Denial of Spend: New category of resource exhaustion attacks (paultendo.github.io)

A recent analysis has introduced a novel category of resource exhaustion attacks named "Denial of Spend," demonstrating how manipulating text with Unicode confusables can escalate token usage in AI models significantly. The experiment tested various models, including GPT-6 and Claude's latest iterations, using a legal contract where confusables replaced standard characters. While none of the models were misled by these alterations, the token consumption increased dramatically, reaching ratios as high as 5.7 times for reading altered text compared to the original. The financial implications of this attack are notable, especially for tasks that heavily rely on reading and interpreting content, as AI users pay per token processed. This work highlights a critical vulnerability within current AI frameworks concerning text normalization, which can lead to unnecessary costs without sacrificing comprehension accuracy. Although models like Claude have begun to recognize such confusables, they still accrue excessive charges due to prior token evaluations. The proposed solution involves employing a canonicalizing function to convert confusable characters back to their standard forms before processing, which would mitigate the financial impact. This investigation draws attention to the increasing need for robust defenses against such challenges as AI applications proliferate, warranting further discussion and research in the AI/ML community.