LLM04: Model Denial of Service

📋 What Is It?

Model Denial of Service (DoS) occurs when attackers manipulate inputs or exploit the resource-intensive nature of Large Language Models to cause service degradation, excessive resource consumption, or complete system unavailability. Unlike traditional DoS attacks that flood network bandwidth, Model DoS exploits the computational characteristics of AI systems.

LLM04 OWASP Rank

Medium Risk Level

Easy Exploitability

⚠️ Common Exploits

Resource Exhaustion: Queries that consume excessive compute/memory
Long Context Attacks: Maximum token length inputs
Repetitive Queries: High-frequency requests without rate limiting
Complex Prompt Chains: Recursive or deeply nested prompts
Model Flooding: Concurrent requests overwhelming infrastructure

🔴 Attack Flow

1. Attacker crafts resource-intensive prompt
↓
2. Submits maximum length input (8K+ tokens)
↓
3. LLM processes at high computational cost
↓
4. Resources exhausted or response delayed
↓
5. BREACH: Service degradation or unavailability!

❌ Vulnerable Code

# Bad: No rate limiting or resource controls
def process_query(user_input):
    # VULNERABLE: No input length limit
    response = llm.generate(
        user_input,  # Could be 100K tokens!
        max_tokens=4000  # Max response length
    )
    return response

# Bad: No rate limiting per user
@app.route('/api/chat', methods=['POST'])
def chat():
    # VULNERABLE: Unlimited requests allowed
    message = request.json['message']
    return process_query(message)

# Bad: No timeout controls
while True:
    response = llm.generate(user_query)  # Could hang forever
                

✅ Secure Code

# Good: Implement comprehensive resource controls
from flask_limiter import Limiter
import timeout_decorator

# Rate limiting
limiter = Limiter(app, key_func=get_user_id)

@app.route('/api/chat', methods=['POST'])
@limiter.limit("10 per minute")  # Rate limit per user
def secure_chat():
    message = request.json['message']
    
    # Input validation
    if len(message) > 500:  # Token limit
        return {"error": "Input too long"}, 400
    
    return process_with_timeout(message)

# Good: Timeout protection
@timeout_decorator.timeout(30)  # 30 second timeout
def process_with_timeout(user_input):
    response = llm.generate(
        user_input,
        max_tokens=500,  # Limit output
        timeout=25  # Model timeout
    )
    return response

# Good: Queue management
from celery import Celery

@celery.task(time_limit=30, soft_time_limit=25)
def process_async(user_input):
    return llm.generate(user_input)
                

✓ Prevention Checklist

Implement rate limiting per user/IP
Set input length limits (tokens/characters)
Configure request timeouts
Limit maximum output tokens
Use request queuing mechanisms
Implement circuit breakers
Monitor resource usage metrics
Set up auto-scaling policies
Implement CAPTCHA for public endpoints
Use cost-based throttling

🔍 Detection & Tools

Rate Limiting Tools:

Flask-Limiter Express Rate Limit Redis Kong Gateway AWS WAF Cloudflare

Monitoring Tools:

Prometheus Grafana Datadog New Relic AWS CloudWatch

How to Test:

Send maximum length inputs repeatedly
Test concurrent request limits
Verify rate limiting enforcement
Check timeout configurations
Monitor resource consumption under load

🌍 Real-World Examples

ChatGPT Outages (2023): Service degradation during peak usage due to resource exhaustion
API Abuse: Attackers scripted maximum-length prompts to overwhelm LLM services
Free Tier Exploitation: Automated scripts abused free tiers causing service degradation
Context Window Attacks: Users sending 32K+ token contexts crashed processing pipelines
Recursive Prompt DoS: Self-referential prompts caused infinite processing loops

📌 Quick Tips

DO NOT allow unlimited input length
DO NOT skip rate limiting
DO NOT ignore timeout configuration
DO enforce per-user limits
DO monitor resource usage
DO use request queuing

📜 Compliance

Related Standards:

NIST 800-53 SC-5 (DoS Protection)
ISO 27001 A.13.1.1
PCI-DSS Requirement 6.5.9
CWE-400 Uncontrolled Resource Consumption
SOC 2 CC7.2

⏰ Model Denial of Service