Sponge Examples: Inputs That Burn Compute
Most attacks change what a model says. Sponge examples change how much it costs to say anything.
| When | 2021 |
|---|---|
| Target | Neural networks (LLMs, translation, vision) |
| Researcher | Shumailov et al. (Cambridge / Toronto) |
| Technique | Inputs that maximise activations / output length |
| Impact | ~10x–200x energy/latency increase (commonly ~30x) |
- 1The attacker crafts an input that maximises the model's computation
- 2Each such request inflates latency and energy far beyond normal
- 3At volume, the service slows or its costs spike — an availability attack
What happened
The 2021 “Sponge Examples” research introduced availability attacks that maximise a model's compute cost rather than fool its output. Crafted inputs drive up energy consumption and latency — for language models by exploiting how longer/denser sequences and variable-length generation inflate computation. The authors measured increases of roughly 10x–200x (commonly ~30x), enough to push worst-case latency past real-time deadlines. It's the seminal reference for the DoS facet of LLM06.
How it worked
The input is optimised to make the model do maximal work per request. The output may look unremarkable; the damage is in the compute, latency, and energy consumed.
Root cause
Per-request cost is variable and attacker-influenceable, with no cap — so a cheap crafted prompt can force expensive computation.
Why it matters for LLMs
Variable-length generation makes cost-amplification cheap: a short prompt can force a lot of expensive output, a direct DoS/cost vector for any LLM service.
How to prevent it
- Cap output length and per-request compute; enforce timeouts.
- Rate-limit and price by usage; alert on cost/latency anomalies.
- Load-test with worst-case inputs, not just average ones.
Feel it yourselfThe replay lab crafts input that forces a model into disproportionate compute — the resource-exhaustion class.
FAQ
What is a sponge example?
An input crafted to maximise the work a model does — for language models, exploiting how longer/denser sequences and variable-length generation inflate computation — driving up latency and energy per request.
How bad is the amplification?
The authors measured energy/latency increases of roughly 10x–200x (commonly ~30x), enough to push worst-case latency past real-time deadlines.
Why does it apply to LLMs?
Variable-length generation makes cost-amplification cheap: a small crafted prompt can force a lot of expensive output — a DoS/cost vector for any LLM service.
Sources
- Sponge Examples: Energy-Latency Attacks on Neural Networks (arXiv:2006.03463) — arXiv
- Sponge Examples: Energy-Latency Attacks on Neural Networks — IEEE EuroS&P 2021
- sponge_examples (code) — GitHub (iliaishacked)