PaperlayerView exact revision on arXiv

Source-linked AI summary

Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents

Jinqian Zhang, Haojun Xia, Shujiang Wu, Jingkun Yue, Xia Zhang, Zhangpei Cheng, Bibo Tu

arXiv:2609.28585v1cs.CRcs.AI

TL;DR

Multi-step tool agents preserve external tool returns across turns, which can make an admitted malicious return recurring victim-billed state; the host-side economic lifecycle after tool admission has not been systematically isolated. This paper measures that exposure, tests retention interventions, and evaluates host-side pre-reingestion controls. Maximum per-session input-token amplification reached 14,293× across 243 executions, while the proposed controls contained replayed attacks and preserved useful workflow completion.

  • Problem

    Prior agent-security work studies manipulation and resource amplification, but leaves unisolated who authorizes an admitted tool return to persist as future provider-billed state.

    Source: §1 · p. 2

  • Method

    The paper builds DOW-BENCH, measures attack exposure, isolates raw-history retention with provider reruns, and evaluates deterministic history transformation with host-side pre-reingestion invariants.

    Source: §1 · p. 2

  • Results

    Across 243 executions, maximum per-session input-token Cost Amplification Factor reached 14,293×; compression preserved 10/12 and 11/12 history-dependent successes versus 2/12 under deletion for each provider.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Persistent billable state is a first-class security object, and the host’s pre-reingestion decision is the control point for governing what tool returns become future spend.

    Source: §10 · p. 13

    The threat model assumes attacker control of an endpoint the victim agent can already invoke and proceeds through returned content after invocation.

    Source: §2.2 · p. 3

Abstract

from arXiv · show

Multi-step tool-calling LLM agents rely on host runtimes to preserve state across turns. When a runtime carries an external tool return into later model inputs, providers meter it again. An admitted malicious or compromised tool can thereby convert untrusted data into recurring victim-billed processing without victim credentials or local runtime privilege. We call retained content persistent billable state and formalize the host's decision over whether and how it enters later billable context as the persistent billable-state boundary. We present the first systematic security study of this post-admission lifecycle. We derive six denial-of-wallet attack vectors and build DOW-BENCH, an end-to-end harness evaluated across six model families. Across 243 executions, usage telemetry shows that the maximum per-session cumulative input reaches 14,293x the session's first-call input. Controlled history-policy reruns isolate raw retention's contribution: retaining raw history increases mean effective session cost by 21.2-35.9%. Compression succeeds on 10/12 and 11/12 history-dependent tasks, versus 2/12 under deletion for each provider. To govern this boundary, we combine deterministic history transformation with four host-side invariants that bound prompt mass, context growth, recursive opportunity, and cumulative spend before reingestion. The kernel contains every recurring attack in the 123-evaluation replay corpus. Across 24 Mistral Small 4 workflows, a progress-authorized policy achieves 22/24 oracle-verified task successes with no pre-completion interruptions, versus 13/24 under a fixed cap. Only 71 of 3,830 scanned MCP server and transport repositories expose any code-visible safeguard proxy, and none cover all four safeguard families. These results establish persistent billable state as a first-class security object and pre-reingestion as its host-owned control point.

1 Introduction

The introduction frames retained tool returns as a post-admission economic security problem: they can become recurring provider-billed state, while legitimate workflows also depend on continuity. It presents measurement, history-policy interventions, host-side controls, and an ecosystem scan to study and govern this boundary.

1 Introduction

  • The study identifies a post-admission lifecycle gap: an admitted tool’s return can persist as future billable state, making the host’s pre-reingestion decision the enforcement point.Legitimate workflows also rely on retained state, so the challenge is to govern attacker-controlled persistence while preserving task-relevant continuity.Source: §1 · pp. 1–2
  • 14,293× was the maximum per-session input-token Cost Amplification Factor across 243 executions spanning six model families.Separately, 51/69 priced attack sessions crossed the $0.10 circuit-breaker setting, with exposure reaching $3.40 versus a $0.025 benign maximum.Source: §1 · p. 2
  • Full history increased mean effective session cost by 21.2–35.9%, while compression preserved 10/12 and 11/12 history-dependent successes versus 2/12 under deletion for each provider.Independent Full/Drop/Compress reruns isolate the contribution of retaining raw history.Source: §1 · p. 2
  • Four host-side invariants contained all 41 recurring attacks under each of three replay presets; progress-authorized D4 achieved 22/24 task successes without pre-completion interruptions versus 13/24 under a fixed $0.10 cap.The transfer evaluation used 24 Mistral Small 4 workflows and oracle-verified task success.Source: §1 · p. 2
  • Only 71 of 3,830 scanned MCP server and transport repositories exposed any code-visible safeguard proxy, and none covered all four safeguard families.The scan included stratified manual validation and targeted probes of zero-proxy repositories.Source: §1 · p. 2
  • The authors systematize six denial-of-wallet attack vectors and build DOW-BENCH, evaluating exposure and retention interventions across six model families.The evaluation combines listed-price API measurement with independent Full/Drop/Compress interventions across two providers.Source: §1 · p. 2

2 Background

The background defines denial-of-wallet exposure as a lifecycle in which retained tool returns are reprocessed and billed across calls. It specifies the threat assumptions and the metrics used to measure cumulative input processing and nominal session exposure.

2.1 DoW: Definition and Mechanism

  • A schema-valid return from an admitted malicious or compromised tool can persist in later inputs and accrue provider-metered cost on reuse; under stable return mass, cumulative input grows quadratically with calls.The prompt accumulates prior returns, making recursive rebilling both a continuity cost in benign workflows and a source of quadratic pressure under denial-of-wallet attacks.Source: Figure 1 · p. 3, §2.1 · p. 3

2.2 Threat Model

  • The threat model requires control of returned content from an endpoint the victim agent can already invoke, but not victim credentials, local runtime privilege, or access to private data.The attack proceeds through the tool’s returned content after the host invokes it and can use public retrieval, lookup, weather, or debugging tasks.Source: §2.2 · p. 3

2.3 Measurement Metrics

  • The study measures cumulative input processing relative to the first model call and separately computes listed-price dollar exposure over the complete session.CAF compares provider-reported input tokens with the complete first-call input; the history-policy analysis also reports cache-aware effective session cost.Source: §2.3 · pp. 3–4

3 Related Work

Prior work studies semantic manipulation and resource amplification, but leaves the economic lifecycle of an admitted tool return unisolated. The paper frames retained tool state as a host-governed security object and organizes attacks by amplification lever and payload-control policy.

3 Related Work

  • Prior studies address cost abuse, tool attacks, and resource governance, but do not jointly isolate retained tool state, intervene on its retention, and enforce the boundary before reingestion while preserving utility.Related work includes output-token amplification [50], cyclic MCP structures [22], and retained-history cost growth [9].Source: §3 · p. 4

4.1 Architectural Observations

  • A schema-valid, task-plausible tool return can persist as billable context, because each later turn reprocesses accumulated returns and local task decisions do not account for session-level spend.The paper identifies this separation as a local–global objective mismatch.Source: §4.1 · p. 5

4.2 Taxonomy Axes

  • The taxonomy distinguishes what is amplified—input history, generated output, or recursive opportunities—from how payloads change across turns.Payload-control policies may remain fixed, vary or distribute representation without feedback, or adapt to a schedule or observed feedback.Source: §4.2 · p. 5

4.3 Attack Vectors

  • V5 increases returned content only while preserving a margin below an estimated threshold, trading peak one-turn pressure for longer recursive opportunity.The attacker uses continued tool use as feedback that earlier payloads remained below the effective guardrail.Source: §4.3 · p. 5
  • The six evaluated vectors instantiate combinations of amplification lever and payload-control policy, from direct recursive padding to cross-tool chaining and adaptive threshold-hugging.The labels Direct, Stateless, and Adaptive denote static/direct, stateless variation/distribution, and scheduled/feedback-adaptive policies.Source: Table 1 · p. 5, §4.3 · p. 5

5 Attack Instantiation and Evaluation Setup

The study evaluates six attack vectors through a common tool-return interface and execution harness. Independent sessions and history-policy reruns let the authors measure token use, exposure, and the effects of retained history.

5 Attack Instantiation and Evaluation Setup

  • All six vectors use the same ordinary tool-return interface, fresh agent sessions, attacker privileges, and accounting procedure, varying only the amplification strategy.The endpoint confines attacker control to syntactically valid result fields in ordinary, task-plausible schemas.Source: §5 · p. 6, §5.1 · p. 6

5.2 Payload Instantiation

  • Payloads pair cost-bearing content with a plausible continuation cue, using fixed, polymorphic, escalating, output-inducing, cross-tool, or feedback-adaptive strategies.V0 and V2 use 400–1,000-token content blocks; V1 varies representation and length, V3 escalates after small early returns, V4 elicits verbose generation, and V5 adapts to observed continuation.Source: §5.2 · p. 6

5.3 Evaluation Methodology

  • DOW-BENCH records per-turn input and output tokens, tool calls, and termination across independent sessions, evaluating six model families in 243 core executions.History-policy arms retain raw returns, replace earlier untrusted returns with provenance tombstones, or substitute deterministic host-generated fact summaries.Source: §5.3 · p. 6
  • The history-policy study compares complete-session costs using provider-listed rates, while the canonical ledger preserves raw executions and derives reported statistics from a frozen view.Full, Drop, and Compress run independently; the study also analyzes turn survival across family–vector cells and truncates malicious traces offline.Source: §5.3 · pp. 6–7, Table 2 · p. 7

6 Attack Evaluation

Independent history-policy reruns show that raw retention raises session cost while compression preserves continuity on history-dependent tasks. Across attack sessions, exposure is substantial, and recursive exposure is associated with turn survival.

6.1 Listed-Price Exposure in API Sessions

  • $3.404 is the maximum priced attack-session exposure, with 51/69 crossing the $0.10 circuit-breaker setting; the largest benign session is $0.025.The priced cohort includes 69 attack and nine benign sessions.Source: Figure 2 · p. 7, §6.1 · p. 7
  • 14,293× is the maximum CAF across the reported run-level distributions, and all six family-wise V5-versus-benign contrasts remain significant after Holm correction.The corrected p-values range from 0.0155 to 0.0317.Source: §6.1 · p. 7, Figure 3 · p. 8

6.2 Turn Survival Tracks Recursive Exposure

  • Across 24 complete cells, CAF is associated with mean turns (ρ=0.79) and tool calls (ρ=0.81), while truncating 44 malicious traces reduces the higher-to-lower CAF ratio from 4.06× to 1.49–1.51×.Across 111 matched V0/V3 prefixes, the mean paired downstream CAF-gain difference is 1,989 units (95% CI 683–3,908; bootstrap p≤0.002).Source: §6.2 · p. 8, Figure 4 · p. 9

6.3 Retained History Couples Continuity to Cost

  • On persistent-return tasks, Full cost 35.9% more than Drop and 30.0% more than Compress on Mistral, and 22.3% and 21.2% more on Groq; on matched-necessary tasks, Full and Compress achieved at least 10/12 successes per provider, versus Drop’s 2/12.Source: §6.3 · p. 8

7 Defense Framework

The framework governs whether retained state enters another provider call at the host’s pre-reingestion boundary. Four invariants bound prompt mass, context growth, recursive opportunity, and cumulative priced exposure.

7 Defense Framework

  • Deterministic history transformation controls what state survives, while the host kernel decides whether that state may induce another call or unit of spend.D1 and D2 address retained input mass and adjacent growth; D3 governs recursive opportunity, and D4 governs output and price-sensitive cumulative exposure.Source: §7 · p. 9, Figure 6 · p. 10

7.1 Host-Side Enforcement Kernel

  • D1 bounds absolute prompt-token mass, while D2 flags abnormal reconstructed-prompt growth using adjacent reported input-token counts or a local pre-send estimate.Strict, moderate, and relaxed D1 presets set session/turn limits of 20K/8K, 50K/20K, and 200K/100K tokens.Source: §7.1 · p. 10
  • D3 caps recursive opportunity and D4 stops subsequent calls when cumulative priced exposure exceeds its preset threshold.D3 also allows growth-gated depth enforcement subject to explicit host authorization; D4’s strict, moderate, and relaxed thresholds are $0.05, $0.10, and $0.50.Source: §7.1 · p. 10

8 Defense Evaluation

The evaluation tests whether host-side gates can contain recurring attacks while preserving useful workflows and enforcing decisions before the next provider call.

8.1 Frozen-Trace Containment

  • 123/123 replay evaluations of 41 recurring multi-turn attack traces were contained under strict, moderate, and relaxed D1–D4 presets.The triggering provider row is included in leakage, and no provider call follows a gate firing.Source: §8.1 · p. 10

8.2 Threshold-Aware Layer Coverage

  • Seven threshold-aware traces exercised all four gate conditions; maximum trigger-inclusive leakage was $0.105, while disabling D2 on the loud-control trace raised leakage to $0.127.Seed inflation stayed below D2 while crossing D1 at Turn 3; D4 also crossed its threshold on that turn.Source: §8.2 · p. 10, Figure 7 · p. 11

8.3 D2 Operating Point

  • Moderate D2 triggered in 2/1,050 (0.19%) benign provider–scenario executions across five complete corpus runs; primary-corpus triggers were 0/210, with a rule-of-three upper bound of 1.4%.Compared with the denominator-floor D2 sensitivity rule, a 20K static ceiling blocked the six-vector replay set with 0/1,050 benign triggers, acting later (mean Turn 4.67 versus 2.33) and after 26.1% versus 5.1% leakage. Across 1.056M local gate evaluations, median decision-logic time was 3.3/4.4 µs for D2/the full stack; provider, network, and tokenization time were outside this measurement.Source: §8.3 · p. 11

8.4 Progress-Aware Workflow Utility

  • Growth-gated D3 preserved 41/41 replay containment and caused 0/60 D3 interruptions, but unchanged D4 still stopped 7/60 workflows.Frozen moderate D3 interrupted all 60 completed 8–12-step workflows at Turn 6.Source: §8.4 · p. 11
  • 22/24 Mistral Small 4 workflows succeeded under progress-authorized D4, versus 13/24 under fixed D4, with 0/24 versus 9/24 pre-completion interruptions.The comparison uses an intention-to-treat denominator; all nine discordant task-success outcomes favored progress-authorized D4.Source: §8.4 · p. 11, Figure 8 · p. 12

8.5 Live Inline Placement

  • D1–D4 intercepted 23/25 live attack sessions before the next provider call; a separate Mistral/MCP-SDK path blocked 10/10 attack-shaped sessions and completed 20/20 benign tasks.An upstream payload limit preempted the other two sessions in the first live path.Source: §8.5 · pp. 11–12

9 Discussion

The discussion locates authority over recurring billable state at the host and explains how economic controls and policy hierarchy complement semantic safety.

9 Discussion

  • Recurring cost can exhaust authorized spend before legitimate work completes, turning cost amplification into availability loss.Without an enforceable ceiling, recursive opportunity permits exposure to continue growing.Source: §9 · p. 12

9.1 Who Owns the Billable-State Boundary?

  • The host joins local task state, authorized budget, and the decision to issue another model call, so it owns the pre-reingestion authorization decision.Telemetry and protocol signals can inform enforcement but do not themselves grant authority.Source: §9.1 · p. 12

9.2 Why Semantic Safety Is Insufficient

  • Schema validity and topical plausibility do not establish that a return merits recurring computation; compression reduces retained mass, while authorization governs further work.Host-controlled transformation preserves facts needed for continuity while removing attacker-controlled bulk.Source: §9.2 · p. 12

9.3 Compositional Control against Adaptive Attacks

  • Compression alone does not bound later calls or generated output, so the host pairs history transformation with D1–D4 controls over mass, growth, opportunity, and spend.Growth-gated D3 conditions recursive opportunity on retained-state behavior, while progress-authorized D4 releases spend after host-verified progress.Source: §9.3 · pp. 12–13

9.4 Deployment Policy Hierarchy

  • Code-visible safeguard proxies were low-prevalence in the scanned MCP server and transport corpus, making deployment policy allocation—not threshold selection alone—a systems question.The evaluated D1–D4 thresholds instantiate host-owned invariants for these experiments; deployments should derive values from policy authorities rather than copy experimental settings, with tighter applicable bounds taking precedence.Source: §9.4 · p. 13

10 Conclusion

The conclusion frames DoW as a lifecycle failure in which retention can give untrusted tool returns recurring economic authority, and identifies pre-reingestion as the control point.

10 Conclusion

  • Persistent billable state makes the security question not only which tools may run, but what their returns are authorized to become.The paper links measurements of recurring cost and a raw-history intervention to controls that bound mass, growth, opportunity, and spend.Source: §10 · p. 13

A Ethical Considerations

  • DoW can impose runaway cost and task interruption on operators and users, consume provider resources, and burden runtime and tool developers with remediation.The paper also notes that publication may lower the cost of misuse; no human subjects or personal data were involved.Source: A Ethical Considerations · p. 13

B Open Science

  • The paper-only preprint includes manuscript source, figures, and derived tables, but excludes executable code, the experiment ledger, raw captures, credentials, and operational attack material.The authors state that this version makes no artifact-availability claim.Source: B Open Science · p. 13

C Supplementary Tables and Figures

The supplementary material expands replay accounting and calibration details and identifies the scope of its CAF comparison table.

Replay Audit and Layer Ablation

  • The expanded replay audit reports containment of all 41 non-trivial multi-turn attacks under all three presets, across 123 evaluations.The eligible-file audit covered 80 retained JSONL files, of which 52 contained replay-eligible turns.Source: C Supplementary Tables and Figures · p. 17

Live Calibration and Cache Effects

  • Live calibration reports seed-inflation checks on Cerebras and Mistral, while cache-aware accounting finds caching changes price but does not separate attack from benign sessions in the reported matrices.The reported attack effective-cost amplification ranges were 16.0–20.8× for Mistral and 26.1–37.1× for Groq.Source: C Supplementary Tables and Figures · p. 17

Supplementary Tables and Figures

  • Table 4 presents CAF distributions across six core LLM families, four primary attack vectors, and the benign comparator.The supplied table header lists benign, direct, polymorphic, stealth, adaptive, and V5-versus-benign columns.Source: Table 4 · p. 17, C Supplementary Tables and Figures · p. 17

GPT-4o

The evaluation compares transfer defenses, history policies, and ecosystem safeguards, finding that progress-authorized D4 can improve workflow completion over a fixed cap while history retention raises costs and code-visible safeguards are uncommon.

Deployment provenance

  • Historical core manifests omit temperature, maximum-turn, cache-policy, and pricing-version fields, limiting provenance for those settings.Archived Mistral live-run manifests also omit resolved SDK and negotiated protocol versions.Source: GPT-4o · p. 18

D3/D4 successor check

  • The growth-gated D3 successor had zero interruptions across 60 workflows; adding D4 yielded 53/60 completions and seven D4 stops, while D1–D3 yielded 60/60 completions.The full stack's seven D4 stops occurred at median Turn 13.Source: GPT-4o · pp. 18, 20, Table 9 · p. 20

Operating-point evidence

  • The D2 operating-point analysis covers 2,292 post-seed turns across 984 multi-turn scenarios, while false-positive counts use a 1,050-scenario denominator.Attack leakage averages trigger-inclusive fractions over six replay attacks.Source: Figure 10 · p. 20

D4 transfer sensitivity

  • Across 21 available-case pairs, all nine discordant task-success outcomes favored progress-authorized D4 (exact two-sided p = 0.0039), with a paired median effective-cost increase of +$0.00511.The transfer study reports outcomes from 24 independently executed workflows under each policy.Source: GPT-4o · p. 19, Table 11 · p. 20

Related-mechanism comparison

  • Success-gated effective-cost ratios versus provider-matched benign were 1.249×/1.308× for V0, 0.880×/1.004× for V3, and 1.192×/1.235× for V5 on Groq/Mistral.V3 and V5 are mechanism-matched proxies for structural-loop and cost-optimization mechanisms, respectively.Source: GPT-4o · pp. 19–20, Table 12 · p. 20

History-policy results

  • 47/48 individual task costs increased under Full history, and Mistral and Groq each had 2/12 successes under Drop on history-dependent tasks.Groq had 71 cost-complete sessions after one matched-necessary/Drop parse failure; its Drop success was 2/11 available-case and 2/12 planned/ITT.Source: GPT-4o · p. 19, Table 13 · p. 21

Ecosystem scan

  • 71/3,830 repositories (1.9%) exposed at least one code-visible safeguard proxy, and none matched all four safeguard families.Among the 71 positives, 67 matched one family and four matched two or three.Source: Figure 14 · p. 22

Scan validation

  • Manual adjudication confirmed all 20 sampled positive rows and all 20 sampled code-bearing zero-proxy rows; probing 80 zero-proxy repositories found no misclassified safeguard proxy.Three D2-like candidates found by the probe were generic pacing/rate controls and remained classified as zero-proxy.Source: GPT-4o · p. 22
Loading 2609.28585v1…