cannot fan out indefinitely after a transient failure.
- Rate-limit and validate input size
- Cap request volume per source and reject oversized inputs before they reach the model, closing the simplest flooding and context-overflow vectors.
- Monitor and log usage patterns
- Continuous logging of resource consumption turns a slow-building extraction or denial-of-wallet attempt into a detectable anomaly rather than an invisible cost line.