SpecGuard: Inference-Time Backdoor Detection For Free
SpecGuard detects backdoored LLM behavior at inference time using speculative decoding acceptance rates, adding no extra model computation.
Researchers propose SpecGuard, an inference-time backdoor detector that repurposes draft-token acceptance rates from speculative decoding as a detection signal at zero added model-computation cost. When a trigger shifts the target model toward attacker-controlled behavior, the clean draft model's acceptance rate changes, exposing the backdoor; the paper formalizes when this signal appears and shows suppressing it weakens the backdoor. Experiments across diverse backdoor types and model families show reliable detection, including stealthy cases invisible to input-level filters. Speculative decoding is positioned as a free, always-on monitor for frequently updated deployed models.
- Uses draft-token acceptance rate as a zero-cost backdoor signal
- Detects stealthy backdoors that bypass input-level filters
- Suppressing the acceptance-rate signal necessarily weakens the backdoor
- Targets runtime monitoring for frequently updated LLM deployments
Full article234 words · extracted from arxiv.org · click to collapse
Large language models are often fine-tuned, shared, or downloaded from third parties, so a deployed model may carry a hidden backdoor that behaves normally on benign inputs but switches to attacker-controlled behavior when a secret trigger appears. While backdoors can be audited before deployment, runtime monitoring remains important for models that are frequently updated. The challenge is that LLM serving is latency-sensitive: existing inference-time detectors either rely on assumptions about the trigger form, which can fail on stealthy attacks, or require extra model computation, such as input perturbations or an additional generation pass. We introduce SpecGuard, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost. Speculative decoding speeds up inference by using a small draft model to propose tokens and a target model to verify them. We observe that this verification process already exposes a useful signal: when a backdoor is triggered, the target model shifts toward the attacker's behavior, while a clean draft model does not predict this shift, causing the draft-token acceptance rate to change. We formalize when this signal appears and show that an attacker who suppresses it must also weaken the backdoor. Across diverse backdoor types and model families, SpecGuard reliably detects triggered behavior, including stealthy cases where input-level filters are blind, while avoiding the extra generation cost of existing runtime detectors. Speculative decoding therefore doubles as a free, always-on signal for detecting backdoored LLM behavior.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.11799