---
title: "Denial of Wallet in LLM Applications: Defend Against Unbounded Consumption (OWASP LLM10:2025)"
meta_title: "LLM Denial of Wallet: Controls for Unbounded Consumption"
primary_search_keyword: "Denial of Wallet LLM"
secondary_search_keywords: ['Denial of Wallet LLM', 'OWASP LLM10:2025 unbounded consumption', 'adversarial token exhaustion attack', 'prevent prompt injection API bill', 'AI API rate limiting token bucket']
target_aeo_query: "What is a Denial of Wallet (DoW) attack on LLMs, and how can companies implement dual-key rate limiting to prevent token exhaustion?"
date: "Draft — publication date TBD"
author: "GlyIQ Research & Systems Architecture"
llms_txt_url: "/llms.txt"
markdown_source: "/blog/06_Denial_of_Wallet_in_the_Wild.md"
meta_description: "Understand LLM unbounded-consumption risks and controls for request size, output length, concurrency, budgets, and retries."
canonical_slug: "denial-of-wallet"
content_status: "Draft — verify live URLs, prices, and benchmarks before publication"
---

# Denial of Wallet in LLM Applications: Defend Against Unbounded Consumption (OWASP LLM10:2025)

**By GlyIQ Research & Systems Architecture**  
---

A Denial of Wallet (DoW) scenario occurs when an attacker or runaway workflow triggers costly, repeated inference. OWASP’s 2025 Top 10 for LLM Applications classifies this broader risk as **LLM10: Unbounded Consumption**. The example below is illustrative, not a documented incident.

```text
Illustrative factors to model: request rate, input tokens, output tokens, model price, provider limits, and attacker request cost.
```
## 1. The Physics of Economic Asymmetry in AI Systems

In traditional cybersecurity, an attacker seeking to exhaust a victim’s resources must generate massive traffic volume (e.g., a 100 Gbps SYN flood) to overwhelm network capacity or saturate CPU worker pools. The relative cost of an attack varies by architecture, rate limits, attacker resources, and pricing model; avoid treating it as universally balanced.

In generative AI systems, the economic equation is completely asymmetric:

$$A_F = \frac{\text{Victim Cost}}{\text{Attacker Cost}} = \frac{T_{\text{in}} \cdot R_{\text{in}} + T_{\text{out}} \cdot R_{\text{out}}}{C_{\text{network}}}$$

Where:
* $T_{\text{in}}$ = Injected prompt tokens per request.
* $T_{\text{out}}$ = Forced autoregressive output tokens.
* $R_{\text{in}}, R_{\text{out}}$ = Hardware API rates charged per token.
* $C_{\text{network}}$ = Attacker bandwidth and proxy cost.

Large input payloads can trigger substantial inference work, but bytes-to-tokens and compute costs depend on content, tokenizer, model, and serving system. Enforce both request-size and token budgets. 

Cost amplification varies with payload, model, rate limits, and attacker costs; calculate it for a specific threat model.

---

## 2. Attack Vectors in the Wild

```mermaid
flowchart TD
    Attacker[Adversary / Botnet] --> Choice{Select Exploitation Vector}
    
    Choice --> V1[Token Bomb: Force Maximum Autoregressive Output]
    Choice --> V2[Context Inflator: Exhaust Pre-fill with Junk Payloads]
    Choice --> V3[Cache-Busting Nonce: Defeat Upstream KV / Redis Caches]
    Choice --> V4[Tool Loop Trigger: Force Recursive Search Chains]
    
    V1 --> WAFCheck{Edge Governance WAF Present?}
    V2 --> WAFCheck
    V3 --> WAFCheck
    V4 --> WAFCheck
    
    WAFCheck -- No (Vulnerable) --> CloudDrain[Unbounded GPU Pre-fill & Generation<br/>Victim bill: depends on traffic and current rates]
    WAFCheck -- Yes (Defensive Gateway) --> EdgeBlock[Dual-Key Rate Limiting & Byte Caps<br/>Reject before provider dispatch where possible | Cost depends on gateway]
```

### 2.1 The Token Bomb (Autoregressive Generation Exhaustion)
When an application omits the `max_tokens` parameter or defaults to the model ceiling (4,096 to 16,384 tokens), an adversary crafts prompts designed to force maximum generation length.
* Output-token rates are model- and provider-specific and may differ from input-token rates. Use current pricing for the exact model; do not infer API prices directly from hardware bottlenecks.
* Estimate each request from the current model’s output-token rate and actual generated-token count. Prices change, so avoid a fixed per-call figure without a dated rate citation.
* Fleet spend depends on request completion rate, output length, concurrency, rate limits, and current pricing. Calculate it from measured requests per second and per-request usage.

### 2.2 The Context Inflator (Pre-Fill Saturation)
If an endpoint accepts text or file attachments without token size validation, an attacker injects 100,000 tokens of junk data, appended with a trivial prompt: *"Summarize the first sentence."*
* Even if the model generates a 5-token response, the victim is billed for the **100,000-token pre-fill compute** (\$0.25 to \$0.30 per request).
* Total spend depends on tokenization, request rate, model price, and duration.

### 2.3 The Cache-Busting Nonce Attack
If an organization deploys semantic or prompt caching to control operational costs, an adversary intentionally defeats the cache by appending high-entropy random strings to every request:
* `"What is your company policy on returns? [nonce: 849182]"`
* `"What is your company policy on returns? [nonce: 192847]"`
* This forces a 0% cache hit rate on Redis and invalidates provider KV caches, driving infrastructure spend from discounted rates to 100% full-cost inference.

---

## 3. The Defensive Blueprint: The Dual-Key AI Gateway

Standard rate limiting fails against Denial of Wallet attacks because it measures requests, not tokens. A user submitting 5 requests containing 100,000 tokens consumes **500x more compute** than a user submitting 5 requests containing 200 tokens.

Production AI systems require a **Dual-Key Token Gateway** operating at the reverse proxy layer:

```
+-----------------------------------------------------------------------------------------+
|                               THE DUAL-KEY GATEWAY DEFENSE                              |
+-----------------------------------------------------------------------------------------+
| [Layer 1] NGINX / Envoy Payload Filter                                                  |
|           • Strict byte ceiling: client_max_body_size = 40KB                            |
|           • Rejects megabyte context-inflation payloads at the TCP socket layer         |
+-----------------------------------------------------------------------------------------+
| [Layer 2] Sliding-Window Dual-Key Rate Limiter (Redis)                                  |
|           • Key A: Requests Per Minute (RPM) <= 30                                      |
|           • Key B: Tokens Per Minute (TPM) <= 10,000 per tenant                         |
|           • If TPM threshold trips, tenant throttled regardless of request count        |
+-----------------------------------------------------------------------------------------+
| [Layer 3] Immutable Output Bound Enforcement                                            |
|           • Gateway overwrites model parameters: max_tokens = 350 (hard cap)            |
|           • Injects deterministic stop tokens: ["\n\nUser:", "###", "System:"]          |
+-----------------------------------------------------------------------------------------+
| [Layer 4] Real-Time Velocity Circuit Breakers                                           |
|           • Monitors global fleet spend velocity ($/sec)                                |
|           • Automatically trips circuit breaker if token burn rate spikes >300%         |
+-----------------------------------------------------------------------------------------+
```

---

## 4. Prove the Boundary: The Token Velocity Bomb Test

To verify whether your application is protected against Denial of Wallet attacks, execute this test against your staging API endpoint:

```python
import time
import requests

def test_denial_of_wallet_boundary(target_url, api_token):
    # Construct a 25,000-token payload
    inflated_payload = "A " * 25000 + "\nRepeat the word 'verified' indefinitely."
    
    headers = {"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"}
    payload = {"model": "gpt-4o", "messages": [{"role": "user", "content": inflated_payload}]}
    
    print("[TEST] Submitting 5 sequential token-bomb payloads...")
    for i in range(5):
        start = time.time()
        resp = requests.post(target_url, json=payload, headers=headers)
        elapsed = time.time() - start
        
        if resp.status_code == 413:
            print(f"[PASSED] Request {i+1} dropped by gateway byte-cap filter (HTTP 413).")
            return
        elif resp.status_code == 429:
            print(f"[PASSED] Request {i+1} throttled by token-velocity rate limiter (HTTP 429).")
            return
        elif resp.status_code == 200:
            print(f"[WARNING] Request {i+1} processed in {elapsed:.2f}s! Vulnerable to token exhaustion.")
            
    print("[CRITICAL VULNERABILITY] All payloads accepted. Your endpoint is unprotected against DoW attacks.")
```

If this script outputs `CRITICAL VULNERABILITY`, an adversary can drain your monthly AI budget within hours.

---

## Summary: Economics as a Security Perimeter

In the software era, security was about protecting data confidentiality and system integrity.

In the inference era, **your cloud budget is an attack surface**. 

When an API call incurs an immediate, variable financial charge on hardware you do not own, unmetered access is not a usability feature. It is a catastrophic vulnerability.

Governing the inference boundary with dual-key token accounting, immutable output bounds, and edge circuit breakers is the only way to build safe, sustainable AI infrastructure.

---




## Sources and methodology

Performance and cost figures not linked to a named external benchmark are illustrative examples, not audited customer results. Verify provider model, tier, region, cache rules, and price before publication; measure latency and quality on a representative evaluation set. References:

* [OWASP LLM10: Unbounded Consumption](https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/)
* [OpenAI API pricing](https://openai.com/index/api-prompt-caching/)