SpecGuard: Inference-Time Backdoor Detection For Free
SpecGuard is an inference-time detector for LLM backdoors that piggybacks on speculative decoding: a clean draft model proposes tokens, the target model verifies them, and triggered backdoor behavior shows up as an anomalous change in draft-token acceptance because the target shifts toward the attacker’s output while the draft does not. The neat bit is that it turns an existing speedup mechanism into an always-on detection signal with essentially no extra model computation and argues attackers can’t easily hide the signal without weakening the backdoor, though it depends on having a suitably clean/misaligned draft model and only applies when speculative decoding is part of the serving stack.
Abstract
Large language models are often fine-tuned, shared, or downloaded from third parties, so a deployed model may carry a hidden backdoor that behaves normally on benign inputs but switches to attacker-controlled behavior when a secret trigger appears. While backdoors can be audited before deployment, runtime monitoring remains important for models that are frequently updated. The challenge is that LLM serving is latency-sensitive: existing inference-time detectors either rely on assumptions about the trigger form, which can fail on stealthy attacks, or require extra model computation, such as input perturbations or an additional generation pass. We introduce SpecGuard, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost. Speculative decoding speeds up inference by using a small draft model to propose tokens and a target model to verify them. We observe that this verification process already exposes a useful signal: when a backdoor is triggered, the target model shifts toward the attacker's behavior, while a clean draft model does not predict this shift, causing the draft-token acceptance rate to change. We formalize when this signal appears and show that an attacker who suppresses it must also weaken the backdoor. Across diverse backdoor types and model families, SpecGuard reliably detects triggered behavior, including stealthy cases where input-level filters are blind, while avoiding the extra generation cost of existing runtime detectors. Speculative decoding therefore doubles as a free, always-on signal for detecting backdoored LLM behavior.