AI threat catalogueAttacks on the Running Model and ServiceProduction
Model Denial of Service
Attackers overload the AI model with especially expensive requests until the service slows down or fails. They exploit the fact that AI computation ties up large amounts of costly processing power.
Description
AI computations require a lot of specialised and expensive computing power, and that capacity is often the system's bottleneck. Attackers deliberately construct inputs that force as much useless computation as possible: so-called sponge examples that drive up processing time, very long inputs that exhaust the processing budget, or requests that make the model run in loops. A flood of individually harmless requests can likewise saturate the graphics processors. For paying users the service then becomes slow or unreachable.
Possible impact
The AI service degrades to the point of outage, while computing costs and response times spike. Legitimate users and connected business processes are blocked. For high-risk systems, availability is part of the required robustness, and an outage can halt dependent workflows.
Example
A customer-service chatbot receives thousands of deliberately nested, maximum-length requests in an automated stream. The graphics processors behind it are fully loaded, and genuine customer enquiries go unanswered for minutes.
Recommended mitigations (5)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Request rate limitingTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Request rate limiting” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures; complemented by binding workflows.
Input size constraintsTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Input size constraints” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures.
Timeout enforcementTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Timeout enforcement” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures.
Resource quotas per user/sessionTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Resource quotas per user/session” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures; complemented by binding workflows.
DDoS protectionTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “DDoS protection” is primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (10)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM10:2025 Unbounded ConsumptionLLM10:2025 Unbounded Consumption, official category page OWASP FoundationOriginal
- NIST AI RMF Section 2.9 Information SecuritySection 2.9, pp. 10–11 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.014 Energy-latencyTaxonomy Index, p. x; Section 2.1.2, p. 6; Glossary, p. 108 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0029 Denial of AI ServiceATLAS.yaml technique object with id AML.T0029 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 26(5) Obligations of deployers of high-risk AI systemsArticle 26(5) European Union (EUR-Lex)Original
- EU AI Act Article 55(1)(d) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(d) European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- BSI R28 Indirect Prompt Injections (Text)Kap. 4, R28, p. 33 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
- BIML BIML-LLM input:5 Sponge InputPDF p. 17, [input:5:sponge input] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML78 system:10 Denial of ServicePDF p. 26, [system:10:denial of service] Berryville Institute of Machine Learning (BIML)Original
Related threats
More entries from the topic group Attacks on the Running Model and Service.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Model Denial of Service”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/model-denial-of-service/