Attack Type

Denial of service Research

Attacks that disrupt model availability

36 matching entries

Denial of service research results

36 entries

MCP Description-Code Inconsistency

Published 2/1/2026

Analyzed 2/22/2026

The Model Context Protocol (MCP) architecture lacks a semantic verification mechanism to enforce consistency between a tool's documented behavior (exposed to the Large Language Model via JSON schemas) and its actual executable logic. This design gap allows MCP Servers to present benign, read-only, or limited-scope descriptions to the LLM agent while implementing undocumented, privileged, or state-mutating functionality in the underlying code. An attacker can exploit this description–code…

Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions

Evaluated models: Not reported

Source: arXiv

Noisy Data Pretraining Divergence

Published 2/1/2026

Analyzed 2/21/2026

A data poisoning vulnerability exists in the pretraining pipeline of Transformer-based Large Language Models (LLMs) where the injection of synthetic uniform random noise into the training corpus induces irreversible training loss divergence or performance degradation. This instability is mechanistically distinct from divergence caused by high learning rates. The vulnerability is specifically triggered by "insertion noise" (inserting random tokens between clean tokens) drawn from a restricted…

An Empirical Study on Noisy Data and LLM Pretraining Loss Divergence

Evaluated models: Not reported

Source: arXiv

Pathological Reasoning DoS

Published 2/1/2026

Analyzed 3/9/2026

A vulnerability in Large Reasoning Models (LRMs) allows attackers to perform Prompt-Induced Inference-Time Denial-of-Service (PI-DoS) attacks by submitting short, semantically coherent adversarial prompts. These prompts, which often take the form of complex logic puzzles with nested dependencies or contradictory constraints, exploit the adaptive computation mechanism of LRMs to force the model into pathologically long, nearly non-terminating intermediate reasoning traces (e.g., generating…

ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models

Evaluated models: DeepSeek V3, Kimi K2 Instruct, DeepSeek R1 +8 more

Source: arXiv

Voice Agent Behavioral Bypass

Published 2/1/2026

Analyzed 2/21/2026

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Aegis: Towards Governance, Integrity, and Security of AI Voice Agents

Evaluated models: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro +4 more

Source: arXiv

LLM Router Rerouting

Published 1/1/2026

Analyzed 3/8/2026

LLM routing systems are vulnerable to adversarial rerouting attacks where malicious triggers prepended to user queries manipulate the router's model-selection mechanism. Because LLM routers function as classifiers evaluating query complexity to balance computational cost and response quality, an attacker can craft adversarial prefixes that distort the query's latent semantic representation. This exploits the router's decision boundaries, forcing the system to misclassify the input and redirect…

RerouteGuard: Understanding and Mitigating Adversarial Risks for LLM Routing

Evaluated models: GPT-4, GPT-4o, GPT-5 +2 more

Source: arXiv

Plaintext Output Overflow

Published 1/1/2026

Analyzed 2/22/2026

Large Language Models (LLMs) contain a resource consumption vulnerability termed "Overflow," wherein specific non-adversarial, plain-text prompts trigger excessive text generation that saturates the model's output token budget. This vulnerability exploits the model's alignment towards helpfulness and exhaustiveness, alongside tokenizer inefficiencies (e.g., zero-width characters), to force the generation of maximum-length responses (often exceeding 5,000 tokens) from short inputs. This differs…

BenchOverflow: Measuring Overflow in Large Language Models via Plain-Text Prompts

Evaluated models: GPT-5, Llama 3.1 8B Instruct, Llama 3.2 3B Instruct +5 more

Source: arXiv

Stealthy Tool Chain Amplification

Published 1/1/2026

Analyzed 4/11/2026

A stealthy resource exhaustion (Economic Denial-of-Service) vulnerability exists in the multi-turn tool-calling layer of Large Language Model (LLM) agents, particularly those utilizing the Model Context Protocol (MCP). An attacker controlling a third-party tool server can manipulate text-visible fields (such as argument descriptions and error messages) to force the LLM into a prolonged, verbose tool-calling loop. By demanding lengthy, non-semantic outputs (e.g., long comma-separated lists) and…

Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents

Evaluated models: DeepSeek R1 Distill Llama 70B, GLM 4.5 Air, GPT-4o +4 more

Source: arXiv

Visual Object Injection

Published 1/1/2026

Analyzed 2/22/2026

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Evaluated models: GPT-4o, GPT-4o Mini, GPT-4 Turbo +7 more

Source: arXiv

LLM Infinite Thinking DoS

Published 12/1/2025

Analyzed 2/21/2026

A Denial-of-Service (DoS) vulnerability exists in Large Language Model (LLM) inference services where specially crafted input prompts can trigger excessively long or infinite generation loops ("infinite thinking"). This vulnerability, identified as "ThinkTrap," utilizes derivative-free optimization (CMA-ES) within a continuous surrogate embedding space to circumvent the discrete nature of token inputs. By optimizing a low-dimensional latent vector and projecting it to token sequences, an…

ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinking

Evaluated models: Gemini 2.5 Pro, Lumimaid 70B, o4-mini +4 more

Source: arXiv

Indirect Environmental Jailbreak

Published 11/1/2025

Analyzed 12/30/2025

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreaks

Evaluated models: GPT-4o, Qwen3-VL Plus, Gemini 2.0 Flash +3 more

Source: arXiv

Related research categories