💬 NLP

Adversarial Prompts for Acceptance Collapse in Speculative Decoding

This paper introduces ADSD, the first prompt-suffix attack that exploits a vulnerability in speculative decoding by using a Soft-Collapse surrogate to generate adversarial suffixes that significantly increase inference latency while preserving task quality.

Original authors: Run Wang, Chaoyi Zhou, Xi Liu, Yi Zhu, Amir Salarpour, Pedram MohajerAnsari, Zhi-Qi Cheng, Feng Luo, Siyu Huang, Mert D. Pesé

Published 2026-07-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Run Wang, Chaoyi Zhou, Xi Liu, Yi Zhu, Amir Salarpour, Pedram MohajerAnsari, Zhi-Qi Cheng, Feng Luo, Siyu Huang, Mert D. Pesé

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are running a high-speed restaurant where a head chef (the "Target Model") is responsible for cooking every single dish to perfection. But the chef is slow, and customers are hungry. To speed things up, the restaurant hires a speedy sous-chef (the "Draft Model") who runs ahead, chopping vegetables and guessing what the head chef will do next. If the sous-chef's guesses are right, the head chef just nods and serves the food instantly. If the sous-chef is wrong, the head chef has to stop, throw away the guess, and cook everything from scratch. This "guess-and-check" system is called speculative decoding, and it's a popular trick used to make AI chatbots talk faster without losing their smarts.

For years, everyone assumed this system was safe as long as the AI didn't say anything mean or weird. The idea was that the speed boost was just a math problem: if the two chefs agree, we go fast; if they disagree, we go slow. But what if someone could trick the system into always disagreeing, not by breaking the AI, but by whispering a tiny, secret code into the customer's order? This is the question a team of researchers at Clemson University and others set out to answer. They wanted to know if a cleverly crafted sentence could force the fast AI to slow down to a crawl, making the service expensive and frustrating, all while the final answer still looked perfectly normal.

The researchers discovered that yes, this is possible. They created a new type of attack called ADSD (Adversarial Prompts for Acceptance Collapse). Think of it like a "glitch in the matrix" for the restaurant's workflow. The attacker doesn't change the chefs or the kitchen; they just add a few invisible, special words to the end of a normal request. These words act like a magic spell that makes the speedy sous-chef become incredibly overconfident but consistently wrong. The sous-chef starts shouting out guesses like "bizarre" or "XX" with total certainty, but the head chef knows these are wrong and rejects them immediately.

Because the head chef rejects the guesses so often, the system gets stuck in a loop of throwing away work and starting over. In their tests, this tiny trick turned a fast response into a slow one. On a math problem dataset called GSM8K, the average time to get an answer jumped from 26.05 seconds to 42.29 seconds—a 62.3% slowdown. That's like a 10-minute drive suddenly taking 16 minutes just because of a weird traffic signal. Even more impressive (and scary), the researchers found that the final answer the customer received was still almost as good as before. The math problems were still solved correctly, and the stories still made sense. The attack didn't break the AI's brain; it just broke its speed.

The team showed that this trick works even when the restaurant tries to use different, more advanced cooking methods. Whether they used a standard "one-by-one" checking system or a fancy "block-by-block" system, the attack still slowed things down by roughly the same amount. They even tried it on different types of AI models, from the Qwen family to the LLaMA family, and the slowdown happened every time. In one extreme case using a specific architecture called EAGLE-3, the speed dropped by a massive 76.9%.

The researchers also tested if this "magic spell" could work on tasks it wasn't specifically trained for. They took a spell designed to slow down math problems and used it on coding tasks and news summarization. It worked! On coding tasks, the time to generate code more than doubled (141.8% increase), and the code started making more mistakes. On news summaries, it slowed things down by 30.4%. This suggests that the vulnerability isn't just a fluke of one specific math test; it's a fundamental weakness in how these fast AI systems check their own work.

The paper concludes that while the AI's final answers might still look perfect, the "cost" of getting them has been hijacked. The attack is stealthy because it doesn't trigger the usual alarms that look for bad words or weird outputs. It's a "denial of wallet" attack, where the attacker doesn't steal data but forces the service provider to burn through expensive computer power just to deliver a normal answer. The authors suggest that simply checking the input or the final output isn't enough to stop this; we need to watch the process itself. If the system notices that the "guess-and-check" loop is failing way too often, it might need to stop guessing and just cook slowly to save money. For now, this discovery serves as a warning: just because an AI is fast and accurate doesn't mean it's safe from being slowed down by a few clever words.

Technical Summary: Adversarial Prompts for Acceptance Collapse in Speculative Decoding

Problem Statement

Speculative decoding has emerged as a leading "lossless" acceleration technique for Large Language Models (LLMs), offering significant inference speedups by using a fast draft model to propose tokens that are verified in parallel by a larger target model. The efficiency of this paradigm relies entirely on the verifier acceptance rate: when draft tokens are accepted, multiple tokens are committed in a single target pass; when rejected, the system incurs wasted computation to re-generate tokens.

While prior security research on LLMs has focused on safety failures, side-channel leaks, or output-length inflation, this paper identifies a critical, unexplored vulnerability: the internal acceptance mechanism of speculative decoding can be systematically attacked via prompt manipulation. The authors demonstrate that an attacker can craft a short adversarial suffix that forces the draft model to generate tokens the target model is highly unlikely to accept. This "acceptance collapse" converts the lossless acceleration path into repeated wasted computation, drastically increasing latency and serving costs without necessarily degrading the semantic quality of the final output, thereby evading standard quality monitors.

Methodology: ADSD

The paper introduces ADSD (Adversarial Decoding for Speculative Decoding), a prompt-suffix attack designed to maximize verifier rejection while maintaining task performance. The method operates under a white-box threat model where the attacker has offline access to the draft distribution ( $q$ ), the target distribution ( $p$ ), and the verification logic.

Core Components

Soft-Collapse Objective (SC):
The authors derive a surrogate objective based on the asymmetric nature of the speculative acceptance rule: $\alpha(v) = \min(1, p(v)/q(v))$ . Rejection pressure only occurs when the draft is overconfident ( $q(v) > p(v)$ ). The Soft-Collapse objective, defined as $SC(q, p) = \sum_v q(v) \cdot \text{ReLU}(\log q(v) - \log p(v))$ , specifically targets these positive log-margins. It pushes the draft probability mass toward tokens where the verifier is most likely to reject, effectively collapsing the acceptance rate.
Target Semantics Preservation (KL):
To ensure the attack remains stealthy (i.e., the final answer remains useful), ADSD includes a forward KL divergence penalty: $KL(p^0 \parallel p^u)$ . This term anchors the target model's distribution under the adversarial suffix ( $p^u$ ) to its distribution under a benign prompt ( $p^0$ ). This prevents the attack from simply corrupting the output into gibberish, which would be easily detected.
Discrete Prompt Search:
Since the adversarial suffix consists of discrete tokens, ADSD employs a gradient-guided sequential beam search. The algorithm iteratively sweeps through suffix positions, computing gradients with respect to token embeddings to identify top- $k$ substitutions that maximize the combined objective (maximizing SC while minimizing KL).

Key Results

The authors evaluated ADSD on the GSM8K dataset using various model architectures (Qwen2.5, LLaMA-3) and speculative strategies (Tokenwise, Blockwise, Hierarchical Speculative Decoding).

Performance Degradation: On GSM8K, the attack increased the mean sample time from 26.05s to 42.29s (+62.3%).
Efficiency Collapse: The block efficiency (average accepted tokens per block) dropped from 6.028 to 3.683 (-38.9%), and decoding speed decreased by 36.1%.
Stealth: Despite the massive latency increase, the task accuracy remained largely preserved (dropping only from 0.821 to 0.802), demonstrating that the attack successfully decouples operational cost from semantic correctness.
Generalizability:
- Architectures: The attack was effective across different draft-target pairs (e.g., Qwen 14B→0.5B, LLaMA-3 70B→8B) and specialized architectures like EAGLE-3 (where efficiency dropped by 76.9%).
- Strategies: It successfully bypassed advanced decoding strategies like Blockwise and Hierarchical Speculative Decoding (HSD), causing similar latency spikes (+64.8% and +66.1% respectively).
- Transferability: A suffix optimized on GSM8K transferred to other domains, causing a 141.8% latency increase on HumanEval (code generation) and a 30.4% increase on CNN/DailyMail (summarization), though with varying degrees of impact on task quality.

Significance and Claims

The paper claims to be the first work to study vulnerabilities in the internal acceptance mechanism of speculative decoding via prompt-induced attacks. Its primary contributions are:

Novel Threat Vector: It identifies "prompt-induced verifier collapse" as a distinct risk from conventional safety failures or output-length inflation attacks. The attack exploits the draft-target distributional mismatch rather than the model's safety alignment.
Mechanism-Specific Attack: Unlike attacks that target the serving stack or guardrails, ADSD targets the core algorithmic logic of speculative decoding itself.
Operational Vulnerability: The results demonstrate that "lossless" semantic guarantees do not imply "lossless" operational cost robustness. An attacker can transform a cost-saving acceleration technique into a denial-of-wallet vector, inflating the real cost of inference requests.
Defense Implications: The authors note that standard defenses (perplexity filtering, output screening) are insufficient because the attack is short, diluted within benign context, and the final output may remain semantically correct even as internal efficiency collapses. They suggest that online acceptance-rate monitoring may be a necessary mitigation, though this is left for future work.

In summary, the paper argues that the reliance on draft-target alignment in speculative decoding creates a systemic fragility that can be weaponized to degrade service availability and increase costs without triggering standard safety or quality alarms.