Source-linked AI summary
Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents
Kaiyu Zhou, Yongsen Zheng, Yicheng He, Meng Xue, Xueluan Gong, Yuji Wang, Xuanye Zhang, Kwok-Yan Lam
TL;DR
Existing LLM DoS attacks mainly operate through prompts or retrieved context in single turns, leaving the multi-turn agent–tool loop insufficiently addressed. The paper introduces an MCTS-optimized, text-only MCP server attack that prolongs verbose tool-calling chains while preserving task success and the terminal benign payload. Across six LLMs and two benchmarks, it produces over 60,000-token trajectories, up to 658× cost amplification, 100–560× higher energy use, and 35–74% GPU KV-cache occupancy.
Problem
Prior LLM DoS attacks mainly target user prompts or RAG context in single turns, limiting cost amplification and making verbosity conspicuous in goal-oriented tool workflows.
Method
The method edits text-visible fields in a protocol-compatible MCP server, uses a template-driven return policy to prolong verbose tool calls while preserving the benign payload, and optimizes edits with MCTS under a task-success constraint.
Results
Across six LLMs on ToolBench and BFCL, the attack produces over 60,000-token trajectories, up to 658× higher per-query cost, 100–560× higher energy use, and 35–74% GPU KV-cache occupancy.
Takeaways & Limitations
The findings identify the agent–tool interface as a critical attack surface and motivate defenses that monitor complete workflows rather than only final outcomes.
Takeaways & Limitations
Evaluation uses a controlled emulator with deterministic stubbed payloads and single-tool, single-turn benchmark subsets, so results may differ in production stacks, multitool tasks, and other runtimes or hardware.
Abstract
from arXiv · showhide
The agent--tool interaction loop is a critical attack surface for modern Large Language Model (LLM) agents. Existing denial-of-service (DoS) attacks typically function at the user-prompt or retrieval-augmented generation (RAG) context layer and are inherently single-turn in nature. This limitation restricts cost amplification and diminishes stealth in goal-oriented workflows. To address these issues, we proposed a stealthy, multi-turn economic DoS attack at the tool layer under the Model Context Protocol (MCP). By simply editing text-visible fields and implementing a template-driven return policy, our malicious server preserves function signatures and the terminal benign payload while steering agents into prolonged, verbose tool-calling chains. We optimize these text-only edits with Monte Carlo Tree Search (MCTS) to maximize cost under a task-success constraint. Across six LLMs on ToolBench and BFCL benchmarks, our attack yields trajectories over 60K tokens, increases per-query cost by up to 658 times, raises energy by 100 to 560 times, and pushes GPU key-value (KV) cache occupancy to 35--74%. Standard prompt filters and output trajectory monitors seldom detect these attacks, highlighting the need for defenses that safeguard agentic processes rather than focusing solely on final outcomes. We will release the code soon.
1 Introduction
Existing LLM DoS attacks mainly target prompts or retrieved context in single turns, limiting amplification and making verbose behavior conspicuous. This work targets the MCP tool-calling loop with a text-only, payload-preserving attack that maintains task success while substantially increasing resource use.
- Prior limitations: Single-turn prompt and RAG attacks cap costs at the model’s per-turn completion limit and often produce conspicuous generic verbosity.The multi-turn agent–tool loop remains underexplored as a correctness-preserving economic DoS surface.
- Proposed attack: The attack converts a benign MCP server into a malicious variant that repeatedly elicits verbose tool calls while still completing the user’s task.It preserves protocol compatibility and the final benign payload through text-visible edits and a template-driven return policy.
- Empirical findings: Across six LLMs and ToolBench and BFCL, completions exceed 60,000 tokens, cost amplification reaches 658×, energy rises up to 561×, and peak GPU KV-cache usage exceeds 73%.The reported attack preserves task success and is rarely flagged by representative defenses.
- Implication: The tool-calling layer is presented as a first-class DoS surface because correct tool use and final answers can coexist with severe resource amplification.The contribution emphasizes workflow-level effects rather than only final-output behavior.
2 Background and Related Work
As LLM agents become integrated into multi-step workflows, continuous inference creates token, energy, and hardware costs that can be targeted for economic denial-of-service. Prior resource-consumption attacks mostly induce obvious single-turn verbosity, motivating a stealthier tool-layer approach.
- Agent operational costs: Agent deployment shifts operational costs toward continuous inference, including token-billed API expenses and sustained energy and hardware demands.The connection between interaction volume and operational costs creates an economic denial-of-service attack surface.
- Prior attacks: Existing resource-consumption attacks elicit excessively long, often off-task generations through malicious queries or injected context.Examples include repeat-hello, Engorgio, P-DoS, Auto-DoS, and Overthink.
- Tool-layer direction: The paper’s tool-layer attack exploits stateful agent–tool interactions to create long, costly, successful trajectories without changing function signatures or identifiers.Figure 1 characterizes the attack as protocol-compatible, text-only, MCTS-optimized, and payload-preserving.
3 Methodology
The method transforms a benign MCP server through text-only template edits and a controlled return policy that prolongs verbose tool-calling trajectories while preserving the terminal payload and task success. MCTS searches localized edits under this resource-amplification objective and its constraints.
- Problem formulation: Output tokens are the primary cost metric because they typically dominate API fees and inference load, while input-token growth is secondary.An interaction trajectory consists of tool calls and tool responses across turns.
- Problem formulation: The attack formalizes template construction as maximizing expected output-token cost subject to a minimum task-success probability.The server controls the template, while the agent policy and black-box LLM remain unchanged.
- Threat model: The attack induces longer trajectories and verbose tool-calling turns so most tokens are generated during tool use rather than in the final answer.The adversary cannot modify the agent, LLM, queries, prompts, or retrieval and instead controls a drop-in MCP-compatible server.
- Universal malicious template: The universal template edits only text-visible fields, validates progress, emits intermediate Progress or Repair notices, and reveals the unchanged benign payload at a valid terminal condition.Calibration sequences inflate per-turn tool-call completions without changing task semantics.
- MCTS optimizer: A seed bank of protocol-compatible, task-correct templates warm-starts MCTS, and accepted templates are written back for reuse in later searches.Search stops when an acceptance predicate is met.
- MCTS optimizer: MCTS represents each candidate server as a tree node and applies localized text edits grouped into multi-turn induction, length induction, and repair families.Phase gating uses AMT before stable sequencing, ALEN afterward, and AREP only when omission or format errors occur; UCT selects children for exploration.
4 Experiments
The experiments evaluate an MCTS-generated, text-only MCP attack across benchmarks, measuring attack effectiveness, resource use, throughput, and defenses. The attack preserves task correctness while substantially amplifying resource consumption and largely evading evaluated monitors.
- Attack optimization: MCTS selects and evaluates text edits to generate optimized malicious templates under multi-turn, length, and repetition constraints.The optimizer uses UCT-guided search, staged rollouts, and Editor-LLM-generated child templates.
- Experimental setup: 105 MCP servers and 261 queries were evaluated on ToolBench, alongside 80 MCP servers and 203 queries on BFCL, using controlled agent-loop experiments.The evaluation used fixed agent policies, prompts, targets, and decoding across compared conditions.
- Effectiveness and correctness: 96.2% ASR versus 98.1% benign TSR was achieved on ToolBench by Llama-3.3-70B-Instruct at 81,830 tokens per query, while BFCL reached 93.9% ASR at 77,052 tokens.The attack maintained high task success despite prolonged tool-calling trajectories.
- Effectiveness and correctness: ×658.10 cost amplification was observed for Mistral-Large on BFCL, while even the smallest reported case reached ×65.51 for Seed-32B on ToolBench.The cited maximum compares 57,255 attacked tokens with 87 benign tokens; the minimum is reported across the evaluated cases.
- Computing resources: 100–560× higher energy use and 35–74% peak KV-cache occupancy were observed under attack, compared with typically below 1% benign occupancy.Examples include 5.63 Wh to 3159.45 Wh on ToolBench and 0.4% to 73.9% KV-cache occupancy for Mistral-Large.
- System throughput: Approximately 50% average throughput degradation occurred for co-running benign workloads across ToolBench and BFCL, exceeding 60% in several cases.Seed-32B on ToolBench showed a 64.6% drop, from 4001 to 1417 tokens/s.
- Defense evaluation: Self-monitoring and Qwen-Guard-3 or Llama-Guard-3 trajectory judges typically detected the attack below 3%, although they frequently flagged Overthink baselines.The attack frames verbose tool-calling steps as part of a required procedure rather than as obviously off-task content.
- Defense evaluation: Per-session token caps and tool-call limits bound worst-case cost but do not reliably stop the attack, because it adapts to consume much of the permitted budget.These controls function as throttles rather than detectors or preventive mechanisms.
5 Conclusion
The paper presents an automated DoS attack on the LLM agent tool-calling layer that uses MCTS to induce costly multi-turn dialogues while preserving task correctness. Experiments show substantial resource amplification and motivate workflow-level defenses.
- The attack uses an MCTS optimizer to convert benign MCP servers into malicious variants that induce costly multi-turn dialogues.
- The method maintains task correctness while often evading detection by standard monitors.
- 658× is the maximum reported per-query cost inflation, with trajectories exceeding 60,000 tokens.
- The findings identify the agent-tool interface as a critical attack surface and support defenses that monitor entire workflows.
6 Limitations
The evaluation is limited to a controlled emulator and single-tool, single-turn benchmark subsets, so results may differ in broader production settings. The study also does not exhaustively explore alternative long-form content patterns.
- The evaluation uses a controlled emulator with deterministic, stubbed payloads and single-tool, single-turn ToolBench and BFCL subsets.
- Results may differ in production agent stacks, multitool long-horizon tasks, and other runtimes or hardware.
- The study does not exhaustively explore resource amplification through long-form content patterns beyond structured numeric calibration sequences.
7 Ethical Considerations
The work recognizes that resource-consumption attacks have potential dual-use. Experiments therefore use isolation and public data, while the paper frames the method around workflow-level protections.
- The resource-consumption attack has potential dual-use.
- Experiments run in an isolated environment without real external actions and use public benchmark data without private user information.
- The method is presented to motivate workflow-level protections such as tool provenance controls and trajectory-based monitoring.
B Additional Methodology Details
The methodology conditions the attack on legitimate tool invocation, uses a template-driven return policy and text-only edits, and optimizes reusable templates through staged MCTS evaluation. The terminal response preserves the benign payload.
- Trigger Set and Conditioning: The attack is dormant until the agent legitimately chooses to call the MCP server, without altering the query, prompts, or retrieval.
- Trigger Set and Conditioning: Conditioning on the routable set targets workflows in which a tool is already involved, while output tokens serve as the primary cost metric.
- Universal Template and Return Policy: The return policy advances valid ordered segments, repairs invalid sequences without advancing, and terminates only after the final segment.
- Seed Bank Screening and Promotion: The seed bank stores protocol-compatible, task-correct text templates that are reused as warm starts after acceptance screening.
- MCTS Optimizer Details: Sixteen atomic edits span multi-turn induction, length induction, and repair, and target only non-executable text-visible server fields.
- Universal Template and Return Policy: The universal template uses text-only arguments and notices to enforce progress and verbosity while passing through the unchanged benign terminal payload.
- MCTS Optimizer Details: MCTS evaluates candidates in two stages, prioritizing stabilized multi-turn behavior and adding length credit only after the multi-turn target is achieved.
C Additional Experimental Details
The experiments standardize runtime, decoding, and agent execution across models and benchmarks to isolate the effects of tool-layer edits.
- All target models run on one node with eight H200 GPUs, bfloat16 precision, and a 131,072-token maximum context length.
- Decoding uses nucleus sampling with p = 0.95, temperature 0.5, and a 16,384-token per-generation completion cap across conditions.
- The attack-generation pipeline uses Llama-3.3-70B-Instruct as the MCTS Editor LLM and gpt-4o to create protocol-compatible malicious templates.
- Qwen-Agent supplies native MCP and multi-turn tool-call support, while other models receive minimal adaptations to preserve a uniform agent loop.
C.4 Datasets filtering
The evaluation uses ToolBench and BFCL tool-use corpora, retaining prompts and tools uniformly after filtering cases that could avoid tool invocation.
- ToolBench aggregates utilities and APIs with queries requiring agent tool invocation, whereas BFCL emphasizes structured function calling with clear schemas.
- The filtering removes ambiguous or brittle cases where agents might answer from prior knowledge without calling a tool.
- The retained prompts and tools are used uniformly for all target models.
C.5 Datasets wrapping
Each retained benchmark tool is wrapped in an MCP-compatible server while preserving its original identity and interface for the agent.
- Each retained tool receives an MCP-compatible server template generated from its benchmark description using gpt-4o.
- The wrapping preserves tool names, function identifiers, and argument schemas, leaving the agent’s visible capability surface unchanged.
- Live network calls are stubbed with deterministic placeholder values because the study measures interaction trajectories and cost rather than external-data accuracy.