DoS Attacks on AI: Technical Defense Guide | Quiz

Why: Free tier users should have a maximum of 2000 tokens while premium users get 8000 tokens and enterprise users get 32000 tokens – this tiered approach limits abuse potential from free accounts. Context: Free accounts are abuse magnets because attackers create them in bulk. Aggressive limits on free tier combined with phone verification or credit card requirements reduce the attack surface significantly. Remember: Free tier gets 2000 tokens max – lowest limits for highest abuse risk.

Why: This pattern indicates a sponge example or token bomb attack – the attacker is sending complex requests that consume massive resources while staying under traditional rate limits. Context: Traditional rate limiting by request count would not catch this because the number of requests is normal. The attack exploits computational asymmetry where one complex request costs 50x a normal request. Remember: Normal request count but abnormal cost equals sponge/token bomb attack.

Why: An output/input token ratio above 3 should trigger a warning alert while a ratio above 5 indicates critical status – this signals that requests are generating disproportionately large outputs. Context: Normal queries have reasonable output/input ratios. When attackers use token bombs they craft short inputs designed to trigger maximum-length outputs creating abnormally high ratios. Remember: Ratio above 3 is warning – above 5 is critical.

Why: An economic circuit breaker implements per-key daily token and dollar hard caps with auto-suspend at 80% of budget – it prevents the worst financial damage from DoS attacks with minimal implementation effort. Context: AI DoS is fundamentally Economic Denial of Service. Pay-per-use cloud AI means attackers directly cost you money. Budget caps stop the bleeding before costs spiral out of control. Remember: Per-key budget caps with auto-suspend – stops financial damage immediately.

Why: Server-side output caps enforce maximum output tokens at the infrastructure level regardless of what clients request – this single control blocks the majority of token bomb attacks. Context: Never trust client-requested output limits. Attackers will always request maximum output to maximize resource consumption. Server-side enforcement is essential because it cannot be bypassed. Remember: Never trust client limits – enforce output caps at infrastructure level.

Why: Traditional protection uses request-count rate limiting but one complex AI request can consume 1000x the resources of a simple request – making request counts meaningless for AI systems. Context: CDNs and IP-based rate limiting cannot detect that a complex prompt costs vastly more than a simple one. AI DoS requires token-aware rate limiting and input complexity analysis. Remember: Request counts are meaningless – AI needs token-aware rate limiting.

Why: The three attack types are sponge examples/token bombs (50-500x cost multiplier) and compute-heavy prompts (10-200x cost) and model degradation via poisoning (permanent damage). Context: Each type has different mechanisms and detection difficulty. Sponge attacks maximize output tokens while compute-heavy attacks force deep reasoning and model degradation poisons training data. Remember: Three types – sponge/token bombs and compute-heavy and model degradation.