Context Window Exhaustion

The attack leverages the quadratic complexity of the transformer attention mechanism. By inserting massive volumes of irrelevant text (e.g., repeated words, classic literature, or random tokens), the attacker forces the model to allocate computational focus to the filler. This pushes the original system prompt and safety instructions out of the effective attention window, causing the model to 'forget' its core directives and operate solely on the malicious user prompt.

Modern LLMs rely on instructional hierarchies where system-level safety rules are prepended to the conversation. In a context exhaustion attack, the attacker floods the chat history with benign-seeming text until the token limit is reached. The model's internal KV cache becomes saturated with this filler, effectively truncating the initial safety instructions. The model then responds to the final malicious query as if no guardrails were ever set.

This attack is often executed over multiple conversational turns to evade single-prompt filters. An attacker may send dozens of messages containing large code blocks or verbose prose. Each response from the assistant adds to the cumulative token count. Once the combined prompt and response history approaches the model's context limit (e.g., 128k or 1M tokens), the attacker issues a final forbidden query that bypasses the now-diluted safety instructions.

Attackers employ specific strategies to maximize token consumption efficiently:

• Repetition bombs: Repeating a single word or phrase thousands of times to fill the context with minimal effort.
• Padding with inert text: Using public domain books or documentation to appear legitimate while consuming tokens.
• Unicode expansion: Exploiting characters that tokenize into multiple sub-tokens to accelerate context filling.
• Recursive summarization prompts: Forcing the model to generate long-winded outputs that are fed back into the context.

Context window exhaustion is often a precursor or delivery mechanism for prompt injection. While injection focuses on overriding instructions through semantic manipulation, exhaustion creates the condition where injection becomes possible. By clearing the model's safety context, the attacker ensures that a subsequent injection payload—such as 'Ignore all previous instructions'—faces no resistance from the displaced system guardrails.

Key countermeasures include:

• Context boundary enforcement: Strictly segregating system instructions from user content using delimiters that the model cannot override.
• Sliding window attention: Architectures that prioritize recent instructions without losing long-term safety constraints.
• Token budgeting: Monitoring and capping the token count per user session to prevent accumulation attacks.
• Guard model pre-screening: A secondary classifier that detects context-flooding patterns before the prompt reaches the primary model.

A safety framework that enforces a strict privilege order: system messages override user messages, which override tool outputs. This prevents an attacker who floods the context with lower-privilege data from overwriting core directives. The model is trained to recognize and respect this hierarchy even when the context window is saturated with conflicting instructions.

A defensive technique that strictly segregates different information sources within a prompt using structured formats like XML tags or markdown fences. By clearly delineating where user input begins and ends, the model can distinguish trusted instructions from untrusted filler content. This makes it significantly harder for an attacker to blur the line between system prompts and injected noise.

The process of cleaning and normalizing user-provided text before it reaches the model. Key techniques include:

• Truncation: Hard-capping input length to prevent context flooding
• Token counting: Rejecting inputs that exceed a safe token budget
• Encoding normalization: Converting Unicode tricks to canonical forms This is the first line of defense against exhaustion attacks that rely on sheer volume.

A Web Application Firewall-like layer deployed at the API gateway that inspects prompts before they reach the language model. For context window exhaustion specifically, a WAF can enforce rate limiting, maximum payload size, and token budget policies. It can also detect repetitive or low-entropy filler text patterns characteristic of flooding attacks.

A secondary, often smaller and faster model that screens inputs and outputs of the primary model. For exhaustion attacks, a guard model can:

• Detect anomalous prompt length or token density
• Classify inputs as benign queries vs. filler content
• Flag conversations where the ratio of user tokens to system tokens exceeds safe thresholds This provides a real-time safety net without adding latency to the primary inference.

The use of classifiers, heuristics, and perplexity analysis to identify inputs crafted to manipulate a model. For exhaustion attacks, detectors look for:

• Abnormally low perplexity (repetitive, copy-pasted filler)
• High token count with low semantic density
• Structural anomalies like repeated delimiters or whitespace flooding These signals help distinguish a genuine long document from a malicious context-stuffing attempt.