When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attack

TL;DR

This paper reveals that LLM cascade systems, designed for efficiency, are vulnerable to adversarial attacks that can degrade both their performance and cost-effectiveness, highlighting systemic security risks.

Contribution

It introduces the first targeted adversarial attack framework specifically designed for LLM cascade systems, exploiting their structure to cause significant performance and efficiency degradation.

Findings

Adversarial manipulation can disrupt cascade system performance and cost benefits.

The proposed attack framework adapts to different adversary capabilities.

Experiments demonstrate the attack's effectiveness across various datasets.

Abstract

Large Language Model (LLM) cascade systems are designed to balance efficiency and performance by processing queries with lightweight models while selectively escalating complex cases to more powerful ones. Such systems seek to reduces computational cost and latency while maintaining task performance, making it an appealing choice for large-scale deployment. However, the cascade design introduces new vulnerabilities through an expanded attack surface: the inclusion of lightweight front-end models and internal decision mechanisms introduces new weaknesses. In this work, we present the first study demonstrating that LLM cascade systems are susceptible to targeted adversarial manipulation, which disrupts both performance objectives and the intended cost advantages of the cascade design. We propose a novel attack framework that employs constrained sequential collaborative optimization of adversarial suffix under cascade dependencies, enabling simultaneous exploitation of lightweight models and decision mechanisms. This framework adapts to adversaries with varying capabilities, inducing controllable degradation in both cost-efficiency and accuracy. Unlike prior attacks targeting standalone models, our approach strategically leverages the cascade structure to achieve significantly stronger impact. Extensive experiments across diverse datasets and representative LLM cascade systems validate the practicality and severity of this attack. Our findings highlight the urgent need to rigorously scrutinize the security of LLM cascade systems and call for broader attention to the systemic risks inherent in such designs.