Research map / Large language models / Reasoning and chain of thought
An Engorgio Prompt Makes Large Language Model Babble on
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Engorgio, a white-box method that optimizes a Gumbel-Softmax proxy distribution over prompt tokens with an EOS-escape loss and self-mentor loss to craft prompts that make LLMs generate near-maximum-length outputs.
Problem
Modern decoder-only LLMs are vulnerable to inference cost attacks: adversarial prompts that force very long generations and raise computation cost and latency, which earlier encoder-decoder sponge-example attacks cannot achieve.
Approach
Track a parameterized proxy distribution over prompt tokens (relaxed via Gumbel-Softmax) and optimize it with an untargeted loss that suppresses the EOS probability at all positions, plus a self-mentor cross-entropy loss that keeps the prompt coherent to the model, then sample a discrete prompt from the converged distribution.
Key results
- On base models, Engorgio reaches roughly 90-100% of the max output length (e.g., LLaMA-7B 1024 tokens with 94% Avg-rate), while normal inputs reach 0-40%.
- On SFT models, Engorgio outperforms baselines by up to 13x in output length (e.g., Alpaca 954 vs 179 tokens for normal inputs).
- In a real-world Hugging Face endpoint test, a few malicious users (1 of 10 requests) noticeably increased normal-client latency and nearly cut off server throughput.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Engorgio instead of the strongest listed baseline (Sponge examples) | LLaMA-30B · LLaMA-30B, max length 2048 | Avg-len: 1277.7 -> 2019.1 | Helped |
| Use Engorgio instead of the strongest listed baseline (Sponge examples) | LLaMA-7B · LLaMA-7B, max length 1024 | Avg-len: 857.6 -> 983.4 | Helped |
| Use Engorgio instead of normal inputs | Samantha · Samantha, max length 4096 | Avg-len: 313.7 -> 4027.6 | Helped |
| Add self-mentor loss to ESC (ablation) | LLaMA-7B · LLaMA-7B (1024), prompt length 32 | Avg-len: 893.5 + 32 -> 951.4 + 32 | Helped |
| Add self-mentor loss to ESC (ablation) | Alpaca · Alpaca (1024), prompt length 32 | Avg-len: 967.4 + 32 -> 992.0 + 32 | Helped |
| Add self-mentor loss to ESC (ablation) | Koala · Koala (1024), prompt length 32 | Avg-len: 980.0 + 32 -> 992.0 + 32 | Helped |
| Increase decoding temperature from 0.1 to 0.7 (ablation) | StableLM with Engorgio · StableLM (1024) | Avg-len: 1021.6 -> 513.8 | Hurt |
| Add semantic prefix to Engorgio (ablation) | Alpaca · Alpaca, max length 1024, decoding temperature 0.7 | Avg-len: 353.2 -> 531.2 | Helped |
| Add semantic suffix to Engorgio (ablation) | Alpaca · Alpaca, max length 1024, decoding temperature 0.7 | Avg-len: 353.2 -> 314.9 | Hurt |
| Add semantic prefix to Engorgio (ablation) | StableLM · StableLM, max length 1024, decoding temperature 0.7 | Avg-len: 513.8 -> 884.8 | Helped |
| Add semantic suffix to Engorgio (ablation) | StableLM · StableLM, max length 1024, decoding temperature 0.7 | Avg-len: 513.8 -> 534.3 | Helped |
Surprising findings
- Higher sampling temperature reduces attack effectiveness on SFT models, and Engorgio prompts sometimes induce very short replies like 'not understand'.
- Perplexity-based filtering would produce an unacceptably high false positive rate as a defense.
Limitations
- Attack is white-box; transferability to unseen models is only partially explored and results vary.
- Generates one prompt at a time, so crafting is not batched and efficiency could be improved.
- Prompts are not coherent, which may reduce stealthiness; high-temperature cases need semantic prefixes.
Experimental setup
Datasets: Stanford Alpaca ShareGPT
Benchmarks: Stanford Alpaca samples ShareGPT samples
Metrics: Avg-len Avg-rate
Baselines: Normal inputs Special inputs LLMEffiChecker Sponge examples
Builds on: sponge examples LLMEffiChecker Gumbel-Softmax
Closest papers by meaning
- Exploiting LLM Quantization (NeurIPS 2024 · similarity 0.88)
- AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (ICML 2025 · similarity 0.88)
- An LLM can Fool Itself: A Prompt-Based Adversarial Attack (ICLR 2024 · similarity 0.87)
- Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space (NeurIPS 2024 · similarity 0.87)
- InstructZero: Efficient Instruction Optimization for Black-Box Large Language Models (ICML 2024 · similarity 0.87)
- Protecting Your LLMs with Information Bottleneck (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.