LLM06: Unbounded Consumption (Compute, Cost, Extraction)

Description

Unbounded consumption occurs when a caller can trigger inference work costing the operator far more than it costs to request. The asymmetry runs in three currencies: GPU time and KV-cache memory on a self-hosted serving tier, metered spend on a provider API, and the model itself, since every completion returned is a free training label. Extended-thinking models, million-token contexts, multimodal inputs and agents that fan out into sub-agents all raise the ceiling on what one request consumes.

In deployed integrations this looks mundane: an unauthenticated demo endpoint in front of a model gateway, request-rate limits with no token or currency accounting behind them, a vLLM or Ollama process started at the model’s maximum context length with no per-tenant queue, or an agent retrying a failing tool until the session dies. The 2026 edition moves this entry up four places from LLM10:2025. The 2025 edition had already replaced the older Model Denial of Service framing, which covered availability only, and absorbed the retired LLM10:2023 Model Theft category, so query-based distillation counts as consumption; 2026 keeps that scope and names reasoning-loop exhaustion, multimodal inputs, agent-tool flooding and inference-infrastructure exploitation as separate vectors. Its text is explicit that request-rate limiting alone is no longer sufficient.

Keywords: token flooding, denial of wallet, kv cache exhaustion, model extraction, reasoning loop abuse, per-tenant budget

Examples/Proof

• Token-cost asymmetry
  • Send a few hundred bytes with max_tokens at the ceiling, stop sequences removed and high reasoning effort. Tens of thousands of billed output tokens prove input size is no proxy for cost.
• Context accumulation
  • Hold one conversation for 100 turns with no truncation. An unbounded per-turn cost ramp on constant user input is the finding.
• Serving-tier starvation
  • Flood a self-hosted endpoint with maximum-context prompts while a control request loops; rising queue depth and control p99 shows no fair queueing.
• Extraction by sampling
  • Drive a large seeded prompt bank through the completion API with logprobs on. No throttle plus soft targets means a distillable corpus.

Detection and Monitoring

• Cost per identity, not requests per second
  • Log input, output and reasoning tokens with resolved unit cost per key, tenant and session; alert on cost-per-request outliers.
• Serving-tier saturation
  • Scrape queue depth, KV-cache utilisation, time-to-first-token and OOM restarts; alert before the queue drains into 503s.
• Agent step accounting
  • Emit a span per model and tool call carrying depth and attempt number; alert on recursion depth and retry counts.

Remediation

1. Cap consumption per request, session and tenant
   • Limit input tokens, output tokens, reasoning budget, tool calls and wall-clock; return a partial result on breach.
2. Enforce spending limits that stop work
   • Per-key and per-team budgets with a reset period, plus provider-side alarms; a breached budget must fail requests, not just notify.
3. Pin cost-bearing parameters server-side
   • Allowlist model aliases, ignore client-supplied model, max_tokens and reasoning-effort, and derive the tenant from the authenticated credential.
4. Bound agent loops
   • Step, depth and recursion limits, capped retries with backoff, and a circuit breaker after repeated tool failures.
5. Isolate the serving tier
   • Context and concurrency limits below hardware capacity, per-tenant queueing, and admin endpoints off untrusted networks.

Prevention Checklist

• Token and currency budgets per key and tenant, with a hard stop on breach
• Context length, output length and reasoning budget clamped server-side
• Agent step, depth, retry and tool-call ceilings with a circuit breaker
• Serving concurrency sized below OOM, with per-tenant queueing
• Weight stores and inference admin endpoints off user-facing networks