DoS via Repeat-Word-N-Times Output Amplification
An attacker sends a prompt asking the AI model to repeat a specific word or phrase a large number of times (50, 100, 1000+), separated by some delimiter. Generating and returning that much repeated output burns tokens, inflates API costs, and can overwhelm downstream systems that process the response.
How the attack works
The attacker submits input containing a verb like repeat, write, say, or output, paired with a target word or short phrase and a large count, for example "repeat the word 'test' 500 times separated by commas." The model complies and generates a very long output made almost entirely of the repeated token. Producing and transmitting that output consumes far more compute and tokens than a normal reply. If the output feeds into another system, buffers, logs, or rate limiters can be pushed past their limits, causing failures or exhausting quota that would otherwise serve real users.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 176f506f-57dd-498e-b3ce-bff1b7d3526f
- Severity
- High
Why it matters
Inflated API and compute costs, exhausted rate limits or quotas, and possible downstream failures such as buffer overflows or log flooding in any system that consumes the model's output.
What you can do
- →Cap maximum output length or token count per request at the API gateway or application layer.
- →Flag or block prompts that combine a repetition verb, a short target word/phrase, and a large numeric count (roughly 50 or more).
- →Set per-user or per-session rate limits and cost budgets so a single request cannot exhaust shared quota.
- →Validate and truncate model output before passing it to downstream parsers, buffers, or logging systems.
Known benign look-alikes
- Security documentation describing this attack technique
- Test suites that explicitly reference attack patterns in comments
- Benign instruction to repeat a short phrase 2-3 times for emphasis