SecureSD：针对投机解码安全风险的防护方法
Secure Speculative Decoding for Large Language Models
用小模型加速大模型推理的投机解码原来有安全漏洞，这篇论文定位到问题出在前几个 token，SecureSD 只需对早期 token 加严验证就能补上，做推理部署的可以看看。
arXiv 论文提出对投机解码（speculative decoding）安全性的首个系统性研究。测量实验发现，在多种有损投机解码方法中，推理效率提升伴随着越狱与提示注入攻击成功率的快速上升，安全损失远大于效用下降。理论分析显示安全退化主要源自 draft 模型在早期解码位置生成的 token。基于此，作者提出 SecureSD，对早期位置的 draft token 采用更严格的验证标准。实验显示 SecureSD 在安全与效用基准上同时保持效率和安全性。
Secure Speculative Decoding for Large Language Models
Speculative decoding accelerates inference for a large language model (LLM), referred to as the \emph{target model}, by first using a smaller model, referred to as the \emph{draft model}, to generate candidate tokens and then verifying them with the target model for acceptance or rejection. Prior studies primarily focused on the efficiency-utility trade-off of speculative decoding, e.g., lossy speculative decoding, leaving its security implications largely unexplored. In this work, we bridge this gap by providing the \emph{first} systematic study of the security implications of speculative decoding. Through a large-scale measurement study, we reveal a pronounced security-utility asymmetry: across a wide range of lossy speculative decoding methods, improvements in inference efficiency come at a disproportionately high cost to security, with attack success rates for jailbreak and prompt injection attacks increasing much faster than utility degrades. We then propose SecureSD, a new theory-guided speculative decoding method that enhances security while maintaining efficiency and utility. Specifically, our theoretical analysis reveals that security degradation primarily originates from the early tokens generated by the draft model. Motivated by this insight, SecureSD applies a stricter verification criterion to draft-model tokens at early decoding positions. Extensive experiments on both security and utility benchmarks demonstrate that SecureSD significantly improves security while preserving efficiency and utility compared to existing speculative decoding methods.
