When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attack

2026-05-17

AI Summary

While cascaded large language model systems improve efficiency, they are vulnerable to adversarial attacks that simultaneously undermine both performance and cost advantages. This work reveals, for the first time, a cascade-specific failure mode—cascading failure—and introduces a novel coordinated attack framework. By modeling inter-stage dependencies, the framework performs constrained sequential optimization of adversarial suffixes to jointly manipulate the outputs of lightweight models and routing decisions. The approach adapts to varying attacker capabilities, overcoming limitations of conventional single-model attacks. Extensive experiments across multiple datasets and representative cascaded architectures demonstrate its effectiveness in significantly degrading accuracy and compromising cost-efficiency, thereby exposing critical security vulnerabilities in such systems.

Abstract

Large Language Model (LLM) cascade systems are designed to balance efficiency and performance by processing queries with lightweight models while selectively escalating complex cases to more powerful ones. Such systems seek to reduces computational cost and latency while maintaining task performance, making it an appealing choice for large-scale deployment. However, the cascade design introduces new vulnerabilities through an expanded attack surface: the inclusion of lightweight front-end models and internal decision mechanisms introduces new weaknesses. In this work, we present the first study demonstrating that LLM cascade systems are susceptible to targeted adversarial manipulation, which disrupts both performance objectives and the intended cost advantages of the cascade design. We propose a novel attack framework that employs constrained sequential collaborative optimization of adversarial suffix under cascade dependencies, enabling simultaneous exploitation of lightweight models and decision mechanisms. This framework adapts to adversaries with varying capabilities, inducing controllable degradation in both cost-efficiency and accuracy. Unlike prior attacks targeting standalone models, our approach strategically leverages the cascade structure to achieve significantly stronger impact. Extensive experiments across diverse datasets and representative LLM cascade systems validate the practicality and severity of this attack. Our findings highlight the urgent need to rigorously scrutinize the security of LLM cascade systems and call for broader attention to the systemic risks inherent in such designs.

Problem

• LLM cascade systems
• adversarial attack
• cascade failure
• efficiency-performance trade-off
• systemic vulnerability

Innovation

• LLM cascade systems
• adversarial attack
• cascade failure
• constrained sequential optimization
• systemic vulnerability