From Role Prompt to Infinite Thinking: Exploiting Persona Conditioning for Inference Cost Attacks in LLMs

2026-07-28

AI Summary

This work addresses the vulnerability of large language models (LLMs) to malicious prompts that induce excessively verbose outputs, thereby inflating inference costs. The authors propose RolePlay, a novel framework that uncovers role consistency as a previously unrecognized attack surface for inference cost amplification. Unlike existing approaches requiring explicit instructions or adversarial suffixes, RolePlay stealthily triggers this vulnerability through a task-aware, dynamic role alignment mechanism that adaptively constructs semantically coherent yet computationally inefficient personas. Evaluated across mainstream LLMs and diverse tasks, the method achieves an average token amplification of 7.64×, with a maximum of 207.64×, substantially outperforming current inference-expansion techniques.

Abstract

LLMs are increasingly deployed in real-world applications, making inference efficiency and service reliability critical concerns due to their substantial computational costs. However, the autoregressive generation mechanism of LLMs enables malicious prompts to manipulate generation behaviors, inducing excessive token generation that amplifies computational consumption and threatens service efficiency. Existing methods mainly rely on adversarial suffixes or explicit extension instructions, which introduce detectable behaviors and limit their applicability. In this paper, we reveal a previously unexplored vulnerability caused by persona consistency in LLMs, where models maintain assigned roles and reproduce corresponding behaviors even when they result in inefficient reasoning and excessive generation. Based on this observation, we propose RolePlay, a task-aware dynamic persona alignment framework that constructs adaptive personas to naturally induce inefficient yet semantically coherent behaviors for inference cost amplification. Extensive experiments across multiple LLMs and diverse task datasets demonstrate that RolePlay consistently outperforms existing inference extension methods, achieving an average token amplification of up to \bm{$7.64\times$} and a maximum token amplification ratio of \bm{$207.64\times$}. Our findings identify persona conditioning as a new attack surface for LLM inference efficiency and offer a new perspective on computational cost amplification.

Problem

• inference cost
• persona conditioning
• token amplification
• large language models
• service efficiency

Innovation

• persona conditioning
• inference cost attack
• role consistency
• token amplification
• LLM security