Revisiting Denial-of-Service Attacks with Delayed Requests: Attacking LLM Serving Frameworks, Not Models
Rethinking Latency Denial-of-Service: Attacking the LLM Serving Framework, Not the Model
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers propose the Fill and Squeeze (F&S) attack, targeting the scheduler state machine of LLM serving frameworks rather than the model generation process, causing up to a 742x degradation in TTFT for same-machine users on vLLM. The paper first finds that model-level latency attacks largely fail under continuous batching, with 50-75% malicious requests increasing normal users' TTFT by only 3-5.7%. F&S uses Fill to exhaust the global KV cache and trigger head-of-line blocking, uses Squeeze to force the scheduler to repeatedly preempt, and leverages an ITL side channel to estimate KV usage in a black-box setting. On vLLM v0.11.2 with Qwen3-8B, Gemma3-12B-it, and DeepSeek-R1-Distill-Llama-8B, TTFT degradation reaches up to 742x (Gemma3-12B-it from 0.13 seconds to 97.83 seconds), and the attack cost is 30-40% lower than existing attacks. The paper states that per-entity KV quotas, skip-based admission, fair queuing, and output buffering can mitigate this attack.
- 现有针对 LLM 的 latency attack 多从模型层延长输出长度，但作者发现这类攻击在现代 LLM 服务系统上基本无效，因为 continuous batching 在迭代级别隔离了同租户请求，攻击者只是拖慢自己。作者认为需要转向系统层，利用调度器的资源管理逻辑重新制造可传染的延迟。
- 提出 Fill and Squeeze（F&S）攻击，针对调度器状态机：Fill 用长输出请求耗尽全局 KV cache 触发基于内存的 Head-of-Line blocking，Squeeze 在饱和边界附近用低成本请求反复触发 preemption 与恢复。攻击者通过 ITL 侧信道训练 LightGBM 估计 KV 使用率，并用分层 prompt 与闭环反馈在 Fill、Squeeze、Back-off 间切换。
- 在 vLLM 上对 Qwen3-8B、Gemma3-12B-it、DeepSeek-R1-Distill-Llama-8B 等模型测试，F&S 相比现有攻击造成更高 TTFT 与 TPOT 退化，且攻击成本更低；在真实 BurstGPT 流量下可借环境流量降低约 40% 成本。TP2 到 TP4/TP8 的扩容会抬高饱和门槛，削弱攻击。SGLang 上也观察到类似效果。
- 实验主要在单台 8×L40S 节点，多节点仅做被动探测，未对生产流量发起主动攻击；pipeline parallelism、speculative decoding、跨节点 TP 未验证。估计器需在同型号 GPU 与模型上校准，若服务端缓冲流式输出则退化为开环攻击。结论针对 vLLM 0.11.2 与 SGLang 特定 commit，未来版本可能修补相关路径。
The paper finds that model-level latency attacks largely fail under continuous batching, so it instead targets the scheduler state machine and provides measured data on vLLM.