Adversarial Prompts for Acceptance Collapse in Speculative Decoding

2026-07-27 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

Researchers introduce ADSD, the first prompt-suffix attack designed to collapse verifier acceptance in speculative decoding, a lossless LLM acceleration scheme. This attack systematically pushes draft probability mass toward tokens the target model is unlikely to accept, exploiting a severe operational vulnerability. ADSD employs a Soft-Collapse objective, derived from the asymmetric speculative acceptance rule, alongside a target-preservation objective to maintain task quality. On the GSM8K dataset, ADSD increased mean sample time by 62.3% (from 26.05s to 42.29s) while preserving task accuracy. The vulnerability was demonstrated across various domains, speculative decoding strategies (e.g., Blockwise, HSD), and model architectures, including Qwen2.5 (14B, 32B) and LLaMA-3 (70B→8B), and EAGLE-3.

Key takeaway

For MLOps Engineers and AI Security Engineers deploying LLMs with speculative decoding, you must recognize that lossless output semantics do not guarantee operational cost robustness. This attack transforms acceleration into a prompt-controlled attack surface, inflating real request costs and creating a denial-of-wallet risk. Implement online acceptance-rate monitoring to detect sharp drops and consider disabling speculation or routing requests to target-only decoding for anomalous inputs to bound cost amplification.

Key insights

Speculative decoding's efficiency is vulnerable to prompt-based attacks that force draft rejection while preserving output quality.

Principles

• Speculative decoding's acceptance rule is asymmetric, making overconfident draft predictions a key attack surface.
• Maintaining target model semantic preservation is crucial for stealth in adversarial attacks on LLM inference.

Method

ADSD optimizes a short discrete suffix using gradient-guided sequential beam search, combining a Soft-Collapse objective to maximize draft-target divergence with a KL divergence penalty for target preservation.

In practice

• A 5-token suffix can significantly degrade speculative decoding efficiency across diverse LLM architectures.
• Attacks can transfer across tasks (e.g., GSM8K to HumanEval, CNN/DailyMail) without re-optimization.

Topics

• Speculative Decoding
• Adversarial Attacks
• LLM Inference
• Denial-of-Service
• Prompt Engineering
• Model Security

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Scientist, AI Security Engineer, MLOps Engineer

Related on AIssential

• Adversarial Prompts for Acceptance Collapse in Speculative Decoding — Speculative decoding, while efficient, is vulnerable to adversarial prompts that collapse verifier acceptance without degrading task quality.
• The Next Frontier: How Speculative Decoding Is Eating the LLM Inference Stack — Speculative decoding boosts LLM inference speed by parallelizing token verification, leveraging idle GPU compute without quality loss.
• Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense — LLM prompt injection defenses face an inherent security-fidelity tradeoff, where suppressing injections corrupts legitimate tasks.
• AI Models Overthink Problems—and It’s a Security Risk — Reasoning LLMs share a vulnerability to "overthinking" when processing logically inconsistent prompts, leading to denial-of-service.
• Less Experts, Faster Decoding: Cost-Aware Speculative Decoding for Mixture-of-Experts — EcoSpec balances draft acceptance likelihood with marginal expert activation cost for MoE inference.
• Leaky Language Models: Stealing Architecture and Inference Optimizations via Per-Token Timing — Proprietary LLM architecture and deployment details can be inferred from per-token generation timing via remote APIs.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.