Search papers, labs, and topics across Lattice.
This paper investigates the vulnerability of large language models (LLMs) to inference cost attacks through persona conditioning, revealing that models maintain assigned roles that can lead to inefficient reasoning and excessive token generation. By introducing RolePlay, a dynamic persona alignment framework, the authors demonstrate that adaptive personas can be constructed to induce semantically coherent but inefficient behaviors, significantly amplifying token generation. Experimental results show that RolePlay achieves an average token amplification of 7.64 times, with a maximum ratio of 207.64 times, outperforming existing methods and highlighting a new attack vector in LLMs.
Persona conditioning in LLMs can be exploited to amplify inference costs by over 200 times, revealing a critical vulnerability in their deployment.
LLMs are increasingly deployed in real-world applications, making inference efficiency and service reliability critical concerns due to their substantial computational costs. However, the autoregressive generation mechanism of LLMs enables malicious prompts to manipulate generation behaviors, inducing excessive token generation that amplifies computational consumption and threatens service efficiency. Existing methods mainly rely on adversarial suffixes or explicit extension instructions, which introduce detectable behaviors and limit their applicability. In this paper, we reveal a previously unexplored vulnerability caused by persona consistency in LLMs, where models maintain assigned roles and reproduce corresponding behaviors even when they result in inefficient reasoning and excessive generation. Based on this observation, we propose RolePlay, a task-aware dynamic persona alignment framework that constructs adaptive personas to naturally induce inefficient yet semantically coherent behaviors for inference cost amplification. Extensive experiments across multiple LLMs and diverse task datasets demonstrate that RolePlay consistently outperforms existing inference extension methods, achieving an average token amplification of up to \bm{$7.64\times$} and a maximum token amplification ratio of \bm{$207.64\times$}. Our findings identify persona conditioning as a new attack surface for LLM inference efficiency and offer a new perspective on computational cost amplification.
