Language model defense makes attackers use more computing energy
Make the Adversary Spend More Energy: Generative Deception against Language-Model Attackers in Critical Infrastructure
Cryptography and Security
Summary
Cyber attackers using language models to probe critical infrastructure use computing power as they try commands. The authors study a defense that uses another language model to respond and slow down the attacker. This defense makes attackers spend more energy without a big increase in their command tokens. They suggest a security system that uses private information per attacker and mimics real protocols to trick attackers effectively.
What this means in practice
- •For cybersecurity defense teams: Deploy deception systems that force attackers to spend more energy probing critical infrastructure, improving defense efficiency.
- •For industrial control system operators: Implement protocol and process emulation with private attacker states to better protect SCADA environments against AI-driven attacks.
Authors
Vlad Mihal, Hosam Alamleh, Alessandro Cantelli-Forti
Abstract
Language-model attackers consume computational resources as they explore and interact with a target, creating an opportunity for cyber deception to impose costs. Whether such engagements favor the defender requires measuring both sides. We evaluate an autonomous language-model attacker against a decoy that uses a defending language model to analyze attacker commands and select defensive responses. Across 330 sessions, eight model pairs, two attacker profiles and three counter-injection levels, both sides run on identical GPUs and their energy is measured above idle. With runtime thinking disabled, the attacker-to-defender energy ratio has a 95% interval above one in 41 of 48 configurations under an allocation excluding attacker diagnostic calls, and in all 48 when those calls are included. Token ratios remain within approximately a factor of two in configurations without generation-cap truncation, showing that token counts can obscure substantial energy asymmetry. Counter-injection increases attacker tokens by approximately 9% per level without a detectable pooled change in energy consumption. Enabling thinking on both sides increases defender energy by 8--17 times and reverses the exchange for one model pair in the original campaign. We use these findings to motivate a proposed SCADA deception architecture with private physical state per identified adversary and deterministic protocol and process emulation.