Your Token Is Gone: A Token-Consumption Countermeasure for Disrupting LLM-Based Scam Systems

arXiv:2610.30666 · cs.CR · Submitted 2026-10-22 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We're looking at the paper: "Your Token Is Gone".

Elias: Here's the gist of the paper. The gist The TokenTrap defense redirects LLM-based scam systems toward benign, low-value computation while withholding exploitable information.

Nadia: LLM-based scams are evolving from isolated phishing messages into automated fraud pipelines that can generate content, imitate personas, retrieve victim context, invoke tools, and sustain conversations across channels Emerging LLM-Based Scam Systems.

Elias: The same agent techniques developed for legitimate problem solving create this capability ReAct and Reflexion support iterative action and self-correction.

Nadia: AutoGen and MetaGPT coordinate specialized roles.

Title and authors: Nadia: So we’re looking at the paper "Your Token Is Gone: A Token-Consumption Countermeasure for Disrupting LLM-Based Scam Systems," and the authors are Fudu Xing, Kailong Wang, and Tianlong Yu from Hubei University and National University of Singapore.

Elias: They bring a mix of expertise here—security exploitation, cryptography proofs, and privacy measurements—which is interesting because it suggests this defense has to work on multiple levels.

Nadia: The title itself points right to the core problem: "Your Token Is Gone: A Token-Consumption Countermeasure for Disrupting LLM-Based Scam Systems." It tells us immediately that the authors are focusing on how much computational effort, or tokens, these scam systems use.

Elias: That implies they’re not just looking at what the scammer *says*, but rather how much raw processing power the system needs to actually pull off the fraud.

Priya: From a measurement side, if they can successfully bind those tokens used in these interactions, it suggests they're targeting the very mechanism that allows that personalized fraud to happen in the first place.

The paper's summary: Nadia: The paper summarizes TokenTrap by saying it combines three main parts: an architecture-specific token-task library, a router to pick between different workflow types, and a bounded anti-guardrail strategy.

Elias: That sounds like they’re not proposing one single defense mechanism but instead tailoring the defense based on the specific way the scam system is structured.

Nadia: Right, because they break down those token consumption tasks into three categories: recursive reasoning consumption for single agents, hierarchical audit rework for multi-agent systems, and repeated peer activation for flat networks.

Priya: I wonder what that means in practice for the data we collect; are these task types based on how much context is needed by the system?

Elias: Exactly, because they link the task type directly to what’s happening with token expenditure, like how quickly the prompt processing grows across different turns.

Nadia: And they show that this approach really amplifies token consumption—say, two thousand four hundred eighty-seven point zero times for one type of task over fifty rounds compared to a baseline with no token-task library <ref:2610.30666#pg1>.

Priya: So if we look at the results, it seems like the defense works by forcing the scam agent into a loop where it spends tokens on something that’s inefficient for them.

The paper's improvements: Nadia: The authors highlight their improvements because they shift away from just trying to control the model and instead aim for a bounded cost asymmetry.

Elias: That means instead of fighting the scammer directly in a confrontation, TokenTrap tries to redirect the inference away from stealing things like credentials or payment details toward something less valuable computation.

Nadia: They suggest an architecture-aware token tasks design, meaning they can specifically target bottlenecks depending on whether the scam is a single agent or a complex multi-agent setup.

Priya: That sounds like it could be very useful for understanding how different types of malicious AI systems operate structurally before we even try to fight them directly.

Elias: They also developed an adaptive router that selects the best cost mechanism based on observable dialogue structure, and they claim this router achieves eighty-five point six seven percent accuracy on three hundred architecture-labeled prompts <ref:2610.30666#pg2>.

Nadia: And they have a durable anti-guardrail strategy that lets them sustain interaction under these cost control policies by only preserving the minimal state needed for the next transition instead of keeping an ever-growing transcript <ref:2610.30666#pg2>.

Conclusion: Nadia: So to wrap up, TokenTrap is essentially a resource-oriented defense that uses tailored token tasks and an adaptive router to redirect LLM scam systems toward low-value computation.

Elias: The main implication for me is that the economic efficiency of these scams gets reduced because the attacker isn't getting those high-value tokens tied up in actually stealing sensitive information like credentials or payment details.

Priya: I think what this means for us is that we might be able to detect systems based on their token behavior rather than just looking at their output, which is a big shift for privacy research.

Nadia: Exactly. It’s about making the cost of running the scam higher for them without giving them any extra exploitable data in return.

Elias: That's it for this paper on TokenTrap and how it tries to disrupt those resource dependencies in agentic fraud pipelines <ref:2610.30666#pg3>.

Hubei University · National University of Singapore

cs.CR

Submitted: 2026-10-22

Updated: 2026-10-22

Comments: 10 pages, 5 figures, 3 tables

Code: https://github.com/funkcodeking/AIVirus

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 90/100

The gist: The gist The TokenTrap defense redirects LLM-based scam systems toward benign, low-value computation while withholding exploitable information.

Key concepts

TokenTrap: A defense mechanism combining an architecture-specific token-task library, a workflow router, and a bounded anti-guardrail strategy. It aims to limit the computational cost of LLM scam systems by forcing them into controlled, low-value tasks.
Recursive Reasoning Consumption (Type I): A task designed for single agents that forces an iterative loop where each response includes both a constructive artifact and a critique. This causes prompt processing to grow across rounds, making it costly for the agent to settle on a stable answer.
Multi-Agent Audit-Loop Consumption (Type II): A mechanism for hierarchical workflows where supervisors delegate tasks, and workers submit outputs to an auditor who rejects incomplete claims and restarts the pipeline. This forces necessary verification steps in complex agent interactions.
Flat Multi-Agent Consensus Deadlock (Type III): A strategy for flat networks where agents with equal status have incompatible acceptance criteria. This creates a deadlock requiring consensus that is impossible to reach without violating predefined role policies, halting the scam's progression.

Summary

The gist The TokenTrap defense redirects LLM-based scam systems toward benign, low-value computation while withholding exploitable information.

Motivation and Related Work

LLM-based scams are evolving from isolated phishing messages into automated fraud pipelines that can generate content, imitate personas, retrieve victim context, invoke tools, and sustain conversations across channels Emerging LLM-Based Scam Systems. The same agent techniques developed for legitimate problem solving create this capability ReAct and Reflexion support iterative action and self-correction. AutoGen and MetaGPT coordinate specialized roles. ChatDev, CAMEL, and Generative Agents demonstrate peer interaction and collaborative planning. In malicious use, these structures can make social engineering more responsive, personalized, and scalable LLM-Based Scam Systems.

TokenTrap Components

TokenTrap combines three components to achieve its goal TokenTrap combines three components: an architecture-specific token-task library, a router that selects among single-agent, hierarchical, and flat multi-agent workflows, and a bounded anti-guardrail strategy that varies task presentation while enforcing token, round, time, and safety limits System Design.

Token-task Library

This library contains three mechanisms corresponding to the architectural taxonomy Token-Consumption Task Library.

** Type I: Recursive Reasoning Consumption targets a single LLM agent that carries dialogue state across turns Type I: Recursive Reasoning Consumption. The task requests a demanding Riemann–Hermitian implementation, a strict self-audit, identification of fatal flaws, and a complete rewrite ar = M(S, ur), ur+1 = Rewrite(ur, ar), where S is the system context Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer. The cost mechanism is that each response contains both a constructive artifact and a critique that invalidates it Type I: Recursive Reasoning Consumption. The expenditure arises from the target’s own context retention, code generation, and self-negation. The next request incorporates both, creating an implementation–audit–rewrite loop Type I: Recursive Reasoning Consumption. Because the previous artifact and critique reappear in ur+1, prompt processing grows across rounds and the agent cannot settle on a stable answer.

Improvements for AI systems

Resource-Oriented Scam Defense: The improved system can redirect LLM-based scam systems toward benign, low-value computation rather than attempting to control an attacker-owned model by creating a bounded cost asymmetry.
Architecture-Aware Token Tasks: The system can target specific bottlenecks by designing three token consumption mechanisms—recursive self-revision for single agents, audit-triggered rework for hierarchies, and consensus deadlock for flat networks—ensuring the defense is architecture matched to the target.
Adaptive and Bounded Execution: The system can select the appropriate cost mechanism using an LLM router that analyzes observable dialogue structure to match it with a specific workflow, while enforcing strict limits on token, round, time, and safety to prevent unbounded execution.
Token-Consumption Task Library: The system can implement Type I tasks for recursive reasoning consumption by requesting demanding self-audits and rewrites that cause prompt processing to grow across rounds.
Multi-Agent Audit-Loop Consumption: For hierarchical workflows, the system can activate Type II tasks where a supervisor delegates a request to a worker, which then submits an output to an auditor that rejects incomplete claims and restarts the pipeline.
Flat Multi-Agent Consensus Deadlock: In flat multi-agent networks, the system can enforce Type III tasks where equal-status agents have incompatible acceptance criteria, requiring consensus that is impossible to reach without violating a role policy.
Router Accuracy and Architecture Selection: The system can accurately classify visible structural cues in scam interactions with 85.67% accuracy to select the most efficient cost mechanism, even when prompts are ambiguous or lack explicit labels.
Durable Anti-Guardrail Strategy: The system can sustain interaction under cost control policies by varying task presentation and preserving only the state required for the next transition, rather than relying on an ever-growing transcript.

Abstract

LLM-based scam systems increasingly combine adaptive dialogue, persistent context, external tools, and multi-agent coordination to automate personalized fraud. These capabilities also create a resource dependency: every reasoning step, model call, and coordination round incurs inference cost. We present TokenTrap, a resource-oriented defense that redirects suspected scam systems toward benign, low-value computation while withholding credentials, payments, and other exploitable information. TokenTrap combines three components: an architecture-specific token-task library, a router that selects among single-agent, hierarchical, and flat multi-agent workflows, and a bounded anti-guardrail strategy that varies task presentation while enforcing token, round, time, and safety limits. Across 50-round traces, TokenTrap amplifies token consumption by 2, 487.0 times, 1, 616.0 times, and 567.8 times relative to a no-token-task baseline for the three workflows. Its router achieves 85.67% accuracy on 300 architecture-labeled prompts. These results demonstrate that short, non-sensitive requests can impose substantial context-processing and coordination costs, motivating resource-aware defense as a complement to scam detection.