FragToken: Amplifying LLM Inference Costs through Noncanonical Token Generation
FragToken trains LLMs to emit longer non-canonical tokens, roughly doubling inference cost while keeping answers usable.
FragToken is a training-time attack that makes LLMs prefer longer non-canonical token sequences for ordinary text, increasing autoregressive decoding steps without a matching increase in visible length. It combines source-model self-distillation, capacity-aware filtering and budgeting, and BPE-aligned merging so utility does not collapse. Across four unnamed LLMs and three benchmarks, average token inflation ranged from 1.99 to 2.46 with only minor quality loss. The authors describe it as a covert supply-chain threat to model-provider inference cost.
- The same text can use much longer non-canonical token sequences.
- Self-distillation, budgeting, and BPE-aligned merging limit quality loss.
- Average token inflation is 1.99 to 2.46 across four LLMs.
- Raises inference cost without large volumes of attack requests.
From the original article
1 min read at arxiv.orgAs large language model (LLM) inference becomes increasingly expensive, resource-consumption attacks pose a growing threat to model providers. Existing attacks typically amplify cost by inducing abnormally long or repetitive outputs on attacker-controlled or triggered requests, making them easier to detect and limiting their deployment-wide impact when benign traffic dominates.
By Zihan Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.