FragToken: Amplifying LLM Inference Cost via Non-Canonical Token Generation

Researchers propose FragToken, an attack framework that amplifies inference cost by training large language models to generate non-canonical token sequences. The attack exploits the many-to-one mapping from token sequences to decoded text: the same text can be represented by a longer non-canonical sequence, thereby systematically increasing the number of autoregressive decoding steps without proportionally increasing the visible response length. The framework combines source-model self-distillation, capacity-aware filtering and budgeting, and BPE-Aligned Merging to induce fragmented generation under ordinary prompts; because directly maximizing token fragmentation would substantially harm model utility, FragToken achieves token inflation while largely preserving utility. The authors' evaluation on four LLMs and three benchmarks shows that the three-benchmark average token inflation rate (TIR) for the four models is 1.99 to 2.46, with only a slight decrease in model utility. The authors state that this reveals a stealthy LLM supply-chain threat that can drive up inference cost without a large number of attack requests.