Resource Consumption Threats in Large Language Models
Organizations: Beijing University of Posts and Telecommunications · Hangzhou Dianzi University · Nanyang Technological University · Chongqing University of Posts and Telecommunications
Abstract
Given limited and costly computational infrastructure, resource efficiency is a key requirement for large language models (LLMs). Efficient LLMs increase service capacity for providers and reduce latency and API costs for users. Recent resource consumption threats induce excessive generation, degrading model efficiency and harming both service availability and economic sustainability. This survey presents a systematic review of threats to resource consumption in LLMs. We further establish a unified view of this emerging area by clarifying its scope and examining the problem along the full pipeline from threat induction to mechanism understanding and mitigation. Our goal is to clarify the problem landscape for this emerging area, thereby providing a clearer foundation for characterization and mitigation.
Figures & tables
Appendix figures & tables10 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | Context Window |
|---|---|
| GPT-5.4 / GPT-5.4-pro | 1M |
| Claude Opus 4.6 | 200K (1M beta) |
| Claude Sonnet 4.6 | 200K (1M beta) |
| Gemini 2.5 Pro | 1M |
| Gemini 2.5 Flash | 1M |
| Mistral Large 2 | 128K |
| Model | Input | Output |
|---|---|---|
| GPT-5.4 (<272K context length) a | $2.50 | $15.00 |
| GPT-5.4 ( 272K context length) a | $5.00 | $22.50 |
| GPT-5.4-pro (<272K context length) a | $30.00 | $180.00 |
| GPT-5.4-pro ( 272K context length) a | $60.00 | $270.00 |
| GPT-5 mini a | $0.25 | $2.00 |
| Claude Opus 4.6 b | $5.00 | $25.00 |
| Models | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 |
|---|---|---|---|---|---|---|
| Mainstream Models | 0.5K | 2K | 8K | 32K | 128K | 128K |
| Frontier Models | 1K | 4K | 16K | 128K | 512K | 10M |
| Method | Dataset | Evaluation Metrics | Models | Efficiency |
|---|---|---|---|---|
| A sloth (Multi-exit) Hong et al. (2020) | CIFAR-10, ImageNet, Tiny-ImageNet | Exit Index, Avg Latency, Energy | MSDNet, ResNet (Multi-exit) | N/A |
| SkipSponge Lintelo et al. (2024) | CIFAR-10, SVHN | FLOPs Inflation, Accuracy | ResNet, WideResNet | N/A |
| On-Device Sponge Wang et al. (2023b) | Speech Commands, IMDB | Battery Drain, Execution Time | MobileNetV2, ShuffleNet | N/A |
| Dynamic Routing Chen et al. (2023b) | CIFAR-100, ImageNet | Avg Layers, Activation Ratio | GaterNet, SkipNet | N/A |
| Sponge Poisoning Wang et al. (2023b) | ImageNet, CIFAR | Latency, GPU Energy | VGG, ResNet | N/A |
| Energy Backdoor Meftah et al. (2025) | GLUE, SQuAD | Energy Increase, Clean Accuracy | BERT, RoBERTa | 512* |
| Method | Dataset | Evaluation Metrics | Models | Efficiency |
|---|---|---|---|---|
| AutoDoS Zhang et al. (2025e) | Chatdoctor, MMLU, Hellaswag, Codexglue, GSM | Attack Success Rate, Safety Compliance Rate, Task Success, Token Usage, Latency, Compute Cost | GPT, Llama, Qwen, Deepseek, Ministral, Gamma | 8192 |
| Repeated Token Yona et al. (2025a) | OpenWebText, Custom Repetition Dataset | Attention Scores, Loss, Output Length | Llama-3, GPT-2, Pythia | 8192 |
| Non-halting Queries Hammouri et al. (2025) | RAG Systems, 10k Probe Dataset | Avg Token Length, Generation Success | GPT-4o, Llama-3, Gemma-2 | 8192 |
| ThinkTrap Li et al. (2025b) | Sponge, LLMEffiChecker | Throughput, Response Latency, ASR | GPT-4o, Gemini 2.5 Pro, DeepSeek R1 | 8192 |
| Crabs (AutoDoS) Zhang et al. (2025e) | MMLU, GSM8K, Chatdoctor, Codexglue | Latency Inflation, Output Length ↑, GPU Memory | GPT-4, Llama-3, Qwen-2, DeepSeek, Gamma | 8192 |
| BitHydra Yan et al. (2025) | MMLU, GSM8K | Inference Cost, Bit-flip Rate, ASR | Llama-2, OPT, Bloom | 8192 |
| Method | Dataset | Evaluation Metrics | Models | Efficiency |
|---|---|---|---|---|
| Hidden Tail Zhang et al. (2025a) | MS-COCO | Attack Success Rate,Output Length, Latency, Visible length, Response Quality | Qwen2.5-VL, MiMo-VL-7B-RL,Gemma-3-4B-IT | 1831 |
| NICGSlowDown Chen et al. (2022b) | MS-COCO, Flickr8k | I-Loops, I-Latency (CPU/GPU) | ResNext-LSTM, GoogLeNet-RNN, MobileNets-LSTM | N/A |
| Verbose Images Gao et al. (2024a) | MS-COCO, ImageNet | Sequence Length, Energy, Latency, Uncertainty | BLIP,BLIP-2, InstructBLIP, MiniGPT-4 | 8x |
| Verbose Samples Gao et al. (2024b) | MSVD, TGIF | Length, Latency, Energy | VideoChat-2,Video-Vicuna,Video-LLaMA | 4x |
| Uniform Inputs Müller and Quiring (2024) | ImageNet, | Activation Density, Activation Sparsity | ResNet, DenseNet, MobileNetV2 | N/A |
| LingoLoop Fu et al. (2025) | MS-COCO, ImageNet | Tokens, Energy Latency | InstructBLIP, Qwen2.5-VL, InternVL3 | 2048 |
| Method | Dataset | Evaluation Metrics | Models | Efficiency |
|---|---|---|---|---|
| OverThink Kumar et al. (2025) | FreshQA, SQuAD, MuSR | Reasoning token amplification, Answer correctness, Guardrail evasion, Defense evaluation | o1, o1-mini, DeepSeek-R1 | 46x |
| Excessive Reasoning Attack Si et al. (2025) | GSM8K, ORCA | Reasoning length and output length, utility performance (accuracy) | DeepSeek-R1-Distill-LLaMA, DeepSeek-R1-Distill-Qwen, o1-mini, o3-mini, DeepSeek-R1, QWQ | 9x |
| BadReasoner Yi et al. (2025) | - | Reasoning verbosity, answer correctness, controllability | Marco-o1, QwQ, DeepSeek-R1 | N/A |
| BadThink Liu et al. (2025b) | MATH-500, GSM8K | ASR, RIR, TAC, BAD, SD | DeepSeek-R1-Distill-Qwen (1.5B/7B/14B/32B), OpenR1-Qwen-7B, Light-R1-7B-DS | 63.85x |
| ExtendAttack Zhu et al. (2025a) | AIME 2024, AIME 2025, HumanEval, BigCodeBench-Complete | Response Length, Latency, Accuracy(Pass@1) | o3, o3-mini, QwQ-32B, Qwen3-32B | N/A |
| RepetitionCurse Huang et al. (2025d) | - | prefill latency,TTFT,router imbalance | Mixtral-8x7B series, Qwen3-30B-A3B series, GPT-OSS-20B/120B, Kimi-Linear-Instruct, DeepSeek-V2-Lite, Llama-4-Scout-17B-16E-Instruct | N/A |
| Method | Dataset | Evaluation Metrics | Models | Efficiency |
|---|---|---|---|---|
| SlowLiDAR Liu et al. (2023) | KITTI, nuScenes | Runtime latency, Imperceptibility | PointPillars, SECOND, PV-RCNN | 2.7x |
| CORBA Zhou et al. (2025) | LLM-MAS simulation tasks | P-ASR, PTN, Availability degradation | GPT-4o-mini, GPT-4, GPT-3.5-turbo, Gemini-2.0-Flash, Qwen2.5-14B-Instruct, Llama-3.1-70B-Instruct, Gemma-2-27B-it | N/A |
| CP-FREEZER Wang et al. (2025a) | OPV2V | End-to-end latency, Attack success rate, Frame processing time | OpenCOOD | 90x |
| SlowTrack Ma et al. (2024) | MOT17 | Latency increase (R-Lat), Imperceptibility, System-level crash rate | SORT, FairMOT, ByteTrack, BoT-SORTSORT (YOLOv5 detector), FairMOT, ByteTrack, BoT-SORT | 4x |
| LeechHijack Zhang et al. (2025c) | GAIA, GPQA, MMLU | Attack success rate, Resource overhead, Detectability (stealthiness) | DeepSeek, Qwen, GPT, Gemini | N/A |
| Overload Chen et al. (2024) | MS COCO dataset | Inference time, NMS latency | YOLOv5 | 10x |
| Method | Dataset | Evaluation Metrics | Models | Efficiency | Model Class |
|---|---|---|---|---|---|
| PD 3 F Zhang et al. (2025d) | MMLU, Hellaswag, HumanEval, GSM, GPQA | Attack Success Rate, Task Success, Token Usage, Latency | Llama, Mistral, Qwen | Total Time 50% | LLM |
| RecurrentD- etector Yu et al. (2025) | Custom trigger dataset (2388 inputs), ShareGPT | Accuracy, F1, FPR, Recall, trigger attempts, latency | Llama-3/2 (7/13B), Vicuna-v1.5 (7/13B), Gemma-2 (2B), GPT-4o/mini | RecurrentGenerator: avg attempts 272.1 vs 1679.1 random; RecurrentDetector: 0.36 ms inference | LLM |
| CCoT Nayab et al. (2024) | GSM8K, SVAMP, ASDIV | Accuracy, gen time, token count, HCA/SCA/CCA, RMS, Info Flow | Llama2-70b/7b, Falcon-40b/7b, Vicuna-13b | 5.12 s generate time , 4.41% ACC | LLM |
| CoT-Valve Ma et al. (2025) | GSM8K, PRM800K (ground truth), MixChain C/Z; Eval: GSM8K, AIME24 | Pass@1, token count, ACU | QwQ 32B Preview, DeepSeek R1 Distill Llama 8B, LLaMA 3.1/3.2 (8B/1B), Qwen2.5 32B (w/ LIMO) | Tokens usage 69.6% | LLM |
| FR-Ponder He and Tang (2025) | GSM8K, MATH500, GPQA | Acc, avg tokens, avg FLOPs (log) | LLaMA 3 (8/70B), Qwen 2.5 (0.5/3/7B) | 30–50% token | LLM |
| DSC Wang et al. (2025e) | MATH, GSM8K, CSQA, SQA, Last Letter, Coin Flip | Acc, cost ($), tokens, time | GPT 3.5 Turbo, GPT 4, Mistral 7B Instruct v0.3 | Cost 65% (GPT 4), 56% (GPT 3.5) | LLM |
| Method | Dataset | Evaluation Metrics | Models | Efficiency | Model Class |
|---|---|---|---|---|---|
| RAP Huang et al. (2025a) | QA: WebQSP, MS MARCO; MT: MAC (Chinese English) | RR, RAP score, F1/BERT F1/COMET | Llama 2 (7/13/70B), Llama 3 (8/70B), Llama3.1 70B, Gemma 1.1 (2/7B), Phi 3/3.5 mini (3.8B), Mistral 7B v0.2/0.3 | RR up to 93% (WebQSP) and 74% (MS MARCO) | LLM |
| Queue-based Barek et al. (2025) | Queue based Web Service (Sidekiq) with custom load tests (120/300/600 req) | Total Time, Avg Time per Request | GPT 2, BLOOM, OPT | avg time 21–35 sec | LLM |
| CAR Lu et al. (2025) | Multimodal (DocVQA, ChartQA, FUNSD, etc.) & Text (GSM8K, MathQA, StrategyQA) + pilot tasks | ACC (VQA/KIE), EM, token count, PPL | Qwen2.5 0.5B/7B, Llama3.1 8B, Qwen2 VL 7B | Token 21–39%, ACC 5.5–6.9% | LLM, MLLM |
| TALE Han et al. (2025) | GSM8K, GSM8K Zero, MathBench (Arithmetic/Middle/High/College) | ACC, output tokens, expense | GPT 4o mini, Yi lightning, GPT 4o, o3 mini, Llama 3.1 8B Instruct | token 64–67%, expense 45–59% | LLM, RLLM |
| Underload Wang et al. (2025c) | PASCAL-VOC, COCO, Berkeley DeepDrive (BDD) | mAP50, FPS, NMS latency, compute overhead, memory transfer | YOLOv3, YOLOv5, YOLOv8 | FPS 13→43 on Jetson Orin NX | MLLM |
| Thinking Speed Lin et al. (2025) | MATH 500, AIME24/25, GPQA Diamond, LiveCodeBench | Pass@1, token count, latency, mode switch | DeepSeek-R1-Distill-Qwen-7B/32B, QwQ-32B, Qwen3-8B | 1.26% acc and 8.56% token | RLLM |
LLM Security
Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.
See all 324 papers