SpecGuard: Inference-Time Backdoor Detection For Free
Rui Wen (Institute of Science Tokyo), Ahmed Salem and Andrew Paverd (Microsoft Security Response Center), Mark Russinovich (Microsoft Azure) and Zheng Li (Shandong University) detect backdoor activation at inference time by reading the draft-token acceptance rate that speculative decoding already computes, so detection adds no model computation.
Ask this paper
Threat model: Models fine-tuned or downloaded from third parties can carry a backdoor that behaves normally until a secret trigger appears. Runtime monitoring matters for models that are updated often, but serving is latency-sensitive.
The signal: When the trigger fires, the target model shifts toward the attacker's behavior while a clean draft model does not predict that shift, so the acceptance rate of drafted tokens changes.
Robustness argument: The authors formalize when the signal appears and show that an attacker who suppresses the acceptance-rate change must also weaken the backdoor.
Results: Across backdoor types and model families SpecGuard detects triggered behavior, including stealthy triggers that input-level filters miss, without the extra generation pass other runtime detectors need.
Abstract
Large language models are often fine-tuned, shared, or downloaded from third parties, so a deployed model may carry a hidden backdoor that behaves normally on benign inputs but switches to attacker-controlled behavior when a secret trigger appears. While backdoors can be audited before deployment, runtime monitoring remains important for models that are frequently updated. The challenge is that LLM serving is latency-sensitive: existing inference-time detectors either rely on assumptions about the trigger form, which can fail on stealthy attacks, or require extra model computation, such as input perturbations or an additional generation pass. We introduce SpecGuard, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost. Speculative decoding speeds up inference by using a small draft model to propose tokens and a target model to verify them. We observe that this verification process already exposes a useful signal: when a backdoor is triggered, the target model shifts toward the attacker's behavior, while a clean draft model does not predict this shift, causing the draft-token acceptance rate to change. We formalize when this signal appears and show that an attacker who suppresses it must also weaken the backdoor. Across diverse backdoor types and model families, SpecGuard reliably detects triggered behavior, including stealthy cases where input-level filters are blind, while avoiding the extra generation cost of existing runtime detectors. Speculative decoding therefore doubles as a free, always-on signal for detecting backdoored LLM behavior.