Problems / AI security and governance, medium

DDoS on an LLM API

At 8 s a 20,000 req/s flood hits your public LLM API. Every flood request costs GPU time.

Free to open. Runs in your browser, no sign-up.

Your goals

Success ≥ 98% for users, block ≥ 95%.

The traffic

20 requests a second for 30 seconds: 100% request (reads).

The system

What each component does in this design, and what calls it. The simulator mimics each one from these settings.

ComponentIts job hereSettings
Load balancerLoad balancerTraffic enters here.Calls AI app.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header.–
AI appApp serviceLoad balancer forwards to it.Calls GPU serving pool.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s.3 replicas × 500 slots · timeout 30 s
GPU serving poolSelf-hosted serving poolAI app calls it.GPU servers batch requests together; throughput rises with batch size until memory runs out.400 slots

Hints

Try it first. Open one hint at a time if you get stuck.

Hint 1

GPUs are the most expensive thing to waste.

Hint 2

Look at what got through, or what was wrongly blocked: which filter is responsible for this kind of traffic?

One way to solve it

Put DDoS protection, a WAF and bot management in front.

More ai security and governance problems