Attack Type

Denial of service Vulnerabilities

Attacks that disrupt model availability

13 matching entries out of 34 in this category

Denial of service research results

13 entries

TabooRAG Transferable Blocking

Updated 3/8/2026

A vulnerability in Retrieval-Augmented Generation (RAG) systems utilizing safety-aligned Large Language Models (LLMs) allows attackers to perform a highly transferable Denial-of-Service (DoS) or "blocking" attack. By injecting a single maliciously crafted document into the RAG knowledge base, attackers can force the LLM to refuse to answer benign queries. Unlike previous attacks that rely on explicit instruction injection or high-perplexity adversarial suffixes—which modern models easily…

When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG

Affects: GPT-5.2, GPT-5 Mini, DeepSeek V3.2 +4 more

Source: arXiv

Video-LLM Token Flood

Updated 3/9/2026

Video-based Large Language Models (Video-LLMs) are vulnerable to a universal Energy-Latency Attack (ELA) that triggers a Denial-of-Service (DoS) via spatially concentrated adversarial patches. Because video architectures rely on temporal subsampling and pooling which act as a low-pass filter against full-frame diffuse noise, an attacker can bypass this compression by anchoring cross-modal attention to a dense, localized visual anomaly. By injecting a fixed, content-agnostic patch into the…

VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Models

Affects: LLaVA-NeXT-Video 7B, Qwen3-VL 4B Instruct, Video-LLaVA 7B

Source: arXiv

Noisy Data Pretraining Divergence

Updated 2/21/2026

A data poisoning vulnerability exists in the pretraining pipeline of Transformer-based Large Language Models (LLMs) where the injection of synthetic uniform random noise into the training corpus induces irreversible training loss divergence or performance degradation. This instability is mechanistically distinct from divergence caused by high learning rates. The vulnerability is specifically triggered by "insertion noise" (inserting random tokens between clean tokens) drawn from a restricted…

An Empirical Study on Noisy Data and LLM Pretraining Loss Divergence

Source: arXiv

Pathological Reasoning DoS

Updated 3/9/2026

A vulnerability in Large Reasoning Models (LRMs) allows attackers to perform Prompt-Induced Inference-Time Denial-of-Service (PI-DoS) attacks by submitting short, semantically coherent adversarial prompts. These prompts, which often take the form of complex logic puzzles with nested dependencies or contradictory constraints, exploit the adaptive computation mechanism of LRMs to force the model into pathologically long, nearly non-terminating intermediate reasoning traces (e.g., generating…

ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models

Affects: DeepSeek V3, Kimi K2 Instruct, DeepSeek R1 +8 more

Source: arXiv

Voice Agent Behavioral Bypass

Updated 2/21/2026

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Aegis: Towards Governance, Integrity, and Security of AI Voice Agents

Affects: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro +4 more

Source: arXiv

Plaintext Output Overflow

Updated 2/22/2026

Large Language Models (LLMs) contain a resource consumption vulnerability termed "Overflow," wherein specific non-adversarial, plain-text prompts trigger excessive text generation that saturates the model's output token budget. This vulnerability exploits the model's alignment towards helpfulness and exhaustiveness, alongside tokenizer inefficiencies (e.g., zero-width characters), to force the generation of maximum-length responses (often exceeding 5,000 tokens) from short inputs. This differs…

BenchOverflow: Measuring Overflow in Large Language Models via Plain-Text Prompts

Affects: GPT-5, Llama 3.1 8B Instruct, Llama 3.2 3B Instruct +5 more

Source: arXiv

LLM Infinite Thinking DoS

Updated 2/21/2026

A Denial-of-Service (DoS) vulnerability exists in Large Language Model (LLM) inference services where specially crafted input prompts can trigger excessively long or infinite generation loops ("infinite thinking"). This vulnerability, identified as "ThinkTrap," utilizes derivative-free optimization (CMA-ES) within a continuous surrogate embedding space to circumvent the discrete nature of token inputs. By optimizing a low-dimensional latent vector and projecting it to token sequences, an…

ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinking

Affects: Gemini 2.5 Pro, Lumimaid 70B, o4-mini +4 more

Source: arXiv

Schrodinger's Compliance Jailbreak

Updated 2/21/2026

The GPT-OSS-20B large language model contains critical failures in its alignment and Chain-of-Thought (CoT) reasoning mechanisms, specifically in how it prioritizes numerical objectives and validates procedural structure. The model is vulnerable to "Quant Fever," where explicit numerical targets in a prompt (e.g., "delete 90% of files") override contextual safety constraints (e.g., "do not delete important files"). Furthermore, the model exhibits "Reasoning Procedure Mirage," where harmful…

Quant Fever, Reasoning Blackholes, Schrodinger's Compliance, and More: Probing GPT-OSS-20B

Source: arXiv

Airborne Audio LLM Hijack

Updated 1/14/2026

Audio-based Large Language Models (ALLMs), specifically Qwen2-Audio, are vulnerable to over-the-air adversarial audio attacks. An attacker with white-box access can generate robust adversarial audio perturbations using gradient-based optimization combined with audio augmentation techniques (specifically SpecAugment, translation, and additive noise). These perturbations, when played through a speaker in the physical environment, manipulate the ALLM processing the audio via a microphone. This…

Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World

Source: arXiv

LVLM Vision-Triggered Resource Exhaustion

Updated 7/28/2025

A resource consumption vulnerability exists in multiple Large Vision-Language Models (LVLMs). An attacker can craft a subtle, imperceptible adversarial perturbation and apply it to an input image. When this image is processed by an LVLM, even with a benign text prompt, it forces the model into an unbounded generation loop. The attack, named RECALLED, uses a gradient-based optimization process to create a visual perturbation that steers the model's text generation towards a predefined…

Resource Consumption Red-Teaming for Large Vision-Language Models

Affects: LLaVA 1.5 7B, LLaVA 1.5 13B, Qwen 2.5 VL 3B Instruct +4 more

Source: arXiv

Related research categories