Crabs: Consuming Resource via Auto-generation for LLM - D o S Attack under Black-box Settings (2025)

Abstract: Large Language Models (LLMs) have demonstrated remarkable performance across diverse tasks yet still are vulnerable to external threats, particularly LLM Denial-of-Service (LLM-DoS) attacks. Specifically, LLM-DoS attacks aim to exhaust computational resources and block services. However, existing studies predominantly focus on white-box attacks, leaving black-box scenarios underexplored. In this paper, we introduce Auto-Generation for LLM-DoS ( \textbf{AutoDoS} ) attack, an automated algorithm designed for black-box LLMs. AutoDoS constructs the DoS Attack Tree and expands the node coverage to achieve effectiveness under black-box conditions. By transferability-driven iterative optimization, AutoDoS could work across different models in one prompt.Furthermore, we reveal that embedding the Length Trojan allows AutoDoS to bypass existing defenses more effectively.Experimental results show that AutoDoS significantly amplifies service response latency by over \textbf{250}\times\uparrow , leading to severe resource consumption in terms of GPU utilization and memory usage. Our work provides a new perspective on LLM-DoS attacks and security defenses.

## introduction large language models (llms) have been increasingly adopted across various domains @xcite @xcite . llm applications lack robust security measures to defend against external threats, particularly attacks that exploit and consume llm computing resources @xcite . in cybersecurity, dos attacks exploit target resources, aiming to deplete computational capacity and disrupt services @xcite ⋆ indicates equal contribution. † indicates corresponding author. @xcite and large language model denial of service (llm-dos) attack works in a similar way. recent studies reveal that llm-dos can effectively disrupt the service of llm applications @xcite . this attack poses a significant threat to free llm applications and api services. while llms ensure safety by aligning with human values @xcite , the inability of models to recover from resource exhaustion presents significant challenges in mitigating its vulnerability to llm-dos attacks. existing llm-dos attack approaches include increasing the latency by extending the model's output length and making high-frequency requests to exhaust application resources @xcite . gcg-based algorithm @xcite and data poisoning @xcite can lead to lengthy text outputs. prompt engineering induction also compels models to produce repetitive generations @xcite . however, these methods struggle to work in black-box because they typically rely on access to model weights or modifications to training data and are prone to being blocked by filters @xcite . as a result, current research on llm-dos is still critically flawed, remaining a significant challenge under black-box conditions. in this paper, we focus on llm-dos attacks under black-box settings. we propose auto-generation for llm-dos (autodos) attack, an automated algorithm tailored for black-box llms. autodos begins by modeling an initial attack prompt as the dos attack tree and then constructs a fine-grained basic dos prompt, which guides redundant generation. specifically, we expand the dos attack tree through depth backtracking and breadth extension to improve the comprehensiveness of the sub-questions in the basic dos prompt. then, autodos iteratively optimizes an assist prompt which assists the basic dos prompt in achieving better transferability across diverse models. additionally, we introduce the length trojan to conceal the need for lengthy text replies in autodos, misleading the security measures of llms. the autodos workflow operates without modifying model parameters and ensures successful execution of attacks in black-box environments. we conducted extensive experiments on several state-of-the-art llms, including gpt @xcite , llama @xcite , qwen @xcite , among others, to evaluate the efficacy of autodos. empirical results demonstrate that autodos extends the output length by 2000%↑ compared to benign prompts, successfully reaching the maximum output length and significantly outperforming baseline approaches in black-box environments. a simulation test on an llm application server shows that autodos induces over 16× the graphics memory consumption. meanwhile, this extension amplifies service performance degradation by up to 250× for llm applications. additionally, we perform cross-attack experiments on at least 11 models, and the results show that autodos exhibits strong transferability across different black-box llms. in summary, our primary contribution lies in the autodos, a novel black-box attack method designed to exhaust the computational resources of free llm services. we propose a llm-dos prompt construction method based on a modeling dos attack tree, which can expand any simple question into a basic dos prompt. to enhance transferability, we present the assist prompt to support the basic dos prompt and introduce an iterative optimization algorithm for construction. furthermore, we reveal the length trojan strategy for better stealthiness, allowing autodos to bypass defense mechanisms. finally, we conduct extensive experiments to validate the effectiveness of auto-dos and simulate a real-world service environment to assess its actual impact on resource consumption. our findings underscore the critical shortcomings of llms in handling external threats, emphasizing the need for more robust defense methods. ## method: auto-generation for llm-dos attack in this section, we introduce autodos and its key components in detail. sec. 3.1 outlines the construction of the basic dos prompt using the dos attack tree, designed to induce the model to generate redundant responses. sec. 3.2 describes the transferability-driven iterative optimization for obtaining the assist prompt, improving its transferability. finally, sec. 3.3 introduces the length trojan, which improves stealthiness. ## conclusion we introduce auto-generation for llm-dos attack (autodos) to degrade service performance. autodos constructs a dos attack tree to generate fine-grained prompts. through iterative optimization and the incorporation of the length trojan, autodos operates stealthily across different models. we evaluate autodos on 11 different models, demonstrating the effectiveness. through server simulation, we confirm that autodos significantly impacts service performance. cross-experimental results further validated the transferability across different black-box llms. furthermore, we show that autodos remains challenging to detect using existing security measures, underscoring its practicality. our study highlights a critical yet underexplored security challenge, llm-dos attack, in large language model applications.