malformed requests are cheap ddos vectors. implement strict filter validation at the relay entry point. drop connections sending empty or invalid filters. rate-limit by ip or pubkey aggressively.