通过重复生成诱导低熵循环，高效耗尽大模型资源。
LoopLLM: Transferable Energy-Latency Attacks in LLMs via Repetitive Generation
- 设计可优化的提示词，利用自回归特性引发重复输出。
- 在12个开源及商用模型上实现超90%最大输出长度，远超基线。
- 提升跨模型攻击迁移能力约40%，适合安全测试与防御研究。
随着大语言模型规模扩大，推理过程消耗大量计算资源，易受能效-延迟攻击影响，即恶意提示导致高能耗和高延迟。现有方法依赖延迟终止符号生成来延长输出，但随着输出变长，输入对终止符号的控制力下降，效果减弱。为此，我们提出LoopLLM，基于重复生成可触发低熵解码循环的观察，使模型持续生成直至达到输出上限。该框架包含：(1) 利用自回归漏洞诱导重复生成的提示词优化方法；(2) 通过梯度聚合实现跨模型迁移的对齐集成优化。在12个开源及2个商用模型上的实验表明，LoopLLM显著优于现有方法，在最大输出长度上达到超过90%，而基线仅约20%；同时对DeepSeek-V3和Gemini 2.5 Flash的迁移能力提升约40%。
原文摘要 · Abstract (English)
As large language models (LLMs) scale, their inference incurs substantial computational resources, exposing them to energy-latency attacks, where crafted prompts induce high energy and latency cost. Existing attack methods aim to prolong output by delaying the generation of termination symbols. However, as the output grows longer, controlling the termination symbols through input becomes difficult, making these methods less effective. Therefore, we propose LoopLLM, an energy-latency attack framework based on the observation that repetitive generation can trigger low-entropy decoding loops, reliably compelling LLMs to generate until their output limits. LoopLLM introduces (1) a repetition-inducing prompt optimization that exploits autoregressive vulnerabilities to induce repetitive generation, and (2) a token-aligned ensemble optimization that aggregates gradients to improve cross-model transferability. Extensive experiments on 12 open-source and 2 commercial LLMs show that LoopLLM significantly outperforms existing methods, achieving over 90% of the maximum output length, compared to 20% for baselines, and improving transferability by around 40% to DeepSeek-V3 and Gemini 2.5 Flash.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。