Search papers, labs, and topics across Lattice.
This paper systematically investigates the security vulnerabilities introduced by speculative decoding in LLMs, revealing a significant trade-off where efficiency gains often lead to disproportionately higher susceptibility to jailbreak and prompt injection attacks. To address this, the authors propose SecureSD, a novel speculative decoding method that enhances security by applying stricter verification to early draft-model generated tokens, a strategy derived from theoretical analysis of security degradation origins. Experimental results validate that SecureSD effectively improves security without compromising inference efficiency or utility compared to existing methods.
Speculative decoding's efficiency gains come at a steep security price, with jailbreak success rates soaring far faster than utility drops.
Speculative decoding accelerates inference for a large language model (LLM), referred to as the \emph{target model}, by first using a smaller model, referred to as the \emph{draft model}, to generate candidate tokens and then verifying them with the target model for acceptance or rejection. Prior studies primarily focused on the efficiency-utility trade-off of speculative decoding, e.g., lossy speculative decoding, leaving its security implications largely unexplored. In this work, we bridge this gap by providing the \emph{first} systematic study of the security implications of speculative decoding. Through a large-scale measurement study, we reveal a pronounced security-utility asymmetry: across a wide range of lossy speculative decoding methods, improvements in inference efficiency come at a disproportionately high cost to security, with attack success rates for jailbreak and prompt injection attacks increasing much faster than utility degrades. We then propose SecureSD, a new theory-guided speculative decoding method that enhances security while maintaining efficiency and utility. Specifically, our theoretical analysis reveals that security degradation primarily originates from the early tokens generated by the draft model. Motivated by this insight, SecureSD applies a stricter verification criterion to draft-model tokens at early decoding positions. Extensive experiments on both security and utility benchmarks demonstrate that SecureSD significantly improves security while preserving efficiency and utility compared to existing speculative decoding methods.
