Year: 2026
Type: dissertation
Abstract: Large language models are now deployed at scale across commercial and production systems. A leading edge of this deployment is the large reasoning model (LRM), which generates an extended chain-of-thought before answering to improve response quality on complex tasks. This capability, however, introduces a severe compu- tational asymmetry: because providers allow large reasoning budgets to avoid truncating legitimate reasoning, a short, cheap input prompt can force the model into tens of thousands of expensive output tokens. This thesis investigates how effectively a black-box, prompt-induced denial-of-service attack can degrade LRM inference on realistic serving infrastructure. I present BrainDrain, a framework that combines the ReasoningBomb attack strategy with latency-based side-channel infrastructure probing and routing-aware attack concentration, evaluated against a vLLM deployment on Google Kubernetes Engine in both single-node and multi-node configurations. On single-node infrastructure, a single attacker renders the server unable to admit legitimate requests for 53% of the attack window for under$3 in induced tokens. On multi-node infrastructure, exploiting prefix-aware routing concentrates 99.9% of generated tokens onto one of three replicas, defeatinghorizontal scale-out and collapsing a load-balanced cluster into a single-node target.
Source: Aaltodoc (Aalto University)
Author: Saied Ahmad, Leo
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204016170