Model Denial of Service
O que é Model Denial of Service?
Model Denial of ServiceOWASP LLM04 — driving an LLM application into runaway resource consumption (long contexts, infinite loops, expensive tool fan-out) so it slows, becomes unavailable, or generates a ruinous cloud bill.
Model Denial of Service (LLM04 in the OWASP Top 10 for LLM Applications) covers attacks that exhaust the resources behind an LLM-powered system rather than knock down a network. Specific patterns include flooding the model with maximum-context inputs to drive up token cost; crafting recursive or self-referential prompts that trigger long generations; abusing tool-calling agents to cascade dozens of expensive sub-calls; submitting inputs that defeat caching; and exploiting retrieval pipelines to pull massive documents into every request. The blast radius is operational (the chatbot becomes unusable) and financial (a single attacker can burn five- or six-figure inference bills in hours). Mitigations include strict per-user input/output token caps, max-step limits on agent loops, semantic and exact-match caching, rate-limit on tool fan-out, async queueing with budget guards, and observability dashboards keyed to spend per tenant.
● Exemplos
- 01
An attacker scripts thousands of requests with maximum-allowed context windows, generating six-figure cloud bills before quotas trip.
- 02
An agent prompt-injection convinces the model to enter a tool-use loop that calls the expensive document-summarization API hundreds of times per session.
● Perguntas frequentes
O que é Model Denial of Service?
OWASP LLM04 — driving an LLM application into runaway resource consumption (long contexts, infinite loops, expensive tool fan-out) so it slows, becomes unavailable, or generates a ruinous cloud bill. Pertence à categoria Segurança de IA e ML da cibersegurança.
O que significa Model Denial of Service?
OWASP LLM04 — driving an LLM application into runaway resource consumption (long contexts, infinite loops, expensive tool fan-out) so it slows, becomes unavailable, or generates a ruinous cloud bill.
Como funciona Model Denial of Service?
Model Denial of Service (LLM04 in the OWASP Top 10 for LLM Applications) covers attacks that exhaust the resources behind an LLM-powered system rather than knock down a network. Specific patterns include flooding the model with maximum-context inputs to drive up token cost; crafting recursive or self-referential prompts that trigger long generations; abusing tool-calling agents to cascade dozens of expensive sub-calls; submitting inputs that defeat caching; and exploiting retrieval pipelines to pull massive documents into every request. The blast radius is operational (the chatbot becomes unusable) and financial (a single attacker can burn five- or six-figure inference bills in hours). Mitigations include strict per-user input/output token caps, max-step limits on agent loops, semantic and exact-match caching, rate-limit on tool fan-out, async queueing with budget guards, and observability dashboards keyed to spend per tenant.
Como se defender contra Model Denial of Service?
As defesas contra Model Denial of Service costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para Model Denial of Service?
Nomes alternativos comuns: LLM04, LLM DoS, Token-burn attack.
● Termos relacionados
- ai-security№ 870
OWASP LLM Top 10
Lista mantida pela OWASP com os dez riscos de segurança mais críticos para aplicações construídas sobre grandes modelos de linguagem.
- attacks№ 333
Ataque de negação de serviço (DoS)
Ataque que esgota largura de banda, capacidade de cálculo, memória ou recursos aplicacionais de um sistema, impedindo o acesso de utilizadores legítimos.
- network-security№ 1008
Rate Limiting
O rate limiting limita o numero de requisicoes que um identificador (IP, usuario, chave de API ou token) pode fazer em uma janela de tempo, protegendo APIs e aplicacoes contra abuso, scraping e brute-force.
- ai-security№ 027
Segurança de IA agêntica
Disciplina que protege agentes LLM autónomos que planeiam, invocam ferramentas e atuam em sistemas reais, onde a injeção de prompt se transforma em execução remota e a agência excessiva em dano efetivo.
- ai-security№ 969
Injeção de prompt
Ataque que sobrepõe as instruções originais de um LLM ao inserir texto adversarial no prompt, fazendo com que o modelo ignore salvaguardas ou execute ações escolhidas pelo atacante.
- ai-security№ 689
Guardrails de LLM
Mecanismos que limitam o que uma aplicação baseada em LLM pode receber ou produzir, aplicando regras de safety, segurança e negócio em torno do modelo subjacente.