Unbounded Consumption
LLM API calls cost money and consume rate-limited capacity. Unbounded consumption is the class of attacks that drives those costs out of control — and includes model-extraction attacks that copy your model by querying it enough.
01What it is
Resource exhaustion attacks against LLM applications and the model itself. Includes denial-of-wallet (DOW) attacks that drive API cost, denial-of-service (DOS) attacks that exhaust capacity, and model-extraction attacks that recover model behaviour by accumulating queries and responses.
02Why it matters
LLM API costs are 10× to 100× higher than traditional API costs. A bug that sends a 100K-token prompt in a retry loop spends ₹50K in an hour. A motivated attacker can drain a startup's OpenAI bill overnight. Model-extraction lets a competitor recreate your fine-tuned moat for the cost of a few thousand queries.
03Attack vectors
- Cost-amplification — attacker sends prompts that maximise output length (long contexts, "list everything you know about…").
- Context-window saturation — pump huge documents into agent context to inflate costs per call.
- Retry-loop induction — craft outputs that fail downstream validation, triggering retries.
- Model extraction — systematic querying to copy the model's output distribution; train a smaller model to imitate.
- Knowledge-distillation theft — use the production model to label data for training a competing model.
- Concurrency exhaustion — saturate rate limits, denying legitimate users.
04Defence patterns
- Hard cost limits per API key, per user, per session. Alert on threshold approach.
- Output length caps — never let the model generate unbounded.
- Rate limiting at multiple layers (CDN, WAF, application, model provider).
- Watermarking — embed detectable signals in outputs that survive extraction.
- Query monitoring — flag accounts whose query patterns look like extraction (high-diversity, high-volume, semantic coverage).
- Service-tier-based throttling — free users on a low ceiling, paid users on a higher one.
05Detection
Signals to watch
Real-time cost dashboards. Per-user token budgets with hard cutoffs. Anomaly detection on query patterns. Alert on any single session exceeding 10× baseline.
06India context
DPDP · RBI · CERT-In
For BFSI AI features, operational risk policies require cost ceilings on any externally-provided service. SEBI cyber resilience treats unbounded consumption as both a financial and availability risk. CERT-In Direction reporting applies if model-extraction succeeds against a regulated entity's production system.