Skip to content
Log in
Conference Open access

NaturalSloth: Revisiting Denial-of-Service Attacks on Large Language Models

Yiming Chen Zexin Li Xianghu Yue R. Tan Haizhou Li
2026 · Annual Meeting of the Association for Computational Linguistics · pp. 19685-19702 · 0 citations · 52 references
Computer Science

TL;DR

This work introduces NaturalSloth, an adversarial dataset of natural, instruction-based DoS prompts, and designs a multi-agent synthesis framework to scale the dataset while preserving malicious intent and increasing semantic diversity.

Abstract

LLM serving is limited by provider-side resources: longer generations consume more GPU time, increase latency, and reduce throughput in multi-tenant systems. This creates a denial-of-service (DoS) risk, where at-tackers degrade service by inducing excessive generation. Prior work on LLM DoS primarily relies on adversarial perturbations that delay end-of-sequence termination. We show perturbations are often unnecessary: natural, benign-looking instructions that specify impractical and meaningless tasks can already trigger excessive generation. To study this overlooked vulnerability, we introduce NaturalSloth , an adversarial dataset of natural, instruction-based DoS prompts. Starting from a human-curated seed set spanning diverse attack categories, we design a multi-agent synthesis framework to scale the dataset while preserving malicious intent and increasing semantic diversity. Experiments across a wide range of proprietary and open-source LLMs show that NaturalSloth consistently induces excessive generation, with attack effectiveness further amplified when combined with jailbreak techniques. Our analysis also reveals significant limitations of existing defenses, highlighting the need for dedicated protections against natural DoS attacks. 1

DOI Semantic Scholar
Read PDF

Similar papers

Preprint Jul 2026

Defense Against LLM Backdoors using Critical Neuron Isolation Pruning

DeCNIP (Defense with Critical Neuron Isolation Pruning), which leverages representational analysis to identify and neutralize backdoors in a unified pipeline, is introduced, which achieves over 95% relative reduction in Attack Success Rate (ASR), outperforming seven state-of-the-art defenses with only 0.1% neuron intervention.

Yuxi Li, Zhibo Zhang, Kailong Wang et al. · 0 citations
Preprint Aug 2026

Generating Attacks for LLMs with GFlowNets

This study proposes an automated, human-independent, and adaptive approach leveraging GFlowNets to identify LLM vulnerabilities by utilizing one large language model to test another, and introduces a model capable of generating attack inputs in the Turkish language.

Berkay Ozcam, Irem Onen, M. Amasyalı et al. · 0 citations
Book Open access Jul 2026

Llama Models Security: From OWASPs Benchmarking to Encoding-based ​ obfuscation attacks​

This work presents a two-phase evaluation of ten Llama variants using the OWASP Top 10 for LLM Applications, and applies nine encoding obfuscations to the same prompts, which fully bypasses all text-only models.

Nourin Shahin, I. Alsmadi · 0 citations
Preprint Jul 2026

Adversarial Prompts for Acceptance Collapse in Speculative Decoding

Lossless acceleration schemes, such as speculative decoding, promise significant inference speedups by relying on dynamic token-level alignment between a draft and a target model. However, this guarantee of semantic equivalence masks a severe operational vulnerability: draft-target alignment can be systematically attacked. In this paper, we introduce ADSD, which, to the best of our knowledge, is the first prompt-suffix attack that collapses verifier acceptance by pushing draft probability mass toward tokens the target is unlikely to accept. ADSD uses Soft-Collapse, a verifier-aligned surrogate derived from the asymmetric speculative acceptance rule, together with a target-preservation objective that discourages obvious task corruption. ADSD successfully generates highly effective adversarial suffixes. On the GSM8K dataset, our attack increases the mean sample time by 62.3% while preserving the task quality. We further show that this vulnerability exists across different domains, speculative decoding strategies, and model architectures.

Run-Min Wang, Chaoyi Zhou, Xi Liu et al. · 0 citations