Protecting an AI System from Denial-of-Wallet Attacks

Why the attack is a cost-control problem A denial-of-wallet attack does not need to steal data or crash the model; it makes the AI service perform expensive inference repeatedly until the bill or quota is exhausted. The primary controls therefore sit at the request boundary and at the generation boundary: E (API rate controls) limits how many calls a client, token, or IP can make in a window, while F (output token controls) caps how many tokens each response can generate. Together they reduce both request volume and per-call cost.

Why not endpoint access controls or a CDN Option A would harden or restrict endpoints, but on an internet-facing AI API the attacker can distribute source addresses and change them, so endpoint allow-listing is brittle and does not cap repeated, authenticated inference. Option B can absorb traffic and improve availability, but a CDN does not stop a valid API key from triggering billable model calls; it is an availability control, not a spend control. C (fine-tuning) and D (modality controls) affect model behavior or input types, not the rate of billable inference, so they are at best secondary hardening.

The adjacent decision and the flip The real discriminator is whether the scenario asks about availability/performance or cost exhaustion. If the prompt said the service is unavailable because of volumetric flooding, a CDN/WAF or autoscaling might be the answer. If it said unauthorized users are reaching the model, authentication and access controls would matter. Here the explicit denial-of-wallet framing means request throttling plus output caps. Comments split between endpoint access controls plus rate limits and rate limits plus output-token caps; the latter aligns with the cost mechanism because even legitimate-looking calls must be bounded in number and size.

Operational consequence Without E and F, budgets can drain silently through retries, long prompts, or large completions, and incident response becomes a billing investigation rather than an outage. Enforcing both controls also preserves capacity for legitimate users and gives monitoring something concrete to alert on.