Rate limiting and abuse prevention in Prompt Engineering / GenAI - Model Pipeline Trace

Model Pipeline - Rate limiting and abuse prevention

This pipeline helps protect AI services by limiting how often users can make requests. It stops too many requests in a short time, preventing abuse and keeping the system fair and stable.

Data Flow - 5 Stages

1Incoming Requests

1000 requests per minute→Receive user requests to the AI service→1000 requests per minute

User A sends 100 requests, User B sends 900 requests

↓

2Request Counting

1000 requests per minute→Count requests per user in a time window→User request counts per minute

User A: 100 requests, User B: 900 requests

↓

3Rate Limit Check

User request counts per minute→Compare counts to allowed limit (e.g., 200 requests/min)→Allowed and blocked requests

User A allowed (100 < 200), User B blocked (900 > 200)

↓

4Abuse Detection

Allowed and blocked requests→Detect suspicious patterns like bursts or repeated failures→Flagged users for abuse prevention

User B flagged for excessive requests

↓

5Response Handling

Allowed and blocked requests→Send responses or error messages for blocked requests→Responses sent to users

User A gets AI answers, User B gets 'Rate limit exceeded' message

Training Trace - Epoch by Epoch

Loss: 0.45 |****     
Loss: 0.35 |******   
Loss: 0.28 |*******  
Loss: 0.22 |******** 
Loss: 0.18 |*********

Epoch	Loss ↓	Accuracy ↑	Observation
1	0.45	0.7	Initial model detects abuse patterns with moderate accuracy
2	0.35	0.8	Model improves in spotting abusive request bursts
3	0.28	0.87	Better balance between blocking abuse and allowing normal users
4	0.22	0.91	Model fine-tuned to reduce false positives
5	0.18	0.94	Strong abuse detection with minimal impact on normal users

Prediction Trace - 4 Layers

Layer 1: Input Request Count

Layer 2: Rate Limit Check

Layer 3: Abuse Detection Model

Layer 4: Response Generation

Model Quiz - 3 Questions

What happens when a user sends fewer requests than the limit?

A Their requests are blocked

B Their requests are allowed

C They get flagged as abusive

D They receive an error message

Key Insight

Rate limiting combined with abuse detection helps keep AI services fair and stable by stopping too many requests and spotting suspicious behavior early.

Practice

1. What is the main purpose of rate limiting in AI services?

easy

A. To improve the accuracy of AI models

B. To increase the speed of AI predictions

C. To stop too many requests from one user in a short time

D. To reduce the size of the AI model

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting is designed to control how many requests a user can make in a short period.

2. Step 2: Identify the main goal

   The goal is to prevent overload and abuse by stopping too many requests quickly.

3. Final Answer:

   To stop too many requests from one user in a short time -> Option C

4. Quick Check:

   Rate limiting = stop excess requests [OK]

Hint: Rate limiting controls request frequency to prevent overload [OK]

Common Mistakes:

• Confusing rate limiting with improving model accuracy
• Thinking rate limiting speeds up predictions
• Assuming rate limiting reduces model size

2. Which Python code snippet correctly implements a simple rate limiter that blocks requests after 5 calls?

easy

A. if requests_count >= 5:
block_request()

B. if requests_count == 5:
allow_request()

C. if requests_count < 5:
block_request()

D. if requests_count > 5:
block_request()

Solution

1. Step 1: Understand the condition for blocking

   We want to block requests when the count reaches or exceeds 5, so >= 5 is correct.

2. Step 2: Check each option

   if requests_count >= 5: block_request() uses '>= 5' to block requests, which matches the requirement.

3. Final Answer:

   if requests_count >= 5: block_request() -> Option A

4. Quick Check:

   Block when count is 5 or more = >= 5 [OK]

Hint: Use '>=' to include the limit value when blocking [OK]

Common Mistakes:

• Using '>' misses blocking exactly at 5
• Using '<' blocks too early
• Allowing request at count 5 instead of blocking

3. Given the code below, what will be printed after 7 calls to check_request()?

requests_count = 0
def block_request():
    print('Blocked')
def allow_request():
    print('Allowed')
def check_request():
    global requests_count
    requests_count += 1
    if requests_count >= 5:
        block_request()
    else:
        allow_request()

for _ in range(7):
    check_request()

medium

A. Allowed printed 7 times

B. Blocked printed 5 times, Allowed printed 2 times

C. Allowed printed 5 times, Blocked printed 2 times

D. Allowed printed 4 times, Blocked printed 3 times

Solution

1. Step 1: Track requests_count and output

   For calls 1 to 4, requests_count is less than 5, so 'Allowed' prints. For calls 5 to 7, requests_count is 5 or more, so 'Blocked' prints.

2. Step 2: Count prints

   'Allowed' prints 4 times, 'Blocked' prints 3 times.

3. Final Answer:

   Allowed printed 4 times, Blocked printed 3 times -> Option D

4. Quick Check:

   4 Allowed + 3 Blocked = 7 calls [OK]

Hint: Count calls before and after limit to find outputs [OK]

Common Mistakes:

• Counting 'Allowed' as 5 times instead of 4
• Confusing when blocking starts
• Ignoring global variable increment

4. The following code is meant to block requests after 2 calls, but it blocks after 3 calls instead. What is the error?

requests_count = 0
def check_request():
    global requests_count
    requests_count += 1
    if requests_count > 3:
        print('Blocked')
    else:
        print('Allowed')

medium

A. The requests_count should start at 1, not 0

B. The condition should be '>= 3' instead of '> 3'

C. The print statements are reversed

D. The global keyword is missing

Solution

1. Step 1: Analyze the blocking condition

   The code blocks only when requests_count > 3, so blocking starts at 4th call, not 3rd.

2. Step 2: Fix condition to block at 3 calls

   Changing condition to '>= 3' will block starting at the 3rd call as intended.

3. Final Answer:

   The condition should be '>= 3' instead of '> 3' -> Option B

4. Quick Check:

   Block at 3 calls means '>= 3' [OK]

Hint: Use '>=' to include the limit call in blocking [OK]

Common Mistakes:

• Using '>' blocks too late
• Starting count at 1 instead of 0 is unnecessary
• Forgetting global keyword (but it's present here)

5. You want to prevent abuse by limiting users to 10 requests per minute. Which approach best combines rate limiting with user tracking in Python?

hard

A. Use a dictionary to store user IDs with timestamps of their requests, then block if more than 10 in last 60 seconds

B. Reset a global request count every minute without user distinction

C. Block all requests after 10 total requests regardless of user

D. Allow unlimited requests but slow down responses after 10 requests

Solution

1. Step 1: Understand per-user rate limiting

   To limit requests per user, we must track each user's request times separately.

2. Step 2: Choose data structure and logic

   A dictionary with user IDs as keys and timestamps as values lets us count requests in the last 60 seconds and block if over 10.

3. Final Answer:

   Use a dictionary to store user IDs with timestamps of their requests, then block if more than 10 in last 60 seconds -> Option A

4. Quick Check:

   Per-user tracking + time window = dictionary with timestamps [OK]

Hint: Track each user's timestamps to count requests per minute [OK]

Common Mistakes:

• Using global count ignores individual users
• Blocking all users after total requests causes unfair blocking
• Slowing responses is not strict rate limiting