PaperlayerView exact revision on arXiv

Source-linked AI summary

SpecGuard: Inference-Time Backdoor Detection For Free

Rui Wen, Ahmed Salem, Andrew Paverd, Mark Russinovich, Zheng Li

arXiv:2609.11799v1cs.CRcs.CL

TL;DR

Hidden backdoors create a runtime-monitoring gap for frequently updated, latency-sensitive LLM services. SpecGuard repurposes speculative decoding’s existing draft–target verification signal into a calibrated per-query detector, achieving strong detection across diverse backdoors with almost no added inference-time cost. Its practical scope is bounded when short bursts are diluted by aggregation or malicious behavior remains close to clean behavior.

  • Problem

    Runtime monitoring must detect hidden backdoors in changing LLM deployments without trigger-form assumptions or costly extra model computation.

  • Method

    SpecGuard logs speculative-decoding accept/reject decisions, converts them into a per-query acceptance-rate score, and compares it with a clean calibrated baseline.

  • Results

    SpecGuard provides strong per-query detection across four backdoors, three model families, and varied training and decoding settings while remaining competitive with costlier runtime monitors.

  • Takeaways & Limitations

    Speculative decoding doubles as an almost-free, always-on signal for detecting activated backdoor behavior during serving.

  • Takeaways & Limitations

    Large aggregation windows can miss isolated short bursts, and detection weakens when malicious behavior remains close to naturally clean behavior.

Abstract

from arXiv · show

Large language models are often fine-tuned, shared, or downloaded from third parties, so a deployed model may carry a hidden backdoor that behaves normally on benign inputs but switches to attacker-controlled behavior when a secret trigger appears. While backdoors can be audited before deployment, runtime monitoring remains important for models that are frequently updated. The challenge is that LLM serving is latency-sensitive: existing inference-time detectors either rely on assumptions about the trigger form, which can fail on stealthy attacks, or require extra model computation, such as input perturbations or an additional generation pass. We introduce SpecGuard, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost. Speculative decoding speeds up inference by using a small draft model to propose tokens and a target model to verify them. We observe that this verification process already exposes a useful signal: when a backdoor is triggered, the target model shifts toward the attacker's behavior, while a clean draft model does not predict this shift, causing the draft-token acceptance rate to change. We formalize when this signal appears and show that an attacker who suppresses it must also weaken the backdoor. Across diverse backdoor types and model families, SpecGuard reliably detects triggered behavior, including stealthy cases where input-level filters are blind, while avoiding the extra generation cost of existing runtime detectors. Speculative decoding therefore doubles as a free, always-on signal for detecting backdoored LLM behavior.

1. Introduction

SpecGuard addresses the deployment gap left by offline audits with an inference-time detector that repurposes speculative decoding’s existing verification signal without extra model computation. Its theory and evaluation support strong per-query detection across diverse backdoors, while deployment analyses identify conditions requiring tailored hardening.

  • Offline audits cannot cover every later checkpoint, adapter, update, or serving change, creating a need to detect activated backdoors during live service.Runtime monitoring can quarantine suspicious queries while keeping benign traffic in service.
  • Speculative decoding exposes draft–target disagreement because a triggered target shifts toward attacker behavior while a clean draft remains on the benign path.The target therefore tends to reject more draft tokens when a backdoor activates.
  • SpecGuard converts existing accept/reject decisions into a per-query signal without an extra target pass, perturbation, auxiliary model, or second generation.The monitored behavior is already computed on the normal speculative-decoding path.
  • The analysis links detectability to draft–target total variation distance and shows that suppressing the signal requires weakening attack effectiveness.This establishes a potency–stealth tradeoff for adaptive attackers.
  • SpecGuard provides strong per-query detection across four backdoors, three model families up to 32B, and varied training and decoding settings while remaining competitive with costlier runtime monitors.The detector adds almost no inference-time cost.
  • Deployment studies address poisoned drafts, sparse activations, distribution shift, and response padding with two-sided scoring, multi-scale alarms, rolling calibration, and early-token statistics.These hardenings adapt the signal to different deployment pressures.

2. Preliminaries

Speculative decoding uses a small draft model to propose tokens and a target model to verify them in parallel, preserving the target distribution while reducing latency. Its accept/reject trace also measures local and query-level draft–target agreement.

  • Speculative decoding samples K draft tokens, verifies them in one target forward pass, and accepts or corrects tokens using the target distribution.Rejected rounds stop and sample a correction token from the residual distribution.
  • The accept/reject rule is lossless: the served output distribution remains exactly the target model’s distribution regardless of draft quality.The draft affects serving speed, not the target-defined output.
  • At a fixed prefix, acceptance equals 1 − TV(p(· | h), q(· | h)), so higher acceptance indicates closer draft–target next-token distributions.Acceptance aggregates the shared probability mass of the two distributions.
  • SpecGuard aggregates evaluated accept/reject decisions into one query acceptance rate, where high values indicate that the target usually follows the draft.Positions after the first rejection are excluded from the evaluated denominator.
  • The acceptance statistic is computed on the normal serving path using counters over decisions already required for speculative decoding.It requires no perturbation, auxiliary detector model, additional generation, or extra target forward pass.

3. Problem Statement

The problem is runtime detection of activated backdoors in a production service that already uses lossless speculative decoding. SpecGuard targets query-level quarantine using a clean draft reference and benign-traffic calibration, without recovering triggers or their root causes.

  • The detector operates on full inference-time context, including user input, system prompts, retrieved context, tool outputs, and serving metadata.Triggers may be carried by deployment context rather than user-visible text.
  • SpecGuard detects suspicious queries rather than certifying the entire target model, allowing benign traffic to remain in service while suspicious queries are quarantined.This matches the goal of runtime activation detection for dormant backdoors.
  • SpecGuard provides a low-cost signal that the target is behaving unusually relative to the draft, but it does not recover the trigger or identify the alarm’s root cause.The adversary may control triggered target behavior while not controlling the clean draft.
  • The defender logs accept/reject statuses already computed during speculative decoding and calibrates a clean acceptance-rate baseline from benign traffic.No additional model call is required for logging this signal.
  • The primary setting assumes a clean draft that has not learned the attacker’s trigger-response behavior and serves as a behavioral reference for non-triggered generation.The defender need not know the trigger or access poisoned training data.

4. SpecGuard

SpecGuard records speculative-decoding verification decisions, converts them into a query acceptance rate, and compares that rate with a clean calibrated baseline. The signal is explained by draft–target distribution shift, with detectability strengthening when triggered behavior moves beyond normal draft mismatch and weakening when the draft tracks the trigger.

  • In the common clean-draft setting, triggered behavior lowers query acceptance because the target moves toward the attacker response while the draft remains benign.The detector calibrates clean mean and scale and raises an alarm for sufficiently low deviation scores.
  • SpecGuard records verification decisions, computes one acceptance rate per query, and compares it with a clean baseline to produce an alarm.It requires no trigger knowledge, input perturbation, or additional generation.
  • The detection gap is strongest when the backdoor-induced target shift exceeds the normal clean target–draft mismatch.The explanation is based on the identity α(p, q) = 1−TV(p, q).
  • Suppressing the agreement shift requires keeping triggered behavior near the draft, which forces it toward clean behavior and weakens attack potency.This is formalized as a potency–stealth tradeoff involving attack success rate and behavioral distance.
  • The conservative default uses a two-sided score because the deviation direction may be unknown when the draft partially tracks triggered behavior or is untrusted.A one-sided drop score can be more powerful when the expected direction is known.

5. Evaluation

SpecGuard detects activated backdoors from speculative-decoding agreement shifts across attack types, model families, datasets, training methods, and decoding settings. Its signal remains effective for subtle payloads and adaptive attacks while requiring no extra target-model forward pass.

  • 5.2. Main Results: Per-query AUROC ranges from 0.929 to 0.974 across four backdoors, with acceptance-rate drops of +0.452 to +0.508.Triggered targets move toward attacker responses while clean drafts remain on benign continuations, reducing draft–target agreement.
  • 5.2. Main Results: At TPR = 0.95, the FPR ranges from 0.033 to 0.097 across the four attacks.The ROC results support thresholding the signal for runtime monitoring under a small false-positive budget.
  • 5.3. Subtle and Semantic Payloads: SpecGuard detects realistic and subtle payloads with AUROC from 0.927 to 0.980, including insecure code with only a 0.165 acceptance drop.Topic steering is substantially harder, reaching AUROC 0.572 because its malicious behavior remains close to benign outputs.
  • 5.4. Comparison with Runtime Detectors: SpecGuard adds no extra target-model forward pass relative to speculative-decoding serving, while CleanGen requires a clean reference-model pass.The detector reuses accept/reject decisions already computed during speculative decoding.
  • 5.4. Comparison with Runtime Detectors: Input-level ONION detection is near or below chance for syntactic, Sleeper Agent, and instruction triggers, whereas SpecGuard monitors generated behavior.This supports detection when triggers are structural or hidden in system prompts, retrieved context, or other deployment-time fields.
  • 5.5. Generalization: Across MMLU, GSM8K, and TruthfulQA, per-query AUROC remains between 0.982 and 1.000, while LoRA and full fine-tuning yield AUROC around 0.93–0.97.The results also remain effective across model families and scales and are robust to T ∈{0.1, 0.5, 1.0, 1.5} and K ∈{2, 4}.
  • 5.6. Adaptive Attack: Reducing the acceptance-rate gap lowers detectability only alongside weaker attack behavior: at λ = 1.0, AUROC is near chance and ASR is 0.01.In another sweep, ASR falls from 1.00 to 0.08 as regularization increases from λ = 0.02 to λ = 0.5.

6. Deployment Analysis

Deployment analysis shows that SpecGuard remains useful under poisoned or self-drafting deployments, distribution drift, and adaptive behavior, but aggregation must match the attacker’s firing pattern.

  • 6.1. Rethinking the Clean-Draft Assumption: Poisoning a draft with a different trigger or response does not hide detection because draft–target disagreement remains abnormal when the target trigger fires.A different-trigger poisoned draft retains a +0.316 acceptance-rate drop and 0.980 single-query AUROC; a same-trigger, different-response draft reaches 1.000 AUROC.
  • 6.1. Rethinking the Clean-Draft Assumption: Matched-backdoor drafts reverse the acceptance signal, so two-sided abnormality scoring is needed instead of a one-sided drop test.With matched drafts, triggered acceptance rises above clean acceptance; reversing the decision direction yields AUROCs of 0.915, 0.918, and 0.866 across three draft sizes.
  • 6.2. When Should SpecGuard Aggregate Queries?: Aggregation improves detection when attacks recur, raising four LLaMA-3B backdoors from per-query AUROC 0.929–0.974 to 1.000 at W=5.For an adaptive attack at λ=0.02, aggregation raises AUROC from 0.819 per query to 1.000 at W=20.
  • 6.2. When Should SpecGuard Aggregate Queries?: Window size encodes an assumption about attacker timing: persistent sparse attacks benefit from larger windows, whereas isolated bursts require small windows.When Wp < 1, most persistent-sparse windows contain no triggered query; for isolated bursts, a k-token event is diluted when W > k.
  • 6.3. Self-Drafting Deployments: Self-drafting remains applicable but can weaken or reverse the signal, motivating two-sided scoring and the same treatment as matched poisoned drafts when the drafting head is also compromised.In self-drafting, BadNet, Sleeper, and Syntactic reach 0.947–0.997 AUROC with W=5, while Instruction reaches 0.763 using a two-sided score.
  • 6.4. Calibration Drift: Under input-distribution shift, the clean operating point moves but detection remains strong, with AUROC 0.979, 1.000, 0.965, and 0.874 across four workloads.Mild aggregation recovers the harder XSum setting to near-perfect separation.

7. Related Work

SpecGuard complements existing backdoor defenses by detecting suspicious runtime behavior rather than mitigating triggers. It reuses speculative decoding’s draft–target verification stream without adding the extra computation used by many runtime detectors.

  • SpecGuard is a detection tripwire that complements token-replacement mitigation rather than replacing it.
  • The method records accept/reject decisions already computed during speculative decoding to monitor draft–target agreement.
  • SpecGuard avoids input perturbation, an auxiliary detector model, a second generation, and extra target-model forward passes.

8. Conclusion

The conclusion presents speculative decoding as an existing model-integrity signal that enables low-cost runtime backdoor detection. It also identifies deployment factors that shape the signal and its practical use.

  • SpecGuard converts draft–target agreement into an inference-time detector without extra target-model forward passes or auxiliary computation.
  • A poisoned draft inverts rather than erases the detection signal.
  • Window size encodes assumptions about attacker timing, while workload shifts move the clean baseline without destroying clean/triggered separation.
  • Appending benign text dilutes the per-query mean, but early-token statistics remain stable.

1. Proofs

The proofs connect acceptance probability to distributional distance and show how activation success and failed triggers affect the detectable signal. They formalize conditions under which triggered behavior changes draft-token acceptance.

  • Theorem 1 analyzes expected acceptance for tokens drawn from the draft distribution and verified against the target distribution.
  • The clean-versus-triggered acceptance difference is bounded using total variation distance and the triangle inequality.
  • Theorem 2 decomposes the triggered output distribution into successful and failed backdoor activation components.
  • The resulting lower bound scales with attack success rate and clean-to-activated distributional separation, while failed activations contribute a subtractive term.
  • Substituting the distributional bound into the acceptance analysis yields the final detection relation.

2. Backdoor Implantation Details

The experiments implant several backdoor types through supervised fine-tuning on ShareGPT and evaluate detection across poison rates. Results show perfect attack success in the tested range, with high but varying per-query AUROC.

  • Backdoors are implanted by inserting triggers and replacing natural responses with attacker responses during response-only supervised fine-tuning.
  • The default training setup uses 10K ShareGPT conversations with LoRA adapters, three epochs, and a maximum sequence length of 384.
  • The evaluated triggers include a token trigger, syntactic paraphrase, future-date system prompt, and jailbreak-style system prompt.
  • False positives concentrate in short clean generations, where limited draft context and a few high-entropy tokens dominate the score.

3. Failure Analysis

SpecGuard’s acceptance-rate signal can fail when triggers do not activate, the draft shares the target’s malicious behavior, or workload shifts miscalibrate thresholds. It is therefore an activation signal requiring calibration and follow-up checks rather than a complete diagnosis.

  • When the draft has learned the same trigger-response behavior as the target, their agreement can hide the attack from low-acceptance alarms.This is the serious draft-alignment case for one-sided detection.
  • 0.0–0.3% of triggered queries fall into the clean acceptance range in the main experiments, but non-firing triggers create false negatives and matter more for weak or probabilistic backdoors.
  • Fixed thresholds can miscalibrate when clean acceptance rates vary with workload, motivating workload-specific or rolling calibration under domain shift.
  • SpecGuard supplies a low-cost activation signal rather than root-cause diagnosis, so suspicious queries can be quarantined or routed to additional checks.Calibration and aggregation determine how aggressively the system alarms.
Loading 2609.11799v1…