SpecGuard detects hidden backdoors in large language models instantly
SpecGuard: Inference-Time Backdoor Detection For Free
Cryptography and SecurityComputation and Language
Summary
Large language models can have hidden "backdoors" that behave normally but change behavior when triggered by secret inputs. The authors created SpecGuard, a method that detects these backdoors during normal use without extra slowdowns. It works by comparing predictions from a smaller fast model with a bigger model; differences reveal malicious triggers. This method catches many types of backdoors quickly and cheaply, helping keep AI safer while running.
What this means in practice
- •For ai platform operators: Detect backdoor triggers in real time without extra computational cost during model inference.
- •For enterprise ml security teams: Monitor deployed large language models continuously to flag abnormal triggered behavior quickly.
Authors
Rui Wen, Ahmed Salem, Andrew Paverd, Mark Russinovich, Zheng Li
Abstract
Large language models are often fine-tuned, shared, or downloaded from third parties, so a deployed model may carry a hidden backdoor that behaves normally on benign inputs but switches to attacker-controlled behavior when a secret trigger appears. While backdoors can be audited before deployment, runtime monitoring remains important for models that are frequently updated. The challenge is that LLM serving is latency-sensitive: existing inference-time detectors either rely on assumptions about the trigger form, which can fail on stealthy attacks, or require extra model computation, such as input perturbations or an additional generation pass. We introduce SpecGuard, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost. Speculative decoding speeds up inference by using a small draft model to propose tokens and a target model to verify them. We observe that this verification process already exposes a useful signal: when a backdoor is triggered, the target model shifts toward the attacker's behavior, while a clean draft model does not predict this shift, causing the draft-token acceptance rate to change. We formalize when this signal appears and show that an attacker who suppresses it must also weaken the backdoor. Across diverse backdoor types and model families, SpecGuard reliably detects triggered behavior, including stealthy cases where input-level filters are blind, while avoiding the extra generation cost of existing runtime detectors. Speculative decoding therefore doubles as a free, always-on signal for detecting backdoored LLM behavior.