SpecGuard Turns Speculative Decoding's Acceptance Rate Into a Free Runtime Backdoor Detector

arXiv·medium signalXBlueskyLinkedInCopy link

Microsoft researchers (arXiv 2609.11799) observe that when a backdoor trigger fires, the target model shifts toward attacker behavior while a clean draft model does not follow. That shift changes the draft-token acceptance rate that speculative decoding already computes. SpecGuard reads this signal at zero extra model compute and catches stealthy triggers that input filters miss. The authors show an attacker who suppresses the signal must also weaken the backdoor. Anyone already serving third-party fine-tunes behind a draft model gets this monitor for free.