OWASP LLM10:2025 Unbounded Consumption — multimodal dimension

The four multimodal attack surfaces in LLM10 Unbounded Consumption

1. Free-tier public APIs with image upload — adversarial high-entropy images exhausting per-user compute quotas. Public-facing multimodal APIs that allow any user to submit images for VLM analysis — document scanners, image captioning tools, visual question answering, screenshot analysis — are directly exposed to image-layer resource exhaustion. An adversarially crafted high-entropy image submitted by a free-tier user can trigger worst-case attention computation in the VLM's vision encoder: the maximum number of image patches, the highest attention head activation density, the longest completion generation before a stop condition. If the platform's per-user quota is measured in API calls or token-equivalent units rather than GPU-seconds, adversarial images allow a single free-tier user to consume compute equivalent to hundreds or thousands of normal requests. The attack is asymmetric: the adversary submits one API request; the platform incurs the compute cost of many. At scale, coordinated adversarial image submission can exhaust GPU capacity, trigger autoscaling beyond cost budgets, or force rate limiting on legitimate users. The adversarial image bypasses all text-layer protections — request rate limiting, prompt token caps, output length limits — because the attack is in the pixel content, not the request metadata.

2. Webhook and event-driven image processing pipelines — adversarial images triggering retry cascades. Asynchronous image processing pipelines that use webhooks, message queues, or event streams to trigger VLM analysis are exposed to a compounded LLM10 risk from adversarial images. In a typical pipeline, an image processing job is retried on failure — the message is requeued if processing throws an exception, if the VLM returns an unexpected output format, or if downstream validation fails. An adversarial image designed to cause the VLM to produce output that reliably fails the pipeline's downstream validation — wrong schema, invalid JSON structure, content policy flag — triggers the full retry sequence on every processing attempt. If the pipeline retries three times with exponential backoff, one adversarial image submission results in four full VLM inference calls, each consuming full model compute. In a queue-based architecture where the same adversarial image can be submitted by multiple event producers, the retry amplification compounds across all concurrent processing jobs. The adversarial image does not need to be crafted to cause a VLM crash — it only needs to cause a consistent validation failure to exploit the pipeline's own retry logic as a resource amplifier. Message queue poison-pill handling (dead-letter queues, max-retry caps) limits amplification but does not eliminate it; the Glyphward pre-scan gate eliminates the adversarial image before it enters the queue.

3. Multi-modal RAG pipelines with image indexing — adversarial images triggering excessive embedding recomputation. Retrieval-augmented generation systems that index images alongside text — visual knowledge bases, product catalogue RAG, document intelligence systems — are exposed to LLM10 resource exhaustion through the embedding and indexing layer. An adversarially crafted image submitted to a RAG ingestion pipeline can trigger excessive processing at multiple points: the vision encoder run to generate the image embedding (compute-intensive), the similarity search across the existing embedding index (scales with index size), any OCR pass over the image (CPU-intensive for high-entropy pixel regions), and any caching invalidation triggered by a high-entropy embedding that does not cluster with existing index entries. In large-scale RAG systems where embedding computation is distributed and cached, adversarial images with deliberately unusual embedding characteristics can defeat caching (the image embedding falls outside all cached clusters, forcing a full index scan on every retrieval), creating sustained high compute load from a small number of adversarial image submissions. The LLM10 risk compounds if the adversarial image also carries an LLM01 prompt injection payload — the injection steers the VLM to retrieve and surface attacker-specified context, while simultaneously triggering maximum retrieval compute.

4. Client-facing multimodal chatbot UI — adversarial images triggering infinite escalation and model fallback loops. Consumer-facing multimodal chatbots that process user-submitted images — customer service bots with screenshot upload, e-commerce visual search, educational tutoring with diagram upload — implement fallback logic for uncertain or low-confidence VLM responses: retry with a higher-capability model, escalate to a human agent, or request image resubmission. An adversarially crafted image designed to produce maximum uncertainty in the VLM's primary response — triggering the confidence-threshold fallback — forces the pipeline to invoke a more expensive fallback model on every request. If the adversarial image also bypasses the fallback model's confidence threshold, the pipeline escalates to human review, consuming human-agent time in addition to compute. In chatbot deployments with unlimited free image submissions per conversation, this pattern allows a single adversary to systematically exhaust the escalation queue by submitting adversarial images that always trigger the fallback path. Standard LLM10 mitigations (session rate limits, token budgets) do not address image-triggered escalation loops because the escalation is triggered by the image content's effect on VLM output confidence, not by the raw request volume.

Integration: pre-scan gate blocking image-layer resource exhaustion

import base64
import requests
import httpx

GLYPHWARD_KEY = "<your-glyphward-api-key>"
GLYPHWARD_THRESHOLD = 65

def process_image_safe(image_bytes: bytes, user_id: str) -> dict:
    """
    LLM10-safe image processing: scan before VLM invocation.
    Adversarial high-entropy images are blocked before they reach the model.
    """
    # Step 1: Glyphward pre-scan — blocks adversarial images before VLM call
    encoded = base64.b64encode(image_bytes).decode()
    scan_resp = requests.post(
        "https://glyphward.com/v1/scan",
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        json={"image": encoded},
        timeout=5,
    )

    if scan_resp.status_code != 200:
        # Fail-closed: scan unavailability → reject image, do not fall through to VLM
        return {"status": "error", "reason": "scan_unavailable", "user_id": user_id}

    scan = scan_resp.json()
    if scan["score"] >= GLYPHWARD_THRESHOLD:
        return {
            "status": "rejected",
            "reason": "adversarial_image_detected",
            "score": scan["score"],
            "user_id": user_id,
            "scan_id": scan["scan_id"],
        }

    # Step 2: VLM call — only reached by non-adversarial images
    # Apply standard LLM10 text-layer controls in addition to the image-layer scan
    response = httpx.post(
        "https://api.openai.com/v1/chat/completions",
        headers={"Authorization": f"Bearer {OPENAI_KEY}"},
        json={
            "model": "gpt-4o",
            "max_tokens": 512,  # LLM10 token budget cap (text layer)
            "messages": [
                {
                    "role": "user",
                    "content": [
                        {"type": "image_url", "image_url": {"url": f"data:image/jpeg;base64,{encoded}"}},
                        {"type": "text", "text": "Describe this image."},
                    ],
                }
            ],
        },
        timeout=15,  # LLM10 timeout cap
    )

    return {
        "status": "ok",
        "result": response.json()["choices"][0]["message"]["content"],
        "scan_id": scan["scan_id"],
        "user_id": user_id,
    }

The standard LLM10 text-layer controls — max_tokens cap and request timeout — remain in place at the VLM call level. These address text-output length and per-request duration. The Glyphward pre-scan gate addresses the image-input layer that text controls cannot reach: an adversarially crafted image that would trigger worst-case attention computation is blocked before the VLM call is ever issued, so the model never incurs the excessive compute cost. For retry-sensitive pipelines (queue-based architectures with dead-letter queue handling), apply the pre-scan gate at the queue consumer rather than at the ingestion endpoint: this blocks adversarial images that were queued before the scan gate was added, and prevents retry amplification by blocking before the first VLM call rather than after the first failure. For escalation-sensitive chatbot deployments, log the Glyphward scan ID alongside every escalation event to detect systematic adversarial escalation patterns across sessions. Get early access

Coverage matrix

Related questions

Further reading

• OWASP LLM01 Prompt Injection — multimodal dimension — the injection mechanism that compounds with LLM10 resource exhaustion in adversarial image payloads
• OWASP LLM04 Model DoS — multimodal dimension — availability-focused resource exhaustion; LLM10 extends this to cost and quota amplification
• OWASP LLM09 Misinformation — multimodal dimension — adversarially steered false content generation, a distinct LLM10-amplifying attack objective
• Multimodal AI security checklist — structured security review covering all OWASP LLM Top 10 items with multimodal dimensions including LLM10
• Glyphward API free tier — 10 scans/day at no cost; start closing the image-layer LLM10 gap