AI threat catalogueAttacks on the Running Model and ServiceProduction
Application Denial of Service
Attackers make the AI application unreachable for legitimate users by flooding the application layer with requests or exhausting its resources. The service is heavily slowed or goes down.
Description
This attack targets not the model's computing load but the application layer around it: web server, interface gateway, connections and memory. Attackers flood the service with a mass of requests, often distributed across many hijacked sources (distributed denial-of-service, DDoS), or hold connections open permanently with slowly sent requests (Slowloris) until none remain free. Deliberately exhausting connection and memory reserves also belongs here. It is a classic availability attack on the AI service's operating environment.
Possible impact
The AI service is no longer reachable, or only with delay, for legitimate users, and dependent business processes stall. Beyond the operational outage, there is a risk of penalties under service-level agreements and reputational damage. For high-risk systems, continuous availability is part of the required robustness and operational monitoring.
Example
During a product launch an attacker directs a network of hijacked computers at the customer portal with its AI assistant. The flood of requests overloads the interface gateway, and thousands of genuine visitors receive only error messages.
Recommended mitigations (5)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Rate limiting and throttlingTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Rate limiting and throttling” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures; complemented by binding workflows.
DDoS protection servicesTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “DDoS protection services” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures.
Horizontal scaling and autoscalingTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Horizontal scaling and autoscaling” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures.
Circuit breakers and timeoutsTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Circuit breakers and timeouts” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures.
Capacity planningOrganizational & process-based
- Effect
- Preventive
- Implementation level
- Infrastructure, Organization, Use & operations
- Complementary control type
- Technical
- Reason for the classification
- “Capacity planning” is primarily organizational and process-based: Defined selection, operating, or lifecycle procedures make the control binding and repeatable; complemented by technical implementation.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (6)
Every reference states the framework, the exact location and the publishing organisation.
- MITRE ATLAS AML.T0029 Denial of AI ServiceATLAS.yaml technique object with id AML.T0029 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 26(5) Obligations of deployers of high-risk AI systemsArticle 26(5) European Union (EUR-Lex)Original
- EU AI Act Article 55(1)(d) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(d) European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- BIML BIML-LLM inference:9 HostingPDF p. 19, [inference:9:hosting] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML78 system:10 Denial of ServicePDF p. 26, [system:10:denial of service] Berryville Institute of Machine Learning (BIML)Original
Related threats
More entries from the topic group Attacks on the Running Model and Service.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Application Denial of Service”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/application-denial-of-service/