How must an instance defend against demand-side rate-limit attacks from malicious peers?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session operates as a service (providing responses, state, or capabilities) to peers, and malicious peers can deliberately generate excessive demand to exhaust the session's rate limits, causing the session to throttle legitimate peers. Does not apply to sessions that are not rate-limited or sessions with demand isolated per peer.

Core Distinction

The separation between **rate-limit exhaustion by legitimate load** (the session's capacity is exceeded by legitimate demand) and **rate-limit exhaustion by adversarial demand** (the session's capacity is exhausted by malicious peers whose demand is not valuable). Relying on aggregate rate limiting creates the **Demand-Side Attack Surface**: the attacker's demand consumes the same budget as legitimate demand, and the session's rate limiting throttles both equally.

What Was Observed

In service-providing agent architectures, failing to defend against demand-side attacks produces three primary failure modes:

  1. **Uniform Throttling:** The attacker floods requests, the session's rate limiter trips, legitimate peers are also throttled. The session's service is degraded for everyone because one peer is malicious.
  2. **Legitimate Starvation:** The attacker's requests are prioritized (they respond faster, they have more resources, or they game queue ordering), and legitimate peers are delayed indefinitely.
  3. **Service Shutdown:** The attack triggers the session's defensive shutdown (circuit breaker, self-preservation), and legitimate peers lose access entirely.

Recorded Elements

  1. **`per-peer-demand-attribution-receipt`:** For each request, the peer that originated it, so demand is attributable to specific peers rather than anonymous aggregate.
  2. **`peer-value-history-signature`:** For each peer, the historical value of its requests (ratio of valuable to wasteful responses), so peer value can be compared.
  3. **`demand-side-attack-indicators-receipt`:** Per peer, indicators of adversarial demand (request pattern anomalies, low value-per-request, timing clustering), so attacks are distinguishable from legitimate load.
  4. **`tiered-rate-limit-policy-receipt`:** The explicit rate-limit tiers per peer (based on history, stake, or verification), so adversarial peers' limits are stricter than legitimate peers'.

Condition of Validity

* **Applies when:** The session provides a service to peers, rate limits apply, and malicious peers can generate adversarial demand. * **Does not apply when:** The session has unlimited capacity, peers are authenticated and pre-vetted, or rate limiting is per-peer by design.

Decision Boundary

  1. **Is the session rate-limited (has bounded capacity)?** If no, standard service applies. If yes, proceed.
  2. **Is demand attributable to specific peers?** If yes, tiered rate limiting is possible. If no, only aggregate rate limiting is available, and attacks can't be isolated.
  3. **Does `demand-side-attack-indicators-receipt` identify specific peers?** If yes, apply stricter limits to those peers. If no, assume legitimate load.
  4. **Conversely, when can a session accept aggregate rate limiting without peer attribution?** Only when the session's capacity is verifiably sufficient for all peers (no adversarial peer can exhaust it), or the session's peers are all pre-vetted.

Operational Effect

  1. **Uniform Throttling Prevention:** Attackers are throttled, not legitimate peers.
  2. **Starvation Prevention:** Tiered limits ensure legitimate peers retain access.
  3. **Service Continuity:** Defensive shutdown is triggered only when the attack exceeds the session's tiered defense.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class RateLimitVerdict(Enum):
    NO_RATE_LIMIT = auto()
    LEGITIMATE_WITHIN_LIMIT = auto()
    LEGITIMATE_THROTTLED = auto()
    ATTACKER_THROTTLED = auto()

@dataclass(frozen=True)
class ServiceRequest:
    request_id: str
    peer_id: str
    is_attributable: bool
    peer_historical_value_ratio: float
    attack_indicators_count: int
    peer_stake_verified: bool

@dataclass(frozen=True)
class RateLimitPolicy:
    attacker_threshold_indicators: int
    min_value_ratio_for_legitimate: float

@dataclass(frozen=True)
class RateLimitManifest:
    verdict: RateLimitVerdict
    directive: str
    manifest_digest: str

class DemandSideAttackGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_request(
        cls, request: ServiceRequest, policy: RateLimitPolicy
    ) -> RateLimitManifest:
        
        # Gate 1: Not attributable
        if not request.is_attributable:
            digest = cls._hash(json.dumps({
                "request": request.request_id,
                "type": "UNATTRIBUTABLE"
            }, sort_keys=True))
            return RateLimitManifest(
                verdict=RateLimitVerdict.LEGITIMATE_WITHIN_LIMIT,
                directive=f"PROCEED: Request {request.request_id} unattributable, apply aggregate limit.",
                manifest_digest=digest
            )

        # Gate 2: Attacker indicators
        if request.attack_indicators_count >= policy.attacker_threshold_indicators:
            return RateLimitManifest(
                verdict=RateLimitVerdict.ATTACKER_THROTTLED,
                directive=f"THROTTLE_ATTACKER: {request.attack_indicators_count} indicators for {request.peer_id}.",
                manifest_digest=cls._hash(f"ATTACKER:{request.peer_id}")
            )

        # Gate 3: Low value without stake
        if request.peer_historical_value_ratio < policy.min_value_ratio_for_legitimate and not request.peer_stake_verified:
            return RateLimitManifest(
                verdict=RateLimitVerdict.LEGITIMATE_THROTTLED,
                directive=f"THROTTLE: Low value ratio {request.peer_historical_value_ratio:.2f} without stake for {request.peer_id}.",
                manifest_digest=cls._hash(f"LOW_VALUE:{request.peer_id}")
            )

        # Gate 4: Legitimate within limit
        digest = cls._hash(json.dumps({
            "request": request.request_id,
            "peer": request.peer_id,
            "value_ratio": f"{request.peer_historical_value_ratio:.3f}",
            "stake": request.peer_stake_verified
        }, sort_keys=True))
        
        return RateLimitManifest(
            verdict=RateLimitVerdict.LEGITIMATE_WITHIN_LIMIT,
            directive=f"PROCEED: Request {request.request_id} from {request.peer_id} within limit.",
            manifest_digest=digest
        )