PD^3F : A Pluggable and Dynamic D o S -Defense Framework against resource consumption attacks targeting Large Language Models (2025)

Abstract: Large Language Models (LLMs), due to substantial computational requirements, are vulnerable to resource consumption attacks, which can severely degrade server performance or even cause crashes, as demonstrated by denial-of-service (DoS) attacks designed for LLMs. However, existing works lack mitigation strategies against such threats, resulting in unresolved security risks for real-world LLM deployments. To this end, we propose the Pluggable and Dynamic DoS-Defense Framework ( PD^3F ), which employs a two-stage approach to defend against resource consumption attacks from both the input and output sides. On the input side, we propose the Resource Index to guide Dynamic Request Polling Scheduling, thereby reducing computing resource usage induced by malicious prompts under high-concurrency scenarios. On the output side, we introduce the Adaptive End-Based Suppression mechanism, which reduces excessive malicious generation. Experiments across six models demonstrate that PD^3F significantly mitigates resource consumption attacks, improving users’ access capacity by up to 500% during adversarial load. PD^3F represents a step toward the resilient and resource-aware deployment of LLMs against resource consumption attacks.

## introduction deployment of large language models (llms) remains heavily constrained by computational resource demands @xcite @xcite , with limited resource availability posing a critical bottleneck to broader adoption @xcite . this challenge is further amplified by resource consumption attacks, which induce high-overhead inference processes to exhaust computational resources @xcite . the feasibility and impact of such attacks have been empirically demonstrated through denial-of-service (dos) attacks specifically targeting llms @xcite . recent findings reveal that resource consumption attacks increase model response latency across multiple dimensions @xcite , rapidly depleting gpu resources @xcite . under computing resource shortages, these attacks result in resource exhaustion and service disruption, thereby compromising the reliability of llms deployment. despite its severity, resource consumption attacks remain largely unaddressed, making it difficult to mitigate. prior defense techniques, including model checking and input disturbance @xcite , are bypassed by emerging attack strategies, leading to severe malicious resource consumption @xcite . furthermore, research on controlling consumption during generation rarely considers the impact of resource consumption attacks @xcite . consequently, llm applications struggle to suppress resource consumption threats, especially dos attacks for llms. in this paper, we propose the pluggable dynamic dos-defense framework (pd 3 f). to the best of our knowledge, pd 3 f is the pioneer framework to provide end-to-end protection against resource consumption attacks. at its core, pd 3 f introduces the resource index that quantifies the attack risks of incoming requests by leveraging high-dimensional gpu resource features, enabling user-level queue scheduling. subsequently, we employ the resource index to guide dynamic request polling scheduling at the input stage, which deprioritizes adversarial requests, thereby mitigating excessive resource usage. on the output side, pd 3 f applies the adaptive end-based suppression mechanism to shorten attack requests while reducing the resource consumption of individual requests. as a result, pd 3 f mitigates existing resource consumption attacks effectively while preserving the performance of benign queries. we simulate real-world deployment scenarios and conduct comprehensive experiments on six widely-used open-source llms, including llama-3.1 @xcite , qwen2.5 @xcite , mistral-v0.2 @xcite . experimental results demonstrate that pd 3 f effectively mitigates the impact of denial-of-service attacks for llms. under attack scenarios, pd 3 f reduces the impact of dos attacks by at least 50% ↓, while improving user request efficiency by 500% ↑. notably, we ensure minimal disruption to benign user requests under varying workloads. in summary, our primary contribution lies in pd 3 f, which is the first universal defense against resource consumption attacks. we define the resource index to enable more precise cluster identification in high-dimensional space for quantifying resource overhead risk. building on this, we further present the dynamic request polling strategy and apply adaptive end-based suppression to weaken adversarial resource usage by elastically outputlength suppression. we evaluate pd 3 f across six models, three attack types, and eight defense baselines, demonstrating its effectiveness. pd 3 f offers a novel perspective on llm security defenses and improves the deployment robustness. ## method in this section, we present pd 3 f and describe its key components in detail. in sec. 3.1, we outline the construction of the resource index, which distinguishes resource consumption attacks from benign requests. sec. 3.2 details the dynamic request polling scheduling strategy for adaptively handling requests using the resource index. finally, sec. 3.3 introduces the adaptive end-based suppression mechanism, designed to reduce performance degradation caused by dos attacks. ## conclusion we introduce the pluggable dynamic dos-defense framework (pd 3 f), to defend against resource consumption attack instructions. pd 3 f proposes resource index that effectively clusters dos attacks and identifies resource-consuming adversarial prompts without false positives for benign requests. based on this, pd 3 f achieves attacks mitigation through a combination of dynamic request polling scheduling and adaptive end-based sup-pression. we evaluate the defense effectiveness and performance of pd 3 f on six open-source llms. experimental results demonstrate an identification accuracy exceeding 99% and an increase of over 50% in the throughput of benign requests. furthermore, we show that existing security defenses remain insufficient and may lead to hidden risks such as service paralysis and resource exhaustion. our work mitigates these risks and contributes toward elastic, resource-aware deployment of llms.