Concept Fable

Denial-of-service attack

Conclusion first:Denial-of-Service (DoS) on LLM is an attack or abuse that exhausts model service resources through extremely long contexts, recursive tasks, massive concurrency, expensive tool calls, or inducing the model to reason for a long time. Its protection requires rate limiting, context length limits, timeouts, cost budgets, recursion depth limits, queue isolation, anomaly detection, and degradation strategies. For enterprise Agents, DoS protection is directly related to availability, cost, and SLA.

Denial-of-Service (DoS) on LLM · Attack type

Read the story first. There is no rush to give a definition here; let the question grow on its own first.

Fable

The library was crushed by an unlimited borrowing list

The city library had a very fast retriever. When readers submitted questions, he would run into the stacks, find materials, write summaries, and deliver answers. Ordinary questions could be completed in minutes, and everyone praised the library for its speed.

Later someone discovered that as long as you wrote the question long enough—asking him to compare all versions, cite all footnotes, and re-check every clue repeatedly—the researcher would run around the library all day. The troublemaker didn't steal books or break down doors; he just handed over a seemingly earnest borrowing slip.

The curator initially thought this was diligence among readers. So he required the retrieval clerks to answer as completely as possible and not refuse easily. The line soon stretched out the door, and the people truly rushing to look up prescriptions, contracts, and travel permits could not get service.

The accountant found ink, paper and lamp oil consumption soaring; the retriever wasn't robbed of books, but was worn down to the point of being unable to work. Some suggested buying more lamp oil and hiring more retrievers. The troublemaker immediately handed over a longer borrowing list, and queued at several doors at once.

The first fix only expanded resources, and costs rose with the other side's appetite. The deputy director changed the rules: each borrowing slip has a length limit, time budget, recursion depth, concurrency quota, and cost threshold; abnormal patterns are downgraded, unfamiliar readers must queue, and dangerous requests are cut off directly.

They also wrote resource consumption into the ledger: which entry point is most expensive, which kinds of questions slow things down most, which regulars need higher quotas, which behaviors look like attacks. Normal readers with a genuinely long question can book a dedicated time slot; people deliberately digging bottomless pits cannot occupy the public window.

The library later understood that denying service does not necessarily require smashing the door. As long as you induce the retriever to pour expensive labor into a bottomless pit, normal business will be squeezed out; guarding the gate means looking not only at whether content is harmful, but also at how much public capacity it will consume.

Later a small sign appeared at the library entrance: serious questions welcome; questions that would swallow the entire library must first state their purpose and budget. Readers were unaccustomed at first, but after a few weeks they were more satisfied, because people who truly needed help no longer had to be blocked at the door by an absurdly long list.

Reveal

This story is about: denial-of-service attacks

Denial-of-Service (DoS) on LLM is an attack or abuse that exhausts model service resources through extremely long contexts, recursive tasks, massive concurrency, expensive tool calls, or inducing the model to reason for a long time. Its protection requires rate limiting, context length limits, timeouts, cost budgets, recursion depth limits, queue isolation, anomaly detection, and degradation strategies. For enterprise Agents, DoS protection is directly related to availability, cost, and SLA.

What matters is that it is not just a term, but a structural problem that repeatedly appears in real AI / Agent systems. Understanding it lets you judge when to add a model, when to change a process, and when to add governance.

Metaphor mapping

Unlimited book-borrowing list: ultra-long prompts, recursive requests or complex tool chains
The retriever runs all day: model inference and tool-calling resources are exhausted
The line stretches out the door: normal user requests are blocked
Buying more lamp oil: simply scaling up without governing resource consumption
Length limits, time budgets, and recursion depth: LLM DoS protection controls
Unfamiliar readers queuing: rate limiting and queue isolation
Resource consumption logs: cost monitoring and anomaly detection

Andy Ren Xu's judgment

The practical value of this concept is that it helps you break "AI features that look smart" into deliverable, verifiable, and governable units of work.

Compute resource exhaustionOverlong prompt attackRate limiting