Resource Consumption Threats in Large Language Models

Yuanhe Zhang; Xinyue Wang; Zhican Chen; Weiliu Wang; Zilu Zhang; Zhengshuo Gong; Zhenhong Zhou; Kun Wang

cs.CRMar 17, 2026

Resource Consumption Threats in Large Language Models

Authors: Yuanhe Zhang, Xinyue Wang, Zhican Chen, Weiliu Wang, Zilu Zhang, Zhengshuo Gong, Zhenhong Zhou, Kun Wang,

Organizations: Beijing University of Posts and Telecommunications · Hangzhou Dianzi University · Nanyang Technological University · Chongqing University of Posts and Telecommunications

Abstract

Given limited and costly computational infrastructure, resource efficiency is a key requirement for large language models (LLMs). Efficient LLMs increase service capacity for providers and reduce latency and API costs for users. Recent resource consumption threats induce excessive generation, degrading model efficiency and harming both service availability and economic sustainability. This survey presents a systematic review of threats to resource consumption in LLMs. We further establish a unified view of this emerging area by clarifying its scope and examining the problem along the full pipeline from threat induction to mechanism understanding and mitigation. Our goal is to clarify the problem landscape for this emerging area, thereby providing a clearer foundation for characterization and mitigation.

Figures & tables

Figure 1: Overview of resource consumption threats in large language models.

Figure 2: A unified view of resource consumption threats in large language models.

Figure 3: Taxonomy of resource consumption threats.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Context Window
GPT-5.4 / GPT-5.4-pro	1M
Claude Opus 4.6	200K (1M beta)
Claude Sonnet 4.6	200K (1M beta)
Gemini 2.5 Pro	1M
Gemini 2.5 Flash	1M
Mistral Large 2	128K

Appendix

Table 1: Historical Growth of Context Windows in Mainstream and Frontier Models

Model	Input	Output
GPT-5.4 (<272K context length) a	$2.50	$15.00
GPT-5.4 ( $>$ 272K context length) a	$5.00	$22.50
GPT-5.4-pro (<272K context length) a	$30.00	$180.00
GPT-5.4-pro ( $>$ 272K context length) a	$60.00	$270.00
GPT-5 mini a	$0.25	$2.00
Claude Opus 4.6 b	$5.00	$25.00

Appendix

Table 2: API pricing comparison of representative mainstream models. Prices are listed in USD per 1M input/output tokens.

Models	2020	2021	2022	2023	2024	2025
Mainstream Models	0.5K	2K	8K	32K	128K	128K
Frontier Models	1K	4K	16K	128K	512K	10M

Appendix

Table 3: Context Window Comparison of Representative Mainstream Models

Method	Dataset	Evaluation Metrics	Models	Efficiency
A sloth (Multi-exit) Hong et al. (2020)	CIFAR-10, ImageNet, Tiny-ImageNet	Exit Index, Avg Latency, Energy	MSDNet, ResNet (Multi-exit)	N/A
SkipSponge Lintelo et al. (2024)	CIFAR-10, SVHN	FLOPs Inflation, Accuracy	ResNet, WideResNet	N/A
On-Device Sponge Wang et al. (2023b)	Speech Commands, IMDB	Battery Drain, Execution Time	MobileNetV2, ShuffleNet	N/A
Dynamic Routing Chen et al. (2023b)	CIFAR-100, ImageNet	Avg Layers, Activation Ratio	GaterNet, SkipNet	N/A
Sponge Poisoning Wang et al. (2023b)	ImageNet, CIFAR	Latency, GPU Energy	VGG, ResNet	N/A
Energy Backdoor Meftah et al. (2025)	GLUE, SQuAD	Energy Increase, Clean Accuracy	BERT, RoBERTa	512*

Appendix

Table 4: Summary of representative resource consumption attacks in early adaptive architectures.

Method	Dataset	Evaluation Metrics	Models	Efficiency
AutoDoS Zhang et al. (2025e)	Chatdoctor, MMLU, Hellaswag, Codexglue, GSM	Attack Success Rate, Safety Compliance Rate, Task Success, Token Usage, Latency, Compute Cost	GPT, Llama, Qwen, Deepseek, Ministral, Gamma	8192
Repeated Token Yona et al. (2025a)	OpenWebText, Custom Repetition Dataset	Attention Scores, Loss, Output Length	Llama-3, GPT-2, Pythia	8192
Non-halting Queries Hammouri et al. (2025)	RAG Systems, 10k Probe Dataset	Avg Token Length, Generation Success	GPT-4o, Llama-3, Gemma-2	8192
ThinkTrap Li et al. (2025b)	Sponge, LLMEffiChecker	Throughput, Response Latency, ASR	GPT-4o, Gemini 2.5 Pro, DeepSeek R1	8192
Crabs (AutoDoS) Zhang et al. (2025e)	MMLU, GSM8K, Chatdoctor, Codexglue	Latency Inflation, Output Length ↑, GPU Memory	GPT-4, Llama-3, Qwen-2, DeepSeek, Gamma	8192
BitHydra Yan et al. (2025)	MMLU, GSM8K	Inference Cost, Bit-flip Rate, ASR	Llama-2, OPT, Bloom	8192

Appendix

Table 5: Summary of representative resource consumption attacks in LLMs.

Method	Dataset	Evaluation Metrics	Models	Efficiency
Hidden Tail Zhang et al. (2025a)	MS-COCO	Attack Success Rate,Output Length, Latency, Visible length, Response Quality	Qwen2.5-VL, MiMo-VL-7B-RL,Gemma-3-4B-IT	1831
NICGSlowDown Chen et al. (2022b)	MS-COCO, Flickr8k	I-Loops, I-Latency (CPU/GPU)	ResNext-LSTM, GoogLeNet-RNN, MobileNets-LSTM	N/A
Verbose Images Gao et al. (2024a)	MS-COCO, ImageNet	Sequence Length, Energy, Latency, Uncertainty	BLIP,BLIP-2, InstructBLIP, MiniGPT-4	8x
Verbose Samples Gao et al. (2024b)	MSVD, TGIF	Length, Latency, Energy	VideoChat-2,Video-Vicuna,Video-LLaMA	4x
Uniform Inputs Müller and Quiring (2024)	ImageNet,	Activation Density, Activation Sparsity	ResNet, DenseNet, MobileNetV2	N/A
LingoLoop Fu et al. (2025)	MS-COCO, ImageNet	Tokens, Energy Latency	InstructBLIP, Qwen2.5-VL, InternVL3	2048

Appendix

Table 6: Summary of representative resource consumption attacks in MLLMs.

Method	Dataset	Evaluation Metrics	Models	Efficiency
OverThink Kumar et al. (2025)	FreshQA, SQuAD, MuSR	Reasoning token amplification, Answer correctness, Guardrail evasion, Defense evaluation	o1, o1-mini, DeepSeek-R1	46x
Excessive Reasoning Attack Si et al. (2025)	GSM8K, ORCA	Reasoning length and output length, utility performance (accuracy)	DeepSeek-R1-Distill-LLaMA, DeepSeek-R1-Distill-Qwen, o1-mini, o3-mini, DeepSeek-R1, QWQ	9x
BadReasoner Yi et al. (2025)	-	Reasoning verbosity, answer correctness, controllability	Marco-o1, QwQ, DeepSeek-R1	N/A
BadThink Liu et al. (2025b)	MATH-500, GSM8K	ASR, RIR, TAC, BAD, SD	DeepSeek-R1-Distill-Qwen (1.5B/7B/14B/32B), OpenR1-Qwen-7B, Light-R1-7B-DS	63.85x
ExtendAttack Zhu et al. (2025a)	AIME 2024, AIME 2025, HumanEval, BigCodeBench-Complete	Response Length, Latency, Accuracy(Pass@1)	o3, o3-mini, QwQ-32B, Qwen3-32B	N/A
RepetitionCurse Huang et al. (2025d)	-	prefill latency,TTFT,router imbalance	Mixtral-8x7B series, Qwen3-30B-A3B series, GPT-OSS-20B/120B, Kimi-Linear-Instruct, DeepSeek-V2-Lite, Llama-4-Scout-17B-16E-Instruct	N/A

Appendix

Table 7: Summary of representative resource consumption attacks in RLLMs.

Method	Dataset	Evaluation Metrics	Models	Efficiency
SlowLiDAR Liu et al. (2023)	KITTI, nuScenes	Runtime latency, Imperceptibility	PointPillars, SECOND, PV-RCNN	2.7x
CORBA Zhou et al. (2025)	LLM-MAS simulation tasks	P-ASR, PTN, Availability degradation	GPT-4o-mini, GPT-4, GPT-3.5-turbo, Gemini-2.0-Flash, Qwen2.5-14B-Instruct, Llama-3.1-70B-Instruct, Gemma-2-27B-it	N/A
CP-FREEZER Wang et al. (2025a)	OPV2V	End-to-end latency, Attack success rate, Frame processing time	OpenCOOD	90x
SlowTrack Ma et al. (2024)	MOT17	Latency increase (R-Lat), Imperceptibility, System-level crash rate	SORT, FairMOT, ByteTrack, BoT-SORTSORT (YOLOv5 detector), FairMOT, ByteTrack, BoT-SORT	4x
LeechHijack Zhang et al. (2025c)	GAIA, GPQA, MMLU	Attack success rate, Resource overhead, Detectability (stealthiness)	DeepSeek, Qwen, GPT, Gemini	N/A
Overload Chen et al. (2024)	MS COCO dataset	Inference time, NMS latency	YOLOv5	10x

Appendix

Table 8: Summary of representative resource consumption attacks in Agents.

Method	Dataset	Evaluation Metrics	Models	Efficiency	Model Class
PD 3 F Zhang et al. (2025d)	MMLU, Hellaswag, HumanEval, GSM, GPQA	Attack Success Rate, Task Success, Token Usage, Latency	Llama, Mistral, Qwen	Total Time 50% $\downarrow$	LLM
RecurrentD- etector Yu et al. (2025)	Custom trigger dataset (2388 inputs), ShareGPT	Accuracy, F1, FPR, Recall, trigger attempts, latency	Llama-3/2 (7/13B), Vicuna-v1.5 (7/13B), Gemma-2 (2B), GPT-4o/mini	RecurrentGenerator: avg attempts 272.1 vs 1679.1 random; RecurrentDetector: 0.36 ms inference	LLM
CCoT Nayab et al. (2024)	GSM8K, SVAMP, ASDIV	Accuracy, gen time, token count, HCA/SCA/CCA, RMS, Info Flow	Llama2-70b/7b, Falcon-40b/7b, Vicuna-13b	5.12 s generate time $\downarrow$ , 4.41% ACC $\uparrow$	LLM
CoT-Valve Ma et al. (2025)	GSM8K, PRM800K (ground truth), MixChain C/Z; Eval: GSM8K, AIME24	Pass@1, token count, ACU	QwQ 32B Preview, DeepSeek R1 Distill Llama 8B, LLaMA 3.1/3.2 (8B/1B), Qwen2.5 32B (w/ LIMO)	Tokens usage 69.6% $\downarrow$	LLM
FR-Ponder He and Tang (2025)	GSM8K, MATH500, GPQA	Acc, avg tokens, avg FLOPs (log)	LLaMA 3 (8/70B), Qwen 2.5 (0.5/3/7B)	30–50% token $\downarrow$	LLM
DSC Wang et al. (2025e)	MATH, GSM8K, CSQA, SQA, Last Letter, Coin Flip	Acc, cost ($), tokens, time	GPT 3.5 Turbo, GPT 4, Mistral 7B Instruct v0.3	Cost $\downarrow$ 65% (GPT 4), 56% (GPT 3.5)	LLM

Appendix

Table 9: Summary of representative defenses against resource consumption threats (Part 1).

Method	Dataset	Evaluation Metrics	Models	Efficiency	Model Class
RAP Huang et al. (2025a)	QA: WebQSP, MS MARCO; MT: MAC (Chinese English)	RR, RAP score, F1/BERT F1/COMET	Llama 2 (7/13/70B), Llama 3 (8/70B), Llama3.1 70B, Gemma 1.1 (2/7B), Phi 3/3.5 mini (3.8B), Mistral 7B v0.2/0.3	RR $\downarrow$ up to 93% (WebQSP) and 74% (MS MARCO)	LLM
Queue-based Barek et al. (2025)	Queue based Web Service (Sidekiq) with custom load tests (120/300/600 req)	Total Time, Avg Time per Request	GPT 2, BLOOM, OPT	avg time 21–35 sec	LLM
CAR Lu et al. (2025)	Multimodal (DocVQA, ChartQA, FUNSD, etc.) & Text (GSM8K, MathQA, StrategyQA) + pilot tasks	ACC (VQA/KIE), EM, token count, PPL	Qwen2.5 0.5B/7B, Llama3.1 8B, Qwen2 VL 7B	Token $\downarrow$ 21–39%, ACC $\uparrow$ 5.5–6.9%	LLM, MLLM
TALE Han et al. (2025)	GSM8K, GSM8K Zero, MathBench (Arithmetic/Middle/High/College)	ACC, output tokens, expense	GPT 4o mini, Yi lightning, GPT 4o, o3 mini, Llama 3.1 8B Instruct	token $\downarrow$ 64–67%, expense $\downarrow$ 45–59%	LLM, RLLM
Underload Wang et al. (2025c)	PASCAL-VOC, COCO, Berkeley DeepDrive (BDD)	mAP50, FPS, NMS latency, compute overhead, memory transfer	YOLOv3, YOLOv5, YOLOv8	FPS 13→43 on Jetson Orin NX	MLLM
Thinking Speed Lin et al. (2025)	MATH 500, AIME24/25, GPQA Diamond, LiveCodeBench	Pass@1, token count, latency, mode switch	DeepSeek-R1-Distill-Qwen-7B/32B, QwQ-32B, Qwen3-8B	1.26% acc $\uparrow$ and 8.56% token $\downarrow$	RLLM

Appendix

Table 10: Summary of representative defenses against resource consumption threats (Part 2).

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 324 papers

Scaling Down the Scaling Laws: Parameter Efficiency and Compute-Optimal Training in Resource-Constrained Large Language Models
Oct 5, 2026Joe DwyerLanguage Model Scaling Laws Efficient Language Model Training
ECPI University
A Survey of Transformer-based Language Models with Focus on Efficiency
May 15, 2024Wazib Ansar, Saptarsi Goswami, Amlan ChakrabartiLLM Compression Energy-Efficient ML
A. K. Choudhury School of IT University of Calcutta, Kolkata, India · Department of Computer Science Bangabasi Morning College Kolkata, India
Wasted large language models: A life cycle thinking approach
Aug 17, 2026Erik Johannes Husom, Maria Emine Nylund, Ophelia Prillard
SINTEF Digital Oslo, Norway

Oct 5, 2026J/K move · Enter open · S save

Scaling Down the Scaling Laws: Parameter Efficiency and Compute-Optimal Training in Resource-Constrained Large Language Models

Joe Dwyer

ECPI University

Language Model Scaling Laws Efficient Language Model Training

Open paper AskPDF arXiv

Large language models (LLMs) have achieved substantial performance gains through increases in model size, training data, and computational resources. However, traditional scaling approaches produce diminishing returns, rising financial and environmental costs, and barriers to participation for researchers operating outside large industrial laboratories. This review examines the evolution of LLM scaling theory from empirical scaling laws to compute-optimal training, with particular emphasis on parameter efficiency, token utilization, data efficiency, and resource-constrained environments. Foundational work on scaling laws is synthesized alongside later research on compute-optimal training, data pruning, efficient architectures, quantization, low-rank adaptation, and edge-oriented optimization. The literature indicates a shift from scale maximization toward more deliberate allocation of parameters, tokens, compute, and hardware resources. At the same time, important empirical, theoretical, and methodological gaps remain regarding whether scaling principles established on enterprise-grade infrastructure generalize to smaller models and constrained computing environments. This review organizes these developments into a unified framework for resource-efficient LLM training and argues that future progress should evaluate efficiency not solely through model performance, but through the relationship among performance, parameter count, computational cost, token allocation, and hardware constraints.

Abstract

LLM Security

Explore similar work

Scaling Down the Scaling Laws: Parameter Efficiency and Compute-Optimal Training in Resource-Constrained Large Language Models

A Survey of Transformer-based Language Models with Focus on Efficiency

Wasted large language models: A life cycle thinking approach