Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents
Jinqian Zhang, Haojun Xia, Shujiang Wu, Jingkun Yue, Xia Zhang, Zhangpei Cheng, Bibo Tu
cs.CR · cs.AI
Quick verdict
Well-instrumented first study of DoW attacks on tool-calling LLM agents plus host-side D1–D4 defenses; credible but self-benchmarked, with no released artifacts (152 chars)
Summary
The paper studies an economic attack surface of tool-calling LLM agents: runtimes that reintroduce tool outputs into later model inputs let providers re-bill that content every turn. The authors name this "persistent billable state," formalize the host's pre-reingestion decision as a security boundary, and instantiate six Denial-of-Wallet attack vectors (recursive padding, polymorphic payloads, cross-tool chains, stealth escalation, output elicitation, threshold-hugging) in DOW-BENCH across six model families (243 executions). Provider telemetry shows worst-case cumulative input 14,293x the first-call input and 51/69 priced attack sessions exceeding $0.10 (max $3.404 vs. $0.025 benign). Full/Drop/Compress reruns attribute 21.2-35.9% mean cost increases to raw history retention, while compression preserves 10/12 and 11/12 successes on history-dependent tasks versus 2/12 under deletion. A four-invariant host kernel (prompt mass, growth, recursion, spend) contains all 41 replay attack traces under three presets, and a progress-authorized spend policy reaches 22/24 oracle-verified workflow successes versus 13/24 under a fixed cap. A scan of 3,830 public MCP repositories finds only 71 with code-visible safeguards. Key limitations: the maximum CAF is a single-run outlier, no code or data artifacts are released, and the containment evidence is entirely self-generated replay corpus.
Review complete
Assessment at a glance
6
risk flags identified
● high 1
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- An admitted malicious or compromised tool can convert a single schema-valid return into recurring victim-billed input processing across turns, with no victim credentials or runtime privilege (Sec. 1–2, Fig. 1).
- Retaining raw history raises mean effective session cost by 21.2–35.9% on persistent-return tasks, while deterministic compression preserves 10/12 and 11/12 successes on history-dependent tasks versus 2/12 under deletion (Sec. 6.3, Table 13).
- Four host-side invariants (D1–D4) enforced before reingestion contain all 41 replay attack traces under three presets, and a progress-authorized D4 schedule reaches 22/24 oracle-verified successes versus 13/24 under a fixed $0.10 cap (Sec. 8, Tables 9–11).
- Only 71 of 3,830 scanned public MCP server/transport repositories contain any code-visible safeguard proxy, and none cover all four safeguard families (Sec. 1, Fig. 14).
Strengths
Precise threat model and formalization
Sec. 2.2 restricts the attacker to returned content of an already-admitted endpoint — no credentials, local privilege, or model control — making the scope clean; Sec. 2.3 defines CAF (cumulative input over first-call input) separately from dollar exposure, keeping rate-independent and rate-dependent damage apart.
Attribution by intervention, not just observation
The independent Full/Drop/Compress reruns on 12 held-out tasks (144 sessions, Sec. 6.3, Table 13) isolate raw-retention cost contribution (21.2–35.9%) from the O(N²) rebilling mechanism, complementing the observational CAF/turn-survival correlations (Spearman ρ=0.79, Fig. 4a).
Above-average statistical and accounting hygiene
Honest negative results disclosed
Weaknesses
No released artifacts undermine verification
Self-referential defense evidence
The kernel is effectively a D2 detector plus constructed cases
Headline maximum and metric denominator fragility
Post hoc defense redesign and thin transfer base
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper claims the first systematic study of the *post-admission economic lifecycle* of tool returns in tool-calling LLM agents: once a remote tool is admitted, its return may survive into later billable context and be re-metered every turn. The authors define **persistent billable state**, formalize the host's **pre-reingestion decision** as a security boundary, and argue this is architecturally distinct from tool admission (Sec. 2.1) and from MCP wire-level statelessness (2026-07-28 revision; refs [29,30]). Related work (Clawdrain [9], LeechHijack [49], AgentDoS [25], Beyond Max Tokens [50]) is engaged specifically; the differentiator — making the host's retention decision itself the security object and intervening on it — is genuine and clearly argued.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a Denial-of-Wallet (DoW) attack on an LLM agent?
It is an economic attack where a cheap trigger forces the victim to pay sustained compute or API costs. In this paper, a malicious or compromised tool already admitted to an agent's workflow returns inflated but schema-valid content; the agent runtime keeps that content in later model inputs, so the provider bills the victim for reprocessing it on every turn — no stolen credentials or system access required.
What does 'persistent billable state' mean?
It is the paper's term for tool-generated content that survives across conversation turns and incurs repeated provider-billed processing each time it re-enters a model call. The host's decision about whether and how such content re-enters billable context is called the persistent billable-state boundary, and the authors argue the host must govern it explicitly.
How big are the measured costs in this study?
Across 243 executions on six model families, the worst session accumulated input tokens equal to 14,293 times its first-call input. In priced API sessions, 51 of 69 attack sessions crossed $0.10 with a maximum of $3.404, versus a $0.025 maximum for benign sessions. Keeping raw history raised mean session cost by 21.2–35.9% relative to dropping it.
How can agent operators defend against these cost attacks without breaking long workflows?
The paper proposes four host-side checks before each provider call — bounding prompt mass (D1), detecting prompt-growth spikes (D2), capping recursive tool opportunity (D3), and capping cumulative spend (D4) — combined with compressing old tool returns instead of deleting them. Because fixed caps interrupted all 60 long benign workflows, the authors add growth-gated recursion and progress-authorized budgets, which completed 22/24 workflows versus 13/24 under a fixed cap.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Extraction is text-only: figures (Figs. 1–14) are available only as embedded captions/descriptions, so visual details of distributions were not verifiable.
- Appendices A–C are included but Appendix D (presumably prompt/payload details) appears absent from the extraction; some per-vector payload parameters may be missing.
- Several internal numbers are difficult to reconcile without the appendix ledger (e.g., benign priced 9/35 in Table 3 vs. n=9 in Table 2; benign median CAF 1.0 for Qwen-3-235B vs. 23.7 for Mistral-Large), so metric-interpretation criticisms are tentative.
- No code or data release means no claim could be checked against artifacts; the review relies solely on internal consistency of the manuscript.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.