Paper deep dive
Secure Speculative Decoding for Large Language Models
Yichi Zhang, Zhiqi Wang, Neil Gong, Yuchen Yang
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Speculative decoding accelerates inference for a large language model (LLM), referred to as the \emph{target model}, by first using a smaller model, referred to as the \emph{draft model}, to generate candidate tokens and then verifying them with the target model for acceptance or rejection. Prior studies primarily focused on the efficiency-utility trade-off of speculative decoding, e.g., lossy speculative decoding, leaving its security implications largely unexplored. In this work, we bridge this gap by providing the \emph{first} systematic study of the security implications of speculative decoding. Through a large-scale measurement study, we reveal a pronounced security-utility asymmetry: across a wide range of lossy speculative decoding methods, improvements in inference efficiency come at a disproportionately high cost to security, with attack success rates for jailbreak and prompt injection attacks increasing much faster than utility degrades. We then propose SecureSD, a new theory-guided speculative decoding method that enhances security while maintaining efficiency and utility. Specifically, our theoretical analysis reveals that security degradation primarily originates from the early tokens generated by the draft model. Motivated by this insight, SecureSD applies a stricter verification criterion to draft-model tokens at early decoding positions. Extensive experiments on both security and utility benchmarks demonstrate that SecureSD significantly improves security while preserving efficiency and utility compared to existing speculative decoding methods.
Tags
Links
- Source: https://arxiv.org/abs/2610.08678v1
- Canonical: https://arxiv.org/abs/2610.08678v1
Trouble viewing inline? Open PDF directly →
Full Text
102,369 characters extracted from source content.
Expand or collapse full text
Secure Speculative Decoding for Large Language Models Yichi Zhang Affiliation: The Pennsylvania State University Zhiqi Wang Affiliation: The Pennsylvania State University Neil Zhenqiang Gong Affiliation: Duke Universityyichi.zhang, zhiqi.wang, yuchen.yang@psu.edu, neil.gong@duke.edu Yuchen Yang Affiliation: The Pennsylvania State University Abstract Speculative decoding accelerates inference for a large language model (LLM), referred to as the target model, by first using a smaller model, referred to as the draft model, to generate candidate tokens and then verifying them with the target model for acceptance or rejection. Prior studies primarily focused on the efficiency-utility trade-off of speculative decoding, e.g., lossy speculative decoding, leaving its security implications largely unexplored. In this work, we bridge this gap by providing the first systematic study of the security implications of speculative decoding. Through a large-scale measurement study, we reveal a pronounced security-utility asymmetry: across a wide range of lossy speculative decoding methods, improvements in inference efficiency come at a disproportionately high cost to security, with attack success rates for jailbreak and prompt injection attacks increasing much faster than utility degrades. We then propose SecureSD, a new theory-guided speculative decoding method that enhances security while maintaining efficiency and utility. Specifically, our theoretical analysis reveals that security degradation primarily originates from the early tokens generated by the draft model. Motivated by this insight, SecureSD applies a stricter verification criterion to draft-model tokens at early decoding positions. Extensive experiments on both security and utility benchmarks demonstrate that SecureSD significantly improves security while preserving efficiency and utility compared to existing speculative decoding methods.11 1 The code and benchmarks for SecureSD are publicly available at https://github.com/YichiCS/Secure-Speculative-Decoding. I Introduction As LLMs are increasingly deployed in interactive applications, autoregressive decoding has become a major latency bottleneck because each output token typically requires a separate forward pass through a large model. As shown in Algorithm 1, speculative decoding addresses this bottleneck by using a smaller draft model to quickly generate candidate tokens for a larger LLM, referred to as the target model; the target model then verifies these candidates in parallel and either accepts them or rejects them before continuing generation [1, 2]. By accepting multiple tokens in a single decoding step, speculative decoding can substantially reduce decoding latency. This technique has moved beyond research prototypes: Google reports applying speculative decoding in multiple products, including AI Overviews in Google Search [3] and Gemma 4 models [4]. Production-oriented serving stacks such as vLLM [5], NVIDIA Triton/TensorRT-LLM [6], Hugging Face Inference [7], and SGLang [8] also provide built-in speculative decoding support. Existing work on speculative decoding has mainly focused on improving inference efficiency while preserving utility. Recent methods increase speedup by improving draft models [9, 10, 11, 12, 13], using richer proposal structures [14, 15, 16, 17], or adopting lossy verification strategies [18, 19, 20, 21] that accept more draft tokens per decoding step. Some methods further relax the verification criterion [22, 23, 24, 25, 26], explicitly trading exact target-model behavior for higher throughput. However, these methods are still primarily evaluated through the efficiency–utility trade-off, using metrics such as speedup, average acceptance length, perplexity, task accuracy, or human preference. To the best of our knowledge, the safety and security implications of efficiency-oriented speculative decoding under adversarial inputs have not been systematically studied. This gap matters because relaxed verification may accept draft tokens that the target model would otherwise reject. In safety settings, e.g., jailbreak [27, 28, 29, 30], and security settings, e.g., prompt injection [31], such early deviations can steer the response from refusal toward compliance, causing safety and security risks that remain invisible to utility benchmarks. For simplicity, we use security to refer to both throughout the introduction. In this paper, we bridge this gap by providing the first systematic study of the security implications of lossy speculative decoding. Across a range of speculative decoding methods, making token acceptance more aggressive improves inference efficiency with only modest degradation on standard utility benchmarks, but causes a disproportionately large increase in attack success rates on security benchmarks. In particular, jailbreak and prompt injection attacks become much more successful even when task accuracy, output quality, or other utility metrics remain relatively stable. This shows that security degradation is not simply another form of utility degradation: lossy speculative decoding can introduce small changes in the generation trajectory that are largely tolerated by general-purpose benchmarks but have much larger effects on security-critical behavior. To understand this asymmetry, we analyze how accepted draft tokens affect autoregressive generation. Our analysis shows that security degradation depends on two dimensions: (i) how far the accepted tokens deviate from the target model’s original distribution, and (i) at which token position these deviations occur in the output sequence. In particular, draft tokens accepted at early decoding positions have a disproportionate effect because they set the initial direction of the response. For adversarial prompts, an early deviation can shift generation from refusal toward compliance. This positional sensitivity explains why security can degrade much faster than utility. Motivated by this insight, we propose SecureSD, a theory-guided and position-aware speculative decoding method that applies stricter verification to early draft tokens while retaining efficient verification later in the generation process. By correcting only the positions most responsible for security degradation, SecureSD avoids unnecessary verification overhead across the full response. Experiments on five utility and security benchmarks show that SecureSD reduces attack success rates of jailbreak and prompt injection attacks by up to 92.4%, while retaining 99.8% of the decoding speedup and keeping utility within 98.4% of existing speculative decoding methods. Ablation studies further confirm that focusing verification on early positions is key to improving the security–utility–efficiency trade-off. Contribution We make the following contributions: ∙ We provide the first systematic study of the security implications of lossy speculative decoding, revealing a strong security–utility asymmetry: attack success rates rise much faster than utility degrades. ∙ We explain this asymmetry through theoretical and empirical analysis, showing that early draft tokens play an important role in security degradation. ∙ We propose SecureSD, a theory-guided, position-aware speculative decoding method that improves security while preserving efficiency and utility. I Related Work Algorithm 1 Vanilla Speculative Decoding Input: Draft model p, target model q, prefix x1:tx_1:t, speculation length k Output: Tokens sampled from speculative decoding 1 for i=1i=1 to k do 2 pi←p(⋅∣x1:t,x~1:i−1)p_i← p(· x_1:t, x_1:i-1); 3 x~i∼pi x_i p_i; 4 qii=1k+1←TargetForward(x1:t,x~1:k)\q_i\_i=1^k+1← TargetForward(x_1:t, x_1:k); 5 for i=1i=1 to k do 6 r∼(0,1)r (0,1); 7 if r≤min1,qi(x~i)/pi(x~i)r≤ \1,\,q_i( x_i)/p_i( x_i)\ then 8 xt+i←x~ix_t+i← x_i; 9 else 10 xt+i∼(qi−pi)+∑x(qi(x)−pi(x))+x_t+i (q_i-p_i)_+ _x(q_i(x)-p_i(x))_+; 11 return xt+1,…,xt+ix_t+1,…,x_t+i; 12 xt+k+1∼qk+1x_t+k+1 q_k+1; 13 return xt+1,…,xt+k+1x_t+1,…,x_t+k+1; I-A Speculative Decoding Speculative decoding [2, 1] accelerates LLM generation by using a small draft model to propose candidate tokens and a larger target model to verify them in parallel, reducing expensive target-model computation while strictly preserving the target model’s behavior. As shown in Algorithm 1, each decoding round proceeds in two phases: the draft model first autoregressively proposes k candidate tokens, and the target model then computes their probabilities in a single parallel forward pass. Each candidate x~i x_i is accepted with probability min1,qi(x~i)/pi(x~i) \1,\,q_i( x_i)/p_i( x_i)\; upon the first rejection, a replacement token is sampled from the normalized residual distribution (qi−pi)+(q_i-p_i)_+ and the round terminates. If all k candidates pass, one extra token is sampled from qk+1q_k+1, so each round commits between 11 and k+1k+1 tokens whose distribution provably matches sampling from the target model directly. Recent works [22, 23, 24, 25, 26] further improve efficiency by relaxing the verification step. Instead of strictly preserving the target distribution, these methods accept more draft tokens when they appear sufficiently close to what the target model would have produced. This increases the acceptance rate and decoding speed with a small distributional shift from the original target model. Specifically, LossySD [1] relaxes the verification rule, allowing more draft tokens to pass verification under a controlled approximation. BiLD [22] uses model confidence to decide when to continue relying on the draft model and when to roll back to the target model. SpecCascade [23] formulates verification as a cascade decision, determining when the system can trust the draft model and when it should defer to the target model. FSD [24] is designed to accept a draft token when the draft and target distributions are sufficiently similar. FLy [25] uses uncertainty in the target distribution as a signal for relaxation, permitting more relaxation when the target model is confident enough. MARS [26] relies on the structure of the target model’s logits to determine whether a draft token is consistent with the target model’s predictions. However, these works mainly focus on optimizing the efficiency–utility trade-off, leaving unclear how the distributional shifts introduced by relaxed verification affect security. We bridge this research gap in this paper. I-B Attacks on LLMs Jailbreak Attacks Jailbreak attacks are designed to guide LLMs to circumvent their safety rules and respond to queries that would otherwise be refused. Malicious users can craft natural-language prompts that reframe harmful requests through roleplay, fictional scenarios, or privilege escalation, such as “Do-Anything-Now” prompts [32], “developer mode” prompts, and character-roleplay prompts [33]. More recent work formalizes these methods through persuasion [34], highlighting that LLMs are vulnerable to natural language prompting techniques. Another line of jailbreak work relies on adaptive prompt-crafting algorithms [27, 35, 36, 37] that use feedback from the target model. AutoDAN [35] optimizes human-crafted jailbreak prompts with a genetic algorithm by iteratively querying the target LLM and improving the prompt. Greedy Coordinate Gradient (GCG) [27] optimizes an adversarial suffix to increase the likelihood of a compliant response from the target model, making it an iterative attack. Prompt Injection Attacks Prompt injection attacks target the instruction-following behavior of LLM-integrated applications. In these attacks, an adversary supplies additional instructions that conflict with the intended task or higher-level system instructions [38, 39, 31, 40]. Earlier work studies direct prompt injection [39], where a user attempts to override the high-level instructions of an LLM-based application with commands such as “ignore previous instructions.” Later work shows that malicious instructions can also be planted in external sources, such as webpages, documents, or tool outputs, and then hijack a session between the benign user and LLM-based agents. This setting is known as indirect prompt injection [31, 40, 38]. Liu et al. [31] formalize in-the-wild prompt injection techniques into a unified framework and show that combining existing techniques improves attack success rates. Adaptive or automatic jailbreak algorithms [27, 37] can also be used to generate successful prompt injection prompts. In this paper, we use jailbreak and prompt injection benchmarks to quantify the underexplored security–utility asymmetry introduced by relaxed speculative decoding: utility can remain largely stable while security degrades rapidly relative to the target model’s security performance. I Threat Model System Model We consider a realistic deployment scenario in which the LLM infrastructure integrates speculative decoding with relaxed verification for further speedup. The system uses a large target model to generate responses and a cheaper draft model to propose candidate tokens. For the same input X, we compare the output of an LLM system with relaxed speculative decoding against that of an otherwise identical system with vanilla (i.e., lossless) speculative decoding. Our goal is to measure how relaxed verification changes the system’s behavior relative to the vanilla baseline, and how much target-model performance it retains, treating the target model as the upper bound. We focus on lossy speculative decoding systems that use relaxed verification to trade exact target-model behavior for throughput. Mainstream serving frameworks, including vLLM, NVIDIA TensorRT-LLM, and SGLang, support this setting [5, 6, 8]. We quantify relaxation by acceptance rate (AR) and evaluate its practical regime in Section IV. Attacker’s Objectives We use adversarial objectives to define the safety and security stress-test setting. For a given query X, it produces an incorrect or unintended response Y. We primarily consider two attack scenarios. ∙ Jailbreak Attacks. The attacker carefully crafts a query X to induce the LLM system to generate responses Y that violate human values or established safety policies. ∙ Prompt Injection Attacks. The attacker carefully crafts a query X to manipulate the LLM system such that it produces an unintended response Y or causes a downstream application to execute potentially harmful actions Y. Attacker’s Capabilities We assume a black-box threat model in which the attacker can interact with the LLM system only through its public API. Specifically, the attacker can issue queries to an LLM system that employs relaxed speculative decoding and observe the generated responses. Attacker’s Knowledge We assume that the attacker possesses partial knowledge of the target model, such as the target LLM’s family or type (e.g., GPT-5.5). However, we do not assume knowledge of the exact relaxed speculative decoding configuration, including the draft model, verification rule, relaxation threshold, or decoding randomness. Since the same inputs are evaluated under the target model with and without relaxed speculative decoding, the measured security gap reflects the effect of relaxed verification rather than an exploitation of internal implementation details. TABLE I: Average performance retention rate (PRR) and speedup (SPD) of lossless and six lossy speculative decoding methods across security and utility benchmarks. For each speculative decoding method, we sweep its method-specific hyperparameters θ to obtain different ARs. We then report the average PRR and SPD as a function of AR. We also report the PRR and SPD of lossless speculative decoding for comparison with the average performance of lossy speculative decoding. Relaxed Verifier Model Family Safety/Security Benchmarks Utility Benchmarks Jailbreak-SD OpenPromptInjection HumanEval GSM8K PRR↑ SPD↑ PRR↑ SPD↑ PRR↑ SPD↑ PRR↑ SPD↑ LossySD [1] Qwen3-0.6B/8B .708 1.68 .657 1.56 .834 1.89 .925 1.91 Llama3-1B/8B .693 1.84 .763 1.70 .803 1.96 .878 2.03 BiLD [22] Qwen3-0.6B/8B .674 1.50 .664 1.35 .856 1.63 .945 1.74 Llama3-1B/8B .568 1.59 .718 1.46 .748 1.73 .903 1.71 SpecCascade [23] Qwen3-0.6B/8B .566 1.60 .553 1.45 .771 1.79 .831 1.83 Llama3-1B/8B .651 1.76 .720 1.58 .781 1.87 .855 1.90 FSD [24] Qwen3-0.6B/8B .927 1.60 .759 1.56 .865 1.58 .940 1.59 Llama3-1B/8B .610 1.85 .734 1.76 .850 1.64 .945 1.50 FLy [25] Qwen3-0.6B/8B .826 1.71 .694 1.58 .935 1.91 .951 1.96 Llama3-1B/8B .752 1.90 .752 1.79 .839 1.98 .915 2.06 MARS [26] Qwen3-0.6B/8B .993 1.13 .872 1.13 .985 1.78 .998 1.86 Llama3-1B/8B .817 1.48 .845 1.46 .863 1.91 .996 1.88 Average Lossy SD Qwen3-0.6B/8B .782 1.54 .700 1.44 .874 1.76 .932 1.82 Llama3-1B/8B .682 1.74 .755 1.63 .814 1.85 .915 1.85 Lossless SD Qwen3-0.6B/8B 1.019 1.05 .915 1.06 .947 1.65 1.000 1.81 Llama3-1B/8B .909 1.33 .983 1.36 .933 1.85 .976 1.76 IV Measurement: Security–Utility Asymmetry We begin with a measurement study of how speculative decoding affects security performance as the token acceptance strategy becomes more aggressive. IV-A Preliminaries on Speculative Decoding Speculative decoding methods share the same high-level draft-then-verify paradigm, but they differ in how the verifier decides whether to accept a proposed draft token and how generation proceeds after rejection. To compare these methods under a common framework, we first define a unified verifier abstraction. Definition 1 (Speculative Decoding Verifier). A speculative decoding verifier can be represented as S(q,p,α,R)S(q,p,α,R), where the system operates over a sequence of draft positions and sequentially decides whether to accept or reject each draft token. At position t, conditioned on the current prefix x<tx_<t, the target model and the draft model define the following conditional distributions: qt(x) q_t(x) =q(xt=x∣x<t), =q(x_t=x x_<t), (1) pt(x) p_t(x) =p(xt=x∣x<t). =p(x_t=x x_<t). (2) Here, qtq_t specifies the target distribution that the decoding procedure aims to preserve, while ptp_t specifies the draft distribution for efficient token generation. Given a draft token x at position t, the system applies an acceptance function αt(x):→[0,1], _t(x):V→[0,1], (3) which determines the probability with which the proposed token is accepted under the current prefix. If the proposed token is rejected, the system samples a replacement token from a recovery distribution Rt(x) R_t(x) =R(xt=x∣x<t). =R(x_t=x x_<t). (4) Here, RtR_t specifies the distribution used to recover from rejection and continue generation. This verifier definition can be broadly applied to current frameworks such as LossySD [1], BiLD [22], SpecCascade [23], FSD [24], FLy [25], and MARS [26]. We show how a speculative decoding method can be characterized by these four parameters in Table I. Tuning the hyperparameters of this method allows us to modulate the aggressiveness of the corresponding token-acceptance strategies. Fig. 1: Security–Utility Asymmetry under Speculative Decoding. The left panel shows the PRR-AR curves of six speculative decoding methods on four benchmarks. The right panel shows the trade-off between PRR and SPD. The separation between the curves and scatter points for security and utility tasks reveals the security–utility asymmetry. IV-B Experimental Setup Benchmarks We evaluate the system on utility, safety, and security benchmarks. For utility evaluation, we use two benchmarks commonly adopted in speculative decoding studies: 164 Python programming problems from HumanEval [41] to assess code generation, and 200 problems sampled from GSM8K [42] to assess mathematical reasoning. We consider jailbreak for safety settings and prompt injection for security settings. For jailbreak evaluation, we construct a benchmark named Jailbreak-SD of 200 examples from four widely used datasets: WildJailbreak [28], JailbreakBench [29], HarmBench [30], and AdvBench [27]. For prompt injection, we use OpenPromptInjection [31] to evaluate general prompt injection attacks. We sample two instructions from different sources across seven task datasets and combine them using five attack strategies, resulting in a benchmark of 200 samples, with 40 samples for each attack strategy. We also conduct a full evaluation on AgentDojo [43] to assess more realistic prompt injection scenarios in long-context tasks. TABLE I: Instantiation of relaxed verifiers. We instantiate six speculative decoding methods with relaxed verification under Definition 1. Method qtq_t ptp_t αt(x) _t(x) RtR_t LossySD [1] qtq_t ptp_t min1,qt(x)/pt(x)+ϵ \1,q_t(x)/p_t(x)+ε\ ρt(qt,x) _t(q_t;x)1 BiLD [22] qtq_t ptp_t [maxvpt(v)≥fb]1[ _vp_t(v) ] ⋅[qt(x)≥e−rb∨x=x^t]·1[q_t(x)≥ e^-rb x= x_t] δx^t _ x_t SpecCascade [23] πtr _t^r ptp_t min1,πtr(x)/pt(x) \1, _t^r(x)/p_t(x)\ ρt(πtr,x) _t( _t^r;x) FSD [24] qtq_t ptp_t [Dr(qt∥pt)≤τ]1[D_r(q_t\|p_t)≤τ] qtq_t FLy [25] qtq_t ptp_t [x=x^t]1[x= x_t] ∨[H~(qt)≥θ∧¬wintW] 1[ H(q_t)≥θ ^W_t] qtq_t MARS [26] qtq_t ptp_t [x=x^t]1[x= x_t] ∨[x=top-2(qt)∧z2/z1>τ] 1[x=top -2(q_t) z_2/z_1>τ] δx^t _ x_t 1 ρt(μ,x)=(μ(x)−pt(x))+/∑v(μ(v)−pt(v))+ _t(μ;x)=(μ(x)-p_t(x))_+/ _v(μ(v)-p_t(v))_+ denotes the positive-residual recovery distribution, where (f)+=maxf,0(f)_+= \f,0\. Metrics We evaluate speculative decoding using three metrics that capture its efficiency, utility, and security. ∙ Acceptance Rate (AR). AR measures acceptance aggressiveness as the fraction of draft tokens accepted. We sweep the method-specific hyperparameters in Table I to obtain AR values from conservative verification to aggressive acceptance, forming an approximately continuous scale between 0 and 1. ∙ Performance Retention Rate (PRR). To compare target-model performance retention across tasks with different score scales, we orient all raw scores so that higher is better: Pass@1 for HumanEval, Accuracy for GSM8K, attack failure rate (AFR) for Jailbreak-SD and OpenPromptInjection, and utility under attack (UUA) for AgentDojo. We use the official evaluators to compute Pass@1, Accuracy, and UUA. For AFR, we follow the StrongREJECT [44] setting and use GPT-4o-mini as an LLM-as-a-judge [45] to determine whether the attack succeeds. Let x be the raw score of a certain speculative decoding method, and let xtargetx_target and xdraftx_draft be the raw scores of the target and draft models under standard decoding. We define PRR=x−xdraftxtarget−xdraft, = x-x_draftx_target-x_draft, (5) which measures the fraction of the target performance retained by speculative decoding: PRR=0PRR=0 matches the draft model, and PRR=1PRR=1 matches the target model. We also report raw scores for direct interpretation in Table I. ∙ Inference Speedup (SPD). SPD is the ratio between the wall-clock decoding time of the target model under standard decoding and that of speculative decoding. Larger values indicate faster inference, e.g., SPD=2SPD=2 means that speculative decoding achieves a 2×2× speedup against standard autoregressive decoding of the target model. Speculative Decoding Methods We consider the lossless method and six lossy speculative decoding methods: LossySD [1], BiLD [22], FLy [25], FSD [24], MARS [26], and SpecCascade [23]. We use a default speculation length of k=5k=5, meaning that the draft model proposes five candidate tokens at each decoding step. Unless otherwise specified, we use a generation batch size of 32 and set the decoding temperature to 0, corresponding to greedy decoding. These are widely adopted default settings. For notational simplicity, we use θ to abstractly denote the tunable hyperparameters of each speculative decoding method. Models We evaluate four draft-target model pairs. We pair Qwen3-0.6B (i.e., draft model) with Qwen3-8B and Qwen3-32B as target models, and Llama-3.2-1B-Instruct (i.e., draft model) with Llama-3.1-8B-Instruct and Llama-3.3-70B-Instruct as target models. We report the standard evaluation metrics of these models on the four benchmarks in Table I, and use these results to compute PRR in the subsequent sections. TABLE I: Raw Model Performance. We report the task performance of four models across five benchmarks, highlighting the performance gap between the draft and target models. We use these results to compute PRR. Task (Metric) Qwen3 Llama3 0.6B 8B 1B 8B Jailbreak-SD (AFR↑ ) .195 .895 .105 .915 OpenPromptInjection (AFR↑ ) .030 .820 .060 .830 AgentDojo (UUA↑ ) .078 .264 – – HumanEval (Pass@1↑ ) .396 .854 .427 .701 GSM8K (Accuracy↑ ) .500 .930 .410 .820 Environment All experiments are conducted on a server equipped with an AMD EPYC 9334 32-Core Processor running Ubuntu 22.04.5 LTS, with four NVIDIA RTX PRO 6000 Blackwell Workstation Edition GPUs. IV-C Security Degrades Faster than Utility Lower Security Performance Retention We first investigate how lossy speculative decoding affects security and utility benchmarks across a broad range of verifier settings. Table I reports the PRR and SPD of different lossy speculative decoding methods, averaged over hyperparameter sweeps that span diverse ARs. We have two observations: ∙ Lossy speculative decoding retains lower PRR on security benchmarks than on utility benchmarks. For Qwen3-0.6B/8B, the average PRR is 0.744 on the two security benchmarks, Jailbreak and Prompt Injection, compared with 0.905 on the two utility benchmarks, HumanEval and GSM8K. The same trend holds for Llama3-1B/8B, with average PRRs of 0.719 on security benchmarks and 0.866 on utility benchmarks. ∙ The lower PRR on security benchmarks does not come with a higher SPD. For Qwen3-0.6B/8B, lossy speculative decoding achieves only 1.49× average SPD on security benchmarks, compared with 1.79× on utility benchmarks. For Llama3-1B/8B, the average SPD is 1.69× on security benchmarks and 1.85× on utility benchmarks. Therefore, security benchmarks suffer larger performance degradation, but do not receive higher SPD in return. Earlier Security Degradation We next measure how fast security and utility performance degrade as the verifier accepts more draft tokens, i.e., with a higher AR. Figure 1 shows how the PRR varies with the AR on utility and security benchmarks. Moving right along a curve corresponds to a more aggressive acceptance strategy with higher SPD, but the generated sequence may deviate further from the target model’s original behavior. We have two observations: ∙ Security PRR is lower at comparable ARs. PRR decreases as the AR increases on both utility and security benchmarks, indicating that a more aggressive relaxed verifier introduces greater behavioral deviation from the target model. However, this degradation is consistently larger for security tasks. Under the same verifier and at comparable ARs, security benchmarks retain substantially less target model performance than utility benchmarks. ∙ Security PRR drops much earlier. Security degradation also begins at lower ARs. For several methods, utility PRR on GSM8K and HumanEval remains close to the baseline until the verifier becomes highly aggressive, e.g., at ARs around 0.7. In contrast, security PRR often starts to decline at much lower ARs, e.g., around 0.3. These observations show that speculative decoding with relaxed verifiers can weaken jailbreak or prompt injection defenses even when performance on general utility benchmarks shows only limited degradation. Practical Operating Regime Compared with lossless SD, lossy SD raises average SPD from 1.05×1.05× to 1.49×1.49× on Qwen and from 1.35×1.35× to 1.69×1.69× on Llama. Combined with the thresholds above, AR∈[0.3,0.7]AR∈[0.3,0.7] identifies the regime where additional speedup is meaningful and safety/security degradation has emerged. Takeaway 1. Lossy speculative decoding exhibits a security–utility asymmetry: at comparable ARs, it can preserve utility while incurring earlier and sharper degradation on security. These results suggest that efficiency–utility evaluation alone is insufficient for assessing speculative decoding in security-sensitive deployments. V SecureSD We now propose SecureSD, a verification correction mechanism that can be seamlessly integrated into any speculative decoding pipeline. SecureSD mitigates the performance degradation introduced by relaxed speculative decoding verifiers, particularly on security-critical tasks. V-A SecureSD Overview Algorithm 2 SecureSD Input: Relaxed verifier S with acceptance functions αii=1k\ _i\_i=1^k and recovery distributions Rii=1k+1\R_i\_i=1^k+1, prefix x1:tx_1:t, speculation length k, verification correction schedule ηjj≥1\ _j\_j≥ 1 Output: Tokens sampled under SecureSD 1 for i=1i=1 to k do 2 pi←p(⋅∣x1:t,x~1:i−1)p_i← p(· x_1:t, x_1:i-1) ; 3 x~i∼pi x_i p_i ; 4 qii=1k+1←TargetForward(x1:t,x~1:k)\q_i\_i=1^k+1← TargetForward(x_1:t, x_1:k) ; 5 for i=1i=1 to k do 6 αisd←min,qi/pi _i^sd← \1,\,q_i/p_i\ ; 7 Risd←(qi−pi)+∑x(qi(x)−pi(x))+R_i^sd← (q_i-p_i)_+ _x(q_i(x)-p_i(x))_+ ; 8 αiη←(1−ηt+i)αisd+ηt+iαi _i^η←(1- _t+i) _i^sd+ _t+i _i ; 9 r∼(0,1)r (0,1) ; 10 if r≤αiη(x~i)r≤ _i^η( x_i) then 11 xt+i←x~ix_t+i← x_i ; 12 else 13 Riη←(1−ηt+i)Risd+ηt+iRiR_i^η←(1- _t+i)R_i^sd+ _t+iR_i ; 14 xt+i∼Riηx_t+i R_i^η ; 15 return xt+1,…,xt+ix_t+1,…,x_t+i ; 16 Rk+1η←(1−ηt+k+1)qk+1+ηt+k+1Rk+1R_k+1^η←(1- _t+k+1)q_k+1+ _t+k+1R_k+1 ; 17 xt+k+1∼Rk+1ηx_t+k+1 R_k+1^η ; 18 return xt+1,…,xt+k+1x_t+1,…,x_t+k+1 ; Algorithm 2 presents SecureSD, a speculative decoding algorithm that incorporates verification correction. The algorithm is formulated as a single-step procedure, and the complete decoding process can be constructed by invoking it repeatedly. The input consists of a relaxed verifier S, the current prefix x1:tx_1:t, a speculation length k, and a verification correction schedule ηjj≥1\ _j\_j≥ 1. The verifier S exposes acceptance functions αii=1k\ _i\_i=1^k and recovery distributions Rii=1k+1\R_i\_i=1^k+1. The key idea of SecureSD is to use a correction schedule to augment the relaxed verifier with a lossless reference path induced by the standard verifier. We provide both theoretical and empirical analysis of this design in Section VI. Draft Generation and Scoring (Lines 2–2) Given the prefix x1:tx_1:t, the draft model first generates k speculative tokens autoregressively. At speculative position i, it forms the draft distribution pi=p(⋅∣x1:t,x~1:i−1), p_i=p(· x_1:t, x_1:i-1), (6) and samples x~i∼pi x_i p_i (Lines 2–2). These tokens are tentative and are not committed to the output sequence until they pass verification. The target model is then applied in a single forward pass to the concatenation of the current prefix and the speculative draft tokens, yielding target distributions qii=1k+1\q_i\_i=1^k+1 for the k speculative positions and the subsequent extra-token position (Line 2). This single target forward pass preserves the parallelization benefit of speculative decoding. Lossless Reference of the Standard Verifier (Lines 2–2) For each token position, SecureSD constructs the lossless reference of the standard verifier [1]. The acceptance rule is αisd=min,qi/pi, _i^sd= \1,q_i/p_i\, (7) and the corresponding recovery distribution is Risd=(qi−pi)+∑x(qi(x)−pi(x))+. R_i^sd= (q_i-p_i)_+ _x(q_i(x)-p_i(x))_+. (8) Both of these ensure that speculative decoding remains distributionally lossless. Verification Correction (Lines 2–2) SecureSD interpolates the standard and relaxed verifiers at each token position. The mixed acceptance probability is defined as αiη=(1−ηt+i)αisd+ηt+iαi. _i^η=(1- _t+i) _i^sd+ _t+i _i. (9) The proposed draft token x~i x_i is accepted if a uniform random variable r∼(0,1)r (0,1) is no larger than αiη(x~i) _i^η( x_i) (Lines 2–2). Upon acceptance, the algorithm sets xt+i←x~ix_t+i← x_i. If the token is rejected, verification stops immediately. The algorithm then constructs a mixed recovery distribution at the rejected position: Riη=(1−ηt+i)Risd+ηt+iRi, R_i^η=(1- _t+i)R_i^sd+ _t+iR_i, (10) samples xt+i∼Riηx_t+i R_i^η, and returns the accepted prefix together with this recovery token, as shown in Lines 2–2. This left-to-right stopping rule preserves the causal structure of autoregressive decoding, since all draft tokens after a rejection depend on a token that has not been accepted. If all k draft tokens are accepted, SecureSD constructs the sampling distribution for the next position by interpolating between the target distribution qk+1q_k+1 and the relaxed verifier’s recovery distribution Rk+1R_k+1: Rk+1η=(1−ηt+k+1)qk+1+ηt+k+1Rk+1. R_k+1^η=(1- _t+k+1)q_k+1+ _t+k+1R_k+1. (11) It then samples the extra token xt+k+1∼Rk+1ηx_t+k+1 R_k+1^η and returns xt+1,…,xt+k+1x_t+1,…,x_t+k+1 (Lines 2–2). Therefore, each invocation of SecureSD advances generation by at least one token and by at most k+1k+1 tokens. V-B Verification Correction Schedule ηjj≥1\ _j\_j≥ 1 The verification correction schedule ηjj≥1\ _j\_j≥ 1 in Algorithm 2 determines how SecureSD interpolates between the standard verifier and the relaxed verifier. The index j denotes the global decoding position. When ηj=0 _j=0, the verification procedure reduces to standard speculative decoding. When ηj=1 _j=1, SecureSD recovers the relaxed verifier S and directly applies its acceptance and recovery rules. For 0<ηj<10< _j<1, SecureSD interpolates between the two verification rules, allowing it to balance distributional fidelity and decoding efficiency at each token position. Thus, ηjj≥1\ _j\_j≥ 1 determines the trajectory of the correction level. We define three correction schedules ηjj≥1\ _j\_j≥ 1, motivated by the empirical analysis in Section VI-B. (i) Step schedule. The step schedule keeps the correction level at its initial value before position L and switches directly to the final value at position L: ηstep(j)=[j>L]=0,j≤L,1,j>L. _step(j)=1[j>L]= cases0,&j≤ L,\\ 1,&j>L. cases (12) This schedule makes an abrupt transition between the two boundary correction levels at the switch position L. (i) Linear schedule. The linear schedule interpolates between the two boundary correction levels at a constant rate until the terminal value is reached: ηlinear(j)=clip(jL+1,0,1). _linear(j)=clip ( jL+1,0,1 ). (13) This schedule changes ηj _j linearly, with larger L producing a slower transition and smaller L producing a faster one. (i) Power-law schedule. The power-law schedule generalizes the linear transition with a curvature parameter γ>0γ>0: ηγ(j)=[clip(jL+1,0,1)]γ. _γ(j)= [clip ( jL+1,0,1 ) ]^γ. (14) For γ=1γ=1, the power-law schedule reduces to the linear schedule. Values γ>1γ>1 delay the transition toward later positions, while values 0<γ<10<γ<1 make it occur earlier. Takeaway 2. SecureSD uses the verification correction schedule to control how strongly each decoding position follows the standard verifier or the relaxed verifier. This behavior is determined by the correction schedule ηjj≥1\ _j\_j≥ 1, which allows SecureSD to balance utility and efficiency without changing the verifier itself. VI Why SecureSD Works: Analysis This section provides theoretical and empirical analyses of how SecureSD mitigates performance degradation under lossy speculative decoding. The theoretical analysis characterizes the task-agnostic performance-retention benefit of verifier correction, while the empirical analysis identifies the greater early-position sensitivity of security metrics. This distinction explains why SecureSD applies stronger correction to early tokens on security tasks. VI-A Theoretical Analysis of SecureSD Output Distribution A speculative decoding step at position t proceeds as follows. Conditioned on the prefix x<tx_<t, the draft model first proposes a token x~t∼pt x_t p_t. The proposed token is then accepted with probability αt(x~t) _t( x_t). If it is accepted, the system sets xt=x~tx_t= x_t; otherwise, the system samples a replacement token from the recovery distribution xt∼Rtx_t R_t. Equivalently, the one-step transition of the system can be written as xt=x~t,with probability αt(x~t),x^t,x^t∼Rt,with probability 1−αt(x~t). x_t= cases x_t,&with probability _t( x_t),\\ x_t,\ x_t R_t,&with probability 1- _t( x_t). cases (15) Through this definition, we can derive the output distribution of speculative decoding with the relaxed verifier. Theorem 1 (Output Distribution of Relaxed Verifiers). Fix a prefix x<tx_<t and consider a relaxed speculative decoding verifier S(q,p,α,R)S(q,p,α,R). Let q~t q_t denote the output distribution induced by one decoding step of S, i.e., q~t(x)≜PrS(xt=x∣x<t). q_t(x) _S(x_t=x x_<t). (16) Then, for every token x∈x , q~t(x) q_t(x) is given by q~t(x)=pt(x)αt(x)+(1−u∼pt[αt(u)])Rt(x). q_t(x)=p_t(x) _t(x)+ (1-E_u p_t[ _t(u)] )R_t(x). (17) The proof is provided in Appendix A-A. Corollary 1 (Output Distribution of Standard SD). For a fixed prefix x<tx_<t, consider the standard SD verifier with acceptance function and recovery distribution defined as αtsd(x) _t^sd(x) =min(1,qt(x)pt(x)), = (1, q_t(x)p_t(x) ), (18) Rtsd(x) R_t^sd(x) =(qt(x)−pt(x))+∑u∈(qt(u)−pt(u))+, = (q_t(x)-p_t(x))_+ _u (q_t(u)-p_t(u))_+, (19) where (f)+=max(0,f)(f)_+= (0,f). Then the one-step output distribution induced by the verifier matches the target distribution: q~tsd(x)=qt(x),∀x∈. q_t^sd(x)=q_t(x), ∀ x . (20) The proof is provided in Appendix A-B. Corollary 1 establishes that the standard verifier is a zero-deviation baseline for the subsequent analysis. Distributional Deviation We then measure the one-step distortion of a relaxed verifier by the total variation distance TV(q~t,qt)TV( q_t,q_t) between its output q~t q_t and the target qtq_t. The following theorem decomposes TV(q~t,qt)TV( q_t,q_t) into two sources corresponding to the two design choices of the verifier. Theorem 2 (Decomposition of Distributional Deviation). For any relaxed verifier S(q,p,α,R)S(q,p,α,R) at draft position t, define the pointwise acceptance deviation δt(x)≜αt(x)−αtsd(x) _t(x) _t(x)- _t^sd(x). It follows that TV(q~t,qt) ( q_t,q_t) ≤x∼pt[|δt(x)|]⏟acceptance mismatch ≤ E_x p_t [ | _t(x) | ]_acceptance mismatch +(1−x∼pt[αt(x)])TV(Rt,Rtsd)⏟recovery mismatch. + (1-E_x p_t[ _t(x)] )TV(R_t,R_t^sd)_recovery mismatch. (21) The proof is provided in Appendix A-C. Takeaway 3. Theorem 2 attributes the distributional deviation to two factors: (1) the acceptance bias introduced by the relaxed verifier, and (2) the discrepancy between the recovery distribution and the standard recovery distribution. This observation suggests that SecureSD requires a coordinated design for correcting both α and R. Performance Degradation Decomposition We connect the distributional deviation TV(q~t,qt)TV( q_t,q_t) to downstream task metrics. Let Sm:T→[0,1]S_m:V^T→[0,1] be the scoring function for the specific task m, and let M=Sm(x1:T)∈[0,1] M=S_m(x_1:T)∈[0,1] (22) denote the task score. Write Q~ Q (resp. Q) for the full-sequence distribution induced by the relaxed verifier (resp. standard verifier). For a fixed prefix x<tx_<t, define μt(x;x<t)≜Q[M∣x<t,xt=x], _t(x;x_<t) _Q [M x_<t,x_t=x ], (23) as the expected task score when token x is chosen at position t and the remaining tokens are drawn from q. Theorem 3 (Task Metric Drift Bound). For any task metric M∈[0,1]M∈[0,1], let Q~<t Q_<t be the marginal of Q~ Q over x<tx_<t, write osc(f)≜maxxf(x)−minxf(x)osc(f) _xf(x)- _xf(x), and write TVt(x<t)TV_t(x_<t) for the distributional deviation TV(q~t,qt)TV( q_t,q_t) of Theorem 2, viewed as a function of the prefix x<tx_<t. Define Γ≜∑t=1Tx<t∼Q~<t[TVt(x<t)⋅osc(μt(⋅,x<t))]. _t=1^TE_x_<t Q_<t [TV_t(x_<t)·osc ( _t(·;x_<t) ) ]. (24) With Γ as defined in Equation (24), the metric gap satisfies |Q~[M]−Q[M]|≤minΓ,1. |E_ Q[M]-E_Q[M] |≤ \ ,1\. (25) Letting TVt≜supx<tTVt(x<t)TV_t _x_<tTV_t(x_<t) denote the worst-case distributional deviation and osc(μt)≜supx<tosc(μt(⋅,x<t))osc( _t) _x_<tosc( _t(·;x_<t)) denote the worst-case task-score oscillation, we have |Q~[M]−Q[M]|≤min∑t=1TTVt⋅osc(μt),1. |E_ Q[M]-E_Q[M] |≤ \ _t=1^TTV_t·osc( _t),1 \. (26) The proof is provided in Appendix A-D. Theorem 3 links performance degradation to the distributional deviation of the relaxed verifier. Notably, the bound depends not only on the deviation between q~t q_t and qtq_t, but also on the task sensitivity to the token chosen at position t. This sensitivity is captured by osc(μt(⋅,x<t))osc( _t(·;x_<t)), which measures the largest possible change in the final metric induced by a one-token decision. We formalize it as follows. Definition 2 (Positional Task Sensitivity). The positional task sensitivity at position t given prefix x<tx_<t is It(x<t) I_t(x_<t) ≜osc(μt(⋅,x<t)) ( _t(·;x_<t) ) =maxx∈μt(x,x<t)−minx∈μt(x,x<t). = _x _t(x;x_<t)- _x _t(x;x_<t). (27) Takeaway 4. Theorem 3 shows that performance degradation introduced by the relaxed verifier can be decomposed into: (1) the distributional deviation TV(q~t,qt)TV( q_t,q_t), and (2) the task’s sensitivity ItI_t to token choices at each position. Distributional Deviation of SecureSD We now analyze how SecureSD reduces the distributional deviation. Recall from Algorithm 2 that at position t, SecureSD applies the mixed acceptance function and recovery distribution αtη _t^η =(1−ηt)αtsd+ηtαt, =(1- _t) _t^sd+ _t _t, (28) Rtη R_t^η =(1−ηt)Rtsd+ηtRt. =(1- _t)R_t^sd+ _tR_t. (29) Applying Theorem 1 to the mixed verifier S(q,p,αη,Rη)S(q,p,α^η,R^η) gives the output distribution: q~tη(x)=pt(x)αtη(x)+(1−α¯tη)Rtη(x), q_t^η(x)=p_t(x) _t^η(x)+ (1- α_t^η )R_t^η(x), (30) where α¯tη≜u∼pt[αtη(u)]=(1−ηt)α¯tsd+ηtα¯t α_t^η _u p_t[ _t^η(u)]=(1- _t) α_t^sd+ _t α_t. Proposition 1 (Degradation Mitigation via SecureSD). Under ηt∈[0,1] _t∈[0,1] at position t, the distributional deviation of the SecureSD verifier satisfies TV(q~tη,qt)≤ ( q_t^η,q_t)≤ ηtTV(q~t,qt) _tTV( q_t,q_t) + + ηt(1−ηt)|α¯t−α¯tsd|TV(Rt,Rtsd). _t(1- _t)| α_t- α_t^sd|TV(R_t,R_t^sd). (31) Let ϵt=ηt(1−ηt)|α¯t−α¯tsd|TV(Rt,Rtsd) _t= _t(1- _t)| α_t- α_t^sd|TV(R_t,R_t^sd). The task metric drift under SecureSD satisfies |Q~η[M]−Q[M]|≤min∑t=1T(ηtTVt+ϵt)It,1, |E_ Q^η[M]\!-\!E_Q[M] |\!≤\! \ _t=1^T( _tTV_t+ _t)I_t,1 \, (32) where TVtTV_t, ϵt _t, and ItI_t are uniform upper bounds over prefixes. The proof is provided in Appendix A-E. Proposition 1 demonstrates that the performance degradation introduced by a relaxed verifier can be mitigated by reducing ηtTVt+ϵt _tTV_t+ _t. Importantly, we find that ϵt _t is typically zero, and even when non-zero, it is negligible compared to the dominant term ηtTVt _tTV_t. For instance, under the STEP schedule, ϵt=0 _t=0 because ηt∈0,1 _t∈\0,1\; similarly, in LossySD, ϵt=0 _t=0 because Rt=RtsdR_t=R_t^sd. For cases where ϵt≠0 _t≠ 0, we evaluate its magnitude relative to ηtTVt _tTV_t in Table IV. The ratio of ϵt _t to ηtTVt _tTV_t ranges from 0%0\% to 2.55%2.55\%, averaging only 0.52%0.52\%. This indicates that the bound is dominated by ηtTVt _tTV_t and thus scales approximately linearly with ηt _t. We observe a consistent empirical trend in Figure 4. TABLE IV: Magnitude of ϵt _t relative to ηtTVt _tTV_t. Across four datasets, ϵt _t is negligible compared to ηtTVt _tTV_t. Method η=0.25η=0.25 η=0.5η=0.5 η=0.75η=0.75 LossySD 0.00% 0.00% 0.00% FSD 1.03% 0.67% 0.33% MARS 0.48% 0.32% 0.16% BiLD 0.62% 0.41% 0.21% FLy 2.55% 1.70% 0.85% SpecCascade 0.00% 0.00% 0.00% Takeaway 5. Theorem 3 relates the performance degradation under lossy speculative decoding to both the output distribution shift induced by the relaxed verifier and the task type. Both Proposition 1 and our empirical analysis demonstrate that SecureSD can reduce ηtTVt _tTV_t through correction to mitigate performance degradation. VI-B Empirical Study of Theoretical Analysis The analysis in Theorem 3 attributes the performance degradation of relaxed SD to two factors. The first is the per-step distributional deviation TV(q~t,qt)TV( q_t,q_t) characterized in Theorem 2, and the second is the positional task sensitivity ItI_t defined in Definition 2. It further predicts that η-mixing linearly contracts the deviation, as shown in Proposition 1. We now empirically validate these three predictions. Fig. 2: Distributional Deviation of Relaxed Verifiers. Per-position deviation TV(q~t,qt)TV( q_t,q_t) under relaxed verifiers concentrates at early token positions and is amplified by higher acceptance rates. Distributional Deviation of Relaxed Verifiers We estimate the per-position deviation TV(q~t,qt)TV( q_t,q_t) on both security and utility benchmarks in Figure 2. The deviation shows a clear positional pattern: it is concentrated at early generation positions and rapidly diminishes as decoding proceeds. As the acceptance rate increases, the deviation becomes larger, suggesting that more permissive verifiers induce stronger departures from the target distribution. This amplification is most evident at early positions, where deviations can propagate through the autoregressive decoding process. Fig. 3: Positional Task Sensitivity. I^t I_t measures the task sensitivity to tokens at different positions. Security benchmarks show early concentrated I^t I_t, while utility benchmarks show a more uniform distribution across generation. Positional Task Sensitivity Computing the task sensitivity ItI_t exactly is intractable, since it requires evaluating μt(x,x<t) _t(x;x_<t) for every token x∈x . We therefore estimate it with Monte Carlo sampling. For each sampled position t, we select the top-k candidate tokens under qtq_t, generate N target-model continuations for each candidate, and score the resulting completions with the task metric. We then use the range of the average scores as the estimate I^t I_t. Figure 3 shows how the positional task sensitivity ItI_t changes over the course of generation. We find that security and utility benchmarks exhibit different ItI_t patterns. For security benchmarks, ItI_t is mostly concentrated in the early generated tokens, whereas for utility benchmarks, ItI_t is more evenly distributed across the generation process. This difference arises because utility-oriented tasks, such as math and coding, often require step-by-step reasoning, where correctness depends on maintaining accuracy throughout the entire generation. In contrast, performance on security benchmarks is more strongly determined by the model’s early response behavior, such as whether it gives a safe or unsafe initial response and whether the generation is hijacked toward unintended content. Takeaway 6. Proposition 1 and the following empirical analysis suggest that the performance degradation is mainly controlled by ηt⋅TVt⋅It _t·TV_t· I_t. On security tasks, both the distributional deviation and task sensitivity are concentrated in the first few tokens. This system-level result for draft-target model pairs aligns with prior findings on early-token sensitivity in single-model safety [46, 47]. Therefore, using smaller ηt _t at early positions can substantially mitigate the degradation. This observation motivates SecureSD in Algorithm 2. Degradation Mitigation via SecureSD We first validate the relationship between η and the distributional deviation predicted by Proposition 1. Figure 4 (left) plots the measured deviation TV(q~tη,qt)TV( q_t^η,q_t) as η varies from 11 to 00. The deviation decreases nearly linearly with η, closely matching the contraction bound in Proposition 1. We next examine whether applying η-verification correction to the first few tokens can recover model performance. Figure 4 (right) studies a representative setting where utility PRR remains high but security PRR drops substantially. Under the step correction schedule, security PRR increases with L and gradually saturates. This trend matches the positional pattern of TVt⋅ItTV_t· I_t on security tasks and supports our theoretical analysis. Large L values, however, gradually reduce SPD by introducing more strict verification steps. In practice, SecureSD should choose the correction schedule according to the desired PRR–SPD trade-off. Fig. 4: Degradation Mitigation via SecureSD. Left: the measured deviation TV(q~tη,qt)TV( q_t^η,q_t) contracts linearly in η. Right: security PRR shows a saturating increase as L grows. Takeaway 7. Both theoretical and empirical analyses support the framework in three key aspects: relaxed verification induces distributional deviation, security tasks are highly sensitive to early-token errors, and η-mixing contracts deviation as predicted. These findings justify SecureSD: enforcing stronger early correction for security while relaxing later verification for efficiency. TABLE V: Impact of SecureSD on LLM System Safety/Security/Utility/Efficiency. We evaluate SecureSD (default) with six relaxed/lossy verifiers on Qwen3-0.6B/8B and Llama3-1B/8B across four datasets. The average ΔPRR _PRR and ΔSPD _SPD show that SecureSD improves security and safety while largely maintaining target-model utility and lossy SD efficiency. Relaxed Verifier Model Family Safety/Security Benchmarks Utility Benchmarks Jailbreak-SD OpenPromptInjection HumanEval GSM8K ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD LossySD [1] Qwen3-0.6B/8B +.337 +.050 +.125 -.010 -.013 +.001 +.025 -.020 Llama3-1B/8B +.045 +.003 +.071 -.002 +.025 -.002 +.010 -.005 BiLD [22] Qwen3-0.6B/8B +.295 +.063 +.086 -.010 -.054 -.016 +.026 -.010 Llama3-1B/8B +.039 +.018 +.073 -.005 -.002 +.001 .000 -.004 SpecCascade [23] Qwen3-0.6B/8B +.598 +.083 +.229 -.016 +.016 -.005 +.196 +.006 Llama3-1B/8B +.074 +.037 +.197 +.001 +.022 +.004 +.091 +.008 FSD [24] Qwen3-0.6B/8B +.122 -.023 +.084 -.016 -.007 -.004 +.007 -.004 Llama3-1B/8B +.051 +.020 +.122 +.003 +.008 -.001 +.002 -.002 FLy [25] Qwen3-0.6B/8B +.194 -.038 +.152 -.018 -.022 -.006 +.003 -.005 Llama3-1B/8B +.007 +.002 +.095 -.007 +.035 -.001 +.004 -.003 MARS [26] Qwen3-0.6B/8B +.072 +.021 +.009 -.014 +.034 -.017 +.018 -.012 Llama3-1B/8B +.036 +.032 +.038 +.001 +.018 +.002 -.014 -.003 Average Lossy SD Qwen3-0.6B/8B +.270 +.026 +.114 -.014 -.008 -.008 +.046 -.007 Llama3-1B/8B +.042 +.019 +.099 -.001 +.018 +.001 +.015 -.001 Fig. 5: Security PRR versus acceptance rate on Jailbreak-SD. Columns are relaxed verifiers and rows are model families (Qwen3-0.6B/8B, Llama3-1B/8B). The star marks lossless speculative decoding. As the AR increases, vanilla PRR degrades sharply, while SecureSD (STEP (L)) keeps it near the lossless level. VII Experiments In this section, we conduct a comprehensive evaluation of SecureSD to assess its ability to improve security while preserving utility and efficiency. We also design extensive ablation studies to demonstrate that SecureSD can be applied to LLM systems with different parameter scales while remaining effective. VII-A Experimental Setup We follow the same experimental setup as in Section IV-B and introduce two additional metrics to quantify the performance gains of SecureSD. We use the step schedule with L=1L=1 as the default setting of SecureSD. Performance Retention Rate Gain ΔPRR _PRR ΔPRR _PRR measures how much additional target-model performance SecureSD retains on top of a relaxed verifier. To isolate the effect of SecureSD, we compare in a paired manner: the two runs use the same verifier with the same hyperparameter θ, and differ only in whether SecureSD is applied. Let PRRSecureSD θPRR^θ_SecureSD and PRRvanillaθPRR^θ_vanilla denote the PRRs of the verifier with and without SecureSD under hyperparameter θ. We define ΔPRR=1|Θ|∑θ∈Θ(PRRSecureSD θ−PRRvanillaθ), _PRR= 1| | _θ∈ (PRR^θ_SecureSD -PRR^θ_vanilla ), (33) where Θ is the hyperparameter set of the verifier. A positive ΔPRR _PRR indicates that SecureSD retains more target model performance than the vanilla verifier. Inference Speedup Gain ΔSPD _SPD ΔSPD _SPD quantifies the efficiency benefit of applying SecureSD under the same paired comparison. Let SPDSecureSD θSPD^θ_SecureSD and SPDvanillaθSPD^θ_vanilla denote the inference speedups (SPD) of the verifier with and without SecureSD under the same hyperparameter θ. We define ΔSPD=1|Θ|∑θ∈Θ(SPDSecureSD θ−SPDvanillaθ). _SPD= 1| | _θ∈ (SPD^θ_SecureSD -SPD^θ_vanilla ). (34) A small negative ΔSPD _SPD indicates that SecureSD introduces a minor efficiency overhead, while a positive value indicates that SecureSD is faster than the vanilla verifier. TABLE VI: Impact of the correction length L on SecureSD. ΔPRR _PRR increases consistently with L, indicating performance gains from correcting the generation of more tokens, especially on Llama3-1B/8B. ΔSPD _SPD changes only slightly as L increases, indicating that this behavior incurs only a minor efficiency overhead. Results are averaged across six lossy-SD methods. L Qwen3-0.6B/8B Llama3-1B/8B Jailbreak-SD Prompt Inj. HumanEval GSM8K Jailbreak-SD Prompt Inj. HumanEval GSM8K ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD 1 +.270 +.026 +.114 -.014 -.008 -.008 +.046 -.007 +.042 +.019 +.099 -.001 +.018 +.001 +.015 -.001 2 +.279 +.006 +.152 -.021 -.009 -.009 +.045 -.009 +.096 +.014 +.109 -.011 +.023 +.000 +.021 -.011 4 +.282 .000 +.213 -.026 -.008 -.015 +.032 -.018 +.321 -.008 +.140 -.022 +.023 -.001 +.027 -.005 8 +.285 -.047 +.224 -.035 -.005 -.023 +.034 -.035 +.325 -.052 +.135 -.035 +.027 -.010 +.033 -.019 TABLE VII: Evaluation of SecureSD on AgentDojo. We evaluate SecureSD with Qwen3-0.6B/8B on the realistic, long-context prompt injection benchmark AgentDojo. The utility under attack of the target and draft models is .264 and .078, respectively. SecureSD improves the average PRR while preserving SPD. Method w/o SecureSD w/ SecureSD ΔPRR↑ _PRR ΔSPD↑ _SPD PRR↑ SPD↑ PRR↑ SPD↑ LossySD .548 1.919 .723 1.947 +.175 +.028 BiLD .932 1.872 .983 1.891 +.051 +.019 SpecCascade .169 2.081 .328 2.158 +.159 +.077 FSD .869 1.839 .955 1.847 +.086 +.007 FLy .793 1.798 .904 1.799 +.111 +.001 MARS .863 1.882 .953 1.910 +.090 +.028 Average .696 1.898 .808 1.925 +.112 +.027 VII-B Main Results Table V summarizes the paired improvements of SecureSD, measured by ΔPRR _PRR and ΔSPD _SPD, over six relaxed SD verifiers on one safety, two security, and two utility benchmarks. Figure 5 further reports the safety PRR on the Jailbreak benchmark as a function of the acceptance rate. Table VII shows the security results of evaluating SecureSD on AgentDojo. For each verifier and model family, we compare standard lossless SD, the vanilla relaxed verifier, and the corresponding verifier augmented with SecureSD. SecureSD Mitigates Safety and Security Degradation Across most verifier-model combinations, SecureSD yields positive gains. For Qwen3-0.6B/8B, the average ΔPRR _PRR reaches +0.270+0.270 on Jailbreak and +0.114+0.114 on Prompt Injection. The largest single improvement is observed for SpecCascade, where SecureSD improves PRR by up to +0.598+0.598. Figure 5 further shows that vanilla relaxed verifiers lose PRR rapidly as the acceptance rate increases, whereas SecureSD keeps PRR close to that of the standard verifier. This confirms that correcting early accepted positions recovers most of the lost safety/security performance while retaining high acceptance rates. SecureSD Preserves Utility Performance Unlike the substantial gains on safety/security benchmarks, SecureSD has little effect on utility benchmarks. For Qwen3-0.6B/8B, the average ΔPRR _PRR is −0.008-0.008 on HumanEval and +0.046+0.046 on GSM8K. These small changes show that early-position correction does not materially hurt task utility, consistent with our finding that utility-oriented tasks are less sensitive to the deviations corrected by SecureSD. In some cases, corrected prefixes even improve utility, such as the +0.196+0.196 PRR gain of SpecCascade on GSM8K. SecureSD Introduces Negligible Efficiency Overhead SecureSD has only a minor impact on decoding efficiency, with ΔSPD _SPD remaining within ±0.02± 0.02 across most settings. Stricter early verification may reject more draft tokens, but the corrected prefixes can improve later acceptance rates, making the overall speed impact nearly neutral. In some cases, SecureSD is even faster than the vanilla verifier. For example, SpecCascade gains +0.083+0.083 in speedup on Jailbreak with Qwen3-0.6B/8B, with an average gain of +0.026+0.026 in this setting. VII-C Effect of the Correction Length L Table VI reports the effect of varying the step correction length L∈1,2,4,8L∈\1,2,4,8\ on ΔPRR _PRR and ΔSPD _SPD. The two model families exhibit different sensitivities to L. For Qwen3-0.6B/8B, the safety gain on Jailbreak is already close to saturation at L=1L=1, with the average ΔPRR _PRR increasing only slightly from +0.270+0.270 at L=1L=1 to +0.285+0.285 at L=8L=8. In contrast, Llama3-1B/8B benefits substantially from a longer correction window. Its average ΔPRR _PRR on Jailbreak increases from +0.042+0.042 at L=1L=1 to +0.321+0.321 at L=4L=4, and then plateaus at +0.325+0.325 when L=8L=8. Figure 5 shows the same trend across acceptance rates. For Qwen3, all Step curves separate clearly from the vanilla relaxed verifier even with L=1L=1, and larger L brings only marginal additional improvement. For Llama3, however, the Step curves move away from the vanilla verifier progressively as L increases, indicating that correcting only the first accepted position is insufficient for the Llama3 family. This difference is consistent with the distributional-deviation measurements in Figure 2. For Qwen3, the per-position deviation TV(q~t,qt)TV( q_t,q_t) drops rapidly after the first few positions, suggesting that most harmful deviation is concentrated at the beginning of the generated response. Therefore, correcting the first accepted position already restores most of the target-consistent behavior. For Llama3, the deviation decays more slowly across positions, so relaxed verification can continue to steer the committed prefix away from the target model several tokens after the first acceptance. A longer correction window is thus needed to prevent this drift. Increasing L also introduces a mild efficiency cost. On Jailbreak, the average ΔSPD _SPD decreases from +0.026+0.026 at L=1L=1 to −0.047-0.047 at L=8L=8 for Qwen3, and from +0.019+0.019 to −0.052-0.052 for Llama3. Overall, L provides a controllable trade-off between safety recovery and decoding speed: L=1L=1 is sufficient for Qwen3, whereas L=4L=4 recovers nearly all safety gains for Llama3 with only a small average speed change of −0.008-0.008. How to Select L Table VI suggests L≤8L≤ 8 as an empirical choice across tasks. Conceptually, the choice of L should be related to the depth of safety alignment in the model [46]. When L matches the effective depth of safety alignment, the system can ensure that generation begins from a distribution consistent with the model’s safety-aligned behavior. A more robust approach is to perform an ablation study over L on a small calibration dataset and obtain curves similar to those in Figure 4, characterizing the trade-offs among Security/Safety-PRR, Utility-PRR, and SPD. One can then select L according to the requirements of the deployment setting. When no representative calibration dataset is available, using a relatively large L is a safer choice, since increasing L has only a limited impact on the overall decoding speedup and is generally worthwhile given the corresponding improvement in system-level performance. VII-D Effect of Correction Schedule ηjj≥1\ _j\_j≥ 1 TABLE VIII: Impact of the correction schedule η on SecureSD. S/L/P denote the STEP/LINEAR/POWER-LAW schedules, respectively. All three schedules effectively improve PRR. In practice, STEP avoids complex distribution-mixing operations, giving it an advantage in preserving SPD. η Schedule Jailbreak-SD HumanEval Qwen3 Llama3 Qwen3 Llama3 ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD S (L=1L=1) +.337 +.050 +.045 +.003 -.013 +.001 +.025 -.002 S (L=4L=4) +.349 +.023 +.292 -.001 -.004 -.006 +.035 -.004 L (L=1L=1) +.158 -.039 +.019 -.010 -.008 -.012 +.027 -.010 L (L=8L=8) +.313 -.111 +.207 -.110 -.009 -.014 +.037 -.017 P (γ=2,L=1γ=2,L=1) +.248 -.065 +.027 -.015 +.005 -.014 +.026 -.009 P (γ=2,L=8γ=2,L=8) +.349 -.148 +.266 -.119 -.015 -.020 +.033 -.014 P (γ=4,L=1γ=4,L=1) +.313 -.111 +.036 -.019 -.007 -.021 +.034 -.011 P (γ=4,L=8γ=4,L=8) +.347 -.158 +.291 -.186 +.012 -.030 +.038 -.015 The experiments above use the step schedule, which applies full correction to the first L positions and then switches directly to the relaxed verifier. A natural question is whether a smoother transition would be preferable. Table VIII studies this on LossySD by replacing the step schedule with linear and power-law schedules, varying the transition length L∈1,8L∈\1,8\ and the curvature γ∈2,4γ∈\2,4\, and comparing against the step schedule at L∈1,4L∈\1,4\, under the same paired protocol on Jailbreak and HumanEval. The smooth schedules reproduce the qualitative behavior of the step schedule: security gains increase as the transition becomes longer and more delayed, reaching +0.347+0.347 on Qwen3 and +0.291+0.291 on Llama3 for the power-law schedule with L=8L=8 and γ=4γ=4, while ΔPRR _PRR on HumanEval stays flat across all configurations. However, the step schedule provides a better security–efficiency trade-off. On Qwen3, the step schedule with L=1L=1 matches the best power-law gain (+0.337+0.337 versus +0.349+0.349) while being faster (+0.050+0.050 versus −0.148-0.148 in speed); on Llama3, the step schedule with L=4L=4 matches it (+0.292+0.292 versus +0.291+0.291) with a much smaller speed cost (−0.001-0.001 versus −0.186-0.186). Intermediate correction levels are less efficient in our setting, as they extend correction beyond the most security-sensitive positions; the step schedule is also simpler to implement, since each position uses either standard or relaxed verification without materializing vocabulary-level mixtures. We therefore adopt the step schedule as the default configuration of SecureSD. TABLE IX: Evaluation on batched inference with larger target models. We evaluate SecureSD with larger target models and report the average PRR and SPD across four datasets and six relaxed verifiers. SecureSD improves PRR while preserving SPD. Benchmark SecureSD Qwen3-0.6B/32B Llama3-1B/70B PRR SPD PRR SPD Jailbreak-SD w/o 0.727 1.985 0.571 3.738 w/ 0.973 1.752 0.690 3.947 OpenPromptInjection w/o 0.652 1.853 0.512 3.153 w/ 0.855 1.882 0.956 3.161 HumanEval w/o 0.653 2.392 0.500 3.943 w/ 0.627 2.538 0.667 3.874 GSM8K w/o 0.820 2.637 0.791 3.785 w/ 0.843 2.497 0.791 3.737 VII-E Ablation Study We further examine whether the gains of SecureSD remain stable under different deployment and decoding configurations, varying the target-model scale, the decoding temperature τ, and the speculative length k. The τ and k ablations use the same paired protocol on the two security benchmarks with Qwen3-0.6B/8B, averaged over the six relaxed verifiers and their hyperparameter sweeps. Batched Inference with Larger Target Models Speculative decoding is often used in practice to accelerate larger models. In Table IX, we use Qwen3-32B and Llama3.3-70B-Instruct as target models and evaluate the improvements in PRR and SPD with and without SecureSD. We find that speculative decoding generally provides more pronounced speedups for larger target models. Meanwhile, SecureSD effectively improves the safety/security performance while preserving the acceleration benefits. Decoding Temperature τ Higher temperatures flatten the draft and target distributions and make the security-critical opening tokens more stochastic, which could plausibly affect SecureSD. Table X varies τ∈0,0.3,0.7,1.0τ∈\0,0.3,0.7,1.0\ with k=5k=5 fixed. The security gain is largely insensitive to temperature: ΔPRR _PRR stays within +0.238+0.238 to +0.274+0.274 on Jailbreak and remains consistently positive on Prompt Injection (+0.114+0.114 to +0.200+0.200), while ΔSPD _SPD stays within ±0.026± 0.026. The benefit of SecureSD is therefore not an artifact of greedy decoding and carries over to stochastic sampling. TABLE X: Impact of the decoding temperature τ on SecureSD. Although different temperatures introduce generation uncertainty and PRR/SPD fluctuations, SecureSD remains effective across all tested temperatures. τ Jailbreak-SD OpenPromptInjection ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD 0 +.270 +.026 +.114 -.014 0.3 +.269 +.020 +.155 -.015 0.7 +.238 +.014 +.200 -.017 1.0 +.274 +.005 +.168 -.018 TABLE XI: Impact of the speculative length k on SecureSD. Different speculative lengths affect the generation process and acceptance rate, while SecureSD maintains stable safety/security recovery across all speculative lengths. k Jailbreak-SD OpenPromptInjection ΔPRR _PRR ΔSPD _SPD ΔPRR _PRR ΔSPD _SPD 3 +.266 +.032 +.114 -.007 4 +.261 +.037 +.113 -.012 5 +.270 +.026 +.114 -.014 6 +.268 +.030 +.113 -.016 7 +.270 +.024 +.128 -.016 8 +.277 +.018 +.118 -.016 Speculative Length k A larger k commits more draft tokens per verification round and could in principle amplify the draft model’s influence. Table XI varies k∈3,…,8k∈\3,…,8\ with τ=0τ=0 fixed and shows that this does not occur: ΔPRR _PRR fluctuates only between +0.261+0.261 and +0.277+0.277 on Jailbreak and between +0.113+0.113 and +0.128+0.128 on Prompt Injection, while ΔSPD _SPD remains small (−0.016-0.016 to +0.037+0.037). This stability follows by design: the correction schedule is defined over global token positions, so SecureSD always corrects the first L positions of the response regardless of how the speculation rounds are segmented. VIII Discussion Adaptive Attacks Since SecureSD corrects only the first L positions, an attacker aware of the defense could try to push the security-critical decision beyond the correction window. For example, the attacker could first elicit a benign-looking opening longer than L tokens and then steer the subsequent generation toward harmful content. We instantiate this attack with 200 prompt injections that first repeat the original question to delay malicious behavior beyond the correction window, using the Step schedule (L=12L=12). Table XII shows that SecureSD increases AFR by 19 percentage points and PRR by 55.9–71.8 percentage points over the average of six lossy-SD methods, approaching target-model performance. For queries where the target succeeds but the draft fails, early correction creates a target-aligned prefix that increases subsequent draft-target disagreement, reducing draft-token acceptance beyond the correction window and preserving safety/security. TABLE XII: Evaluation under adaptive attacks. We evaluate SecureSD against adaptive prompt injections that delay malicious behavior beyond the correction window. By correcting early generation, SecureSD steers the response toward the target-model trajectory and remains effective against these adaptive attacks. Setting Qwen3-0.6B/8B Llama3-1B/8B AFR↑ PRR↑ AFR↑ PRR↑ Target .625 – .580 – Draft .285 – .315 – w/o SecureSD .415 .382 .360 .168 w/ SecureSD .605 .941 .550 .886 Δ +.190 +.559 +.190 +.718 TABLE XIII: Runtime overhead of SecureSD. We report relative inference-latency changes in our vLLM implementation, in units of 10−3%10^-3\%. Positive values indicate overhead and negative values indicate speedup; overhead is negligible. Qwen3 Llama3 Method 0.6B/8B 0.6B/32B 1B/8B 1B/70B LossySD +0.001 +0.001 +0.001 +0.001 BiLD +0.001 +0.001 +0.001 +0.001 SpecCascade -2.330 -0.583 -1.830 -0.227 FSD +0.775 +0.194 +0.611 +0.076 FLy +0.001 +0.001 +0.001 +0.001 MARS +0.001 +0.001 +0.001 +0.001 Runtime Overhead in Real-World Systems Since SecureSD performs operations such as distribution fusion over the first L tokens, it may introduce additional implementation overhead. We implement a lightweight SecureSD layer on vLLM and measure the time required to generate a fixed number of tokens across all datasets. Table XIII shows that the additional overhead remains below 0.001%0.001\% because SecureSD reuses speculative-decoding intermediates and requires negligible computation relative to the target-model forward pass. For SpecCascade, SecureSD slightly improves speed by eliminating verifier-side recovery softmax and sampling. FSD incurs the largest positive overhead because it recomputes the full recovery distribution R, but the overhead remains negligible. Early-Token Criticality for Safety and Security Prior studies [46, 47] show that the first few generated tokens strongly influence the safety of a response. These studies examine intrinsic early-token sensitivity within a single model. We instead study system-level safety and security under lossy speculative decoding, where target-model decoding defines the performance upper bound, but relaxed verification can introduce early deviations from its generation trajectory. We show that these system-induced deviations degrade safety and security much more than utility, revealing a security–utility asymmetry not studied in prior work. This distinction motivates SecureSD, which restores stricter target verification at early positions. IX Conclusion In this paper, we presented the first systematic study of the security implications of lossy speculative decoding. We revealed a clear safety/security–utility asymmetry, where relaxed verification improves efficiency but increases jailbreak and prompt injection risks much faster than it degrades utility. Our analysis attributed this asymmetry to early-position draft tokens, whose deviations from the target distribution shape the initial direction of the response. Based on this insight, we proposed SecureSD, a position-aware method that strengthens early verification while keeping efficient verification elsewhere. More broadly, our results show that inference optimizations can silently weaken model security, highlighting the need to include security evaluation in their utility and efficiency assessment. Acknowledgments We thank the reviewers and shepherd for their constructive comments on our work. The Authors acknowledge the National Artificial Intelligence Research Resource (NAIRR) Pilot for contributing to this research result. Neil Gong was supported in part by NSF under grant No. 2450935, 2112562, and 2625580. References [1] Y. Leviathan, M. Kalman, and Y. Matias (2023) Fast inference from transformers via speculative decoding. In International Conference on Machine Learning, Cited by: §I, §I-A, §I-A, TABLE I, §IV-A, §IV-B, TABLE I, §V-A, TABLE V. [2] C. Chen, S. Borgeaud, G. Irving, J. Lespiau, L. Sifre, and J. Jumper (2023) Accelerating large language model decoding with speculative sampling. arXiv preprint arXiv:2302.01318. Cited by: §I, §I-A. [3] Y. Leviathan, M. Kalman, and Y. Matias (2024) Looking back at speculative decoding. Note: https://research.google/blog/looking-back-at-speculative-decoding/ Cited by: §I. [4] Google AI for Developers (2026) Speed-up gemma 4 with multi-token prediction. Note: https://ai.google.dev/gemma/docs/mtp/overview Cited by: §I. [5] vLLM Project (2026) Speculative decoding. Note: https://docs.vllm.ai/en/latest/features/speculative_decoding/ Cited by: §I, §I. [6] NVIDIA Triton Inference Server (2026) Speculative decoding with tensorrt-llm. Note: https://docs.nvidia.com/deeplearning/triton-inference-server/user-guide/docs/tutorials/Feature_Guide/Speculative_Decoding/TRT-LLM/README.html Cited by: §I, §I. [7] Hugging Face Text Generation Inference (2026) Speculation. Note: https://huggingface.co/docs/text-generation-inference/conceptual/speculation Cited by: §I. [8] SGLang Project (2026) Speculative decoding. Note: https://docs.sglang.io/docs/advanced_features/speculative_decoding Cited by: §I, §I. [9] Y. Zhou, K. Lyu, A. S. Rawat, A. K. Menon, A. Rostamizadeh, S. Kumar, J. Kagy, and R. Agarwal (2024) Distillspec: improving speculative decoding via knowledge distillation. In International Conference on Learning Representations, Cited by: §I. [10] O. Zafrir, I. Margulis, D. Shteyman, S. Guskin, and G. Boudoukh (2025) Fastdraft: how to train your draft. In Findings of the Association for Computational Linguistics: ACL 2025, Cited by: §I. [11] X. Liu, L. Hu, P. Bailis, A. Cheung, Z. Deng, I. Stoica, and H. Zhang (2024) Online speculative decoding. In Proceedings of the 41st International Conference on Machine Learning, Cited by: §I. [12] Y. Hu, J. Guo, X. Feng, and T. Zhao (2025) Adaspec: selective knowledge distillation for efficient speculative decoders. Advances in Neural Information Processing Systems. Cited by: §I. [13] Y. Li, F. Wei, C. Zhang, and H. Zhang (2025) Eagle-3: scaling up inference acceleration of large language models via training-time test. Advances in Neural Information Processing Systems. Cited by: §I. [14] T. Cai, Y. Li, Z. Geng, H. Peng, J. D. Lee, D. Chen, and T. Dao (2024) MEDUSA: simple llm inference acceleration framework with multiple decoding heads. In Proceedings of the 41st International Conference on Machine Learning, Cited by: §I. [15] Z. Ankner, R. Parthasarathy, A. Nrusimha, C. Rinard, J. Ragan-Kelley, and W. Brandon (2024) Hydra: sequentially-dependent draft heads for medusa decoding. In First Conference on Language Modeling, Cited by: §I. [16] X. Miao, G. Oliaro, Z. Zhang, X. Cheng, Z. Wang, Z. Zhang, R. Y. Y. Wong, A. Zhu, L. Yang, X. Shi, et al. (2024) Specinfer: accelerating large language model serving with tree-based speculative inference and verification. In Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Cited by: §I. [17] Y. Li, F. Wei, C. Zhang, and H. Zhang (2024) Eagle-2: faster inference of language models with dynamic draft trees. In Proceedings of the 2024 conference on empirical methods in natural language processing, Cited by: §I. [18] G. Bachmann, S. Anagnostidis, A. Pumarola, M. Georgopoulos, A. Sanakoyeu, Y. Du, E. Schönfeld, A. Thabet, and J. Kohler (2025) Judge decoding: faster speculative sampling requires going beyond model alignment. In ICLR 2025, Cited by: §I. [19] K. Lu, D. Hong, and P. Liu (2025) AdaSD: adaptive speculative decoding for efficient language model inference. arXiv preprint arXiv:2512.11280. Cited by: §I. [20] J. Wang, Z. Tian, J. Li, Q. Xia, X. Duan, Z. Wang, B. Huai, and M. Zhang (2025) Alignment-augmented speculative decoding with alignment sampling and conditional verification. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Cited by: §I. [21] Z. Wang, S. R. Kasa, A. M. S, S. K. Kasa, J. Zou, S. Negi, R. Zhang, N. Jiang, and Q. Song (2026) DIVERSED: relaxed speculative decoding via dynamic ensemble verification. In Proceedings of The 29th International Conference on Artificial Intelligence and Statistics, Cited by: §I. [22] S. Kim, K. Mangalam, S. Moon, J. Malik, M. W. Mahoney, A. Gholami, and K. Keutzer (2023) Speculative decoding with big little decoder. Advances in Neural Information Processing Systems. Cited by: §I, §I-A, §I-A, TABLE I, §IV-A, §IV-B, TABLE I, TABLE V. [23] H. Narasimhan, W. Jitkrittum, A. S. Rawat, S. Kim, N. Gupta, A. K. Menon, and S. Kumar (2025) Faster cascades via speculative decoding. In International Conference on Learning Representations, Cited by: §I, §I-A, §I-A, TABLE I, §IV-A, §IV-B, TABLE I, TABLE V. [24] M. Holsman, Y. Huang, and B. Dhingra (2025) Fuzzy speculative decoding for a tunable accuracy-runtime tradeoff. In Findings of the Association for Computational Linguistics: ACL 2025, Cited by: §I, §I-A, §I-A, TABLE I, §IV-A, §IV-B, TABLE I, TABLE V. [25] J. Li, Y. Xu, G. Li, S. Yang, J. Xu, X. Yin, D. Li, E. Ngai, and E. Barsoum (2026) Training-free loosely speculative decoding: accepting semantically correct drafts beyond exact match. In International Conference on Learning Representations, Cited by: §I, §I-A, §I-A, TABLE I, §IV-A, §IV-B, TABLE I, TABLE V. [26] J. Song, X. Wang, H. Wang, X. Lei, T. Shi, S. Han, E. Yang, X. Chang, and L. Ai (2026) MARS: unleashing the power of speculative decoding via margin-aware verification. In Findings of the Association for Computational Linguistics: ACL 2026, Cited by: §I, §I-A, §I-A, TABLE I, §IV-A, §IV-B, TABLE I, TABLE V. [27] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson (2023) Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. Cited by: §I, §I-B, §I-B, §IV-B. [28] L. Jiang, K. Rao, S. Han, A. Ettinger, F. Brahman, S. Kumar, N. Mireshghallah, X. Lu, M. Sap, Y. Choi, et al. (2024) Wildteaming at scale: from in-the-wild jailbreaks to (adversarially) safer language models. Advances in Neural Information Processing Systems. Cited by: §I, §IV-B. [29] P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V. Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tramer, et al. (2024) Jailbreakbench: an open robustness benchmark for jailbreaking large language models. Advances in Neural Information Processing Systems. Cited by: §I, §IV-B. [30] M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, et al. (2024) HarmBench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Conference on Machine Learning, Cited by: §I, §IV-B. [31] Y. Liu, Y. Jia, R. Geng, J. Jia, and N. Z. Gong (2024) Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24), Cited by: §I, §I-B, §IV-B. [32] X. Shen, Z. Chen, M. Backes, Y. Shen, and Y. Zhang (2024) ”Do anything now”: characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, Cited by: §I-B. [33] Y. Liu, G. Deng, Z. Xu, Y. Li, Y. Zheng, Y. Zhang, L. Zhao, T. Zhang, and K. Wang (2024) A hitchhiker’s guide to jailbreaking chatgpt via prompt engineering. In Proceedings of the 4th International Workshop on Software Engineering and AI for Data Quality in Cyber-Physical Systems/Internet of Things, Cited by: §I-B. [34] Y. Zeng, H. Lin, J. Zhang, D. Yang, R. Jia, and W. Shi (2024) How johnny can persuade llms to jailbreak them: rethinking persuasion to challenge ai safety by humanizing llms. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, Cited by: §I-B. [35] X. Liu, N. Xu, M. Chen, and C. Xiao (2024) Autodan: generating stealthy jailbreak prompts on aligned large language models. In International Conference on Learning Representations, Cited by: §I-B. [36] C. Anil, E. Durmus, N. Panickssery, M. Sharma, J. Benton, S. Kundu, J. Batson, M. Tong, J. Mu, D. Ford, et al. (2024) Many-shot jailbreaking. Advances in Neural Information Processing Systems. Cited by: §I-B. [37] P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong (2025) Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), Cited by: §I-B, §I-B. [38] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz (2023) Not what you’ve signed up for: compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM workshop on artificial intelligence and security, Cited by: §I-B. [39] F. Perez and I. Ribeiro (2022) Ignore previous prompt: attack techniques for language models. In ML Safety Workshop, 36th Conference on Neural Information Processing Systems, Cited by: §I-B. [40] R. Geng, C. Yin, Y. Wang, Y. Chen, and J. Jia (2026) Piarena: a platform for prompt injection evaluation. arXiv preprint arXiv:2604.08499. Cited by: §I-B. [41] M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. D. O. Pinto, J. Kaplan, H. Edwards, Y. Burda, N. Joseph, G. Brockman, et al. (2021) Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374. Cited by: §IV-B. [42] K. Cobbe, V. Kosaraju, M. Bavarian, M. Chen, H. Jun, L. Kaiser, M. Plappert, J. Tworek, J. Hilton, R. Nakano, et al. (2021) Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168. Cited by: §IV-B. [43] E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr (2024) Agentdojo: a dynamic environment to evaluate prompt injection attacks and defenses for llm agents. Advances in neural information processing systems. Cited by: §IV-B. [44] A. Souly, Q. Lu, D. Bowen, T. Trinh, E. Hsieh, S. Pandey, P. Abbeel, J. Svegliato, S. Emmons, O. Watkins, et al. (2024) A strongreject for empty jailbreaks. Advances in Neural Information Processing Systems. Cited by: 2nd item. [45] J. Gu, X. Jiang, Z. Shi, H. Tan, X. Zhai, C. Xu, W. Li, Y. Shen, S. Ma, H. Liu, et al. (2026) A survey on llm-as-a-judge. The Innovation. Cited by: 2nd item. [46] X. Qi, A. Panda, K. Lyu, X. Ma, S. Roy, A. Beirami, P. Mittal, and P. Henderson (2025) Safety alignment should be made more than just a few tokens deep. In International Conference on Learning Representations, Cited by: §VI-B, §VII-C, §VIII. [47] Z. Zhang, G. Shen, G. Tao, S. Cheng, and X. Zhang (2024) On large language models’ resilience to coercive interrogation. In 2024 IEEE Symposium on Security and Privacy (SP), Cited by: §VI-B, §VIII. Appendix A Proofs of Theoretical Results A-A Proof of Theorem 1 Proof. Let AtA_t denote the event that the draft token at step t is accepted. Since x~t∼pt x_t p_t and the verifier accepts token u with probability αt(u) _t(u), the overall acceptance rate is PrS(At∣x<t)=∑u∈pt(u)αt(u)=u∼pt[αt(u)]. _S(A_t x_<t)= _u p_t(u) _t(u)=E_u p_t[ _t(u)]. (35) We expand q~t(x) q_t(x) by conditioning on whether the draft token is accepted or rejected: q~t(x) q_t(x) =PrS(xt=x,At∣x<t) = _S(x_t=x,A_t x_<t) +PrS(Atc∣x<t)PrS(xt=x∣Atc,x<t). + _S(A_t^c x_<t) _S(x_t=x A_t^c,x_<t). (36) For the first term, using PrS(x~t=x∣x<t)=pt(x) _S( x_t=x x_<t)=p_t(x) and PrS(At∣x~t=x,x<t)=αt(x) _S(A_t x_t=x,x_<t)= _t(x): PrS(xt=x,At∣x<t)=pt(x)αt(x). _S(x_t=x,A_t x_<t)=p_t(x) _t(x). (37) For the second term, rejection triggers sampling from RtR_t, so PrS(xt=x∣Atc,x<t)=Rt(x) _S(x_t=x A_t^c,x_<t)=R_t(x). This gives q~t(x)=pt(x)αt(x)+(1−u∼pt[αt(u)])Rt(x), q_t(x)=p_t(x) _t(x)+ (1-E_u p_t[ _t(u)] )R_t(x), (38) which completes the proof. ∎ A-B Proof of Corollary 1 Proof. Applying Theorem 1 with αt=αtsd _t= _t^sd and Rt=RtsdR_t=R_t^sd, the acceptance term evaluates to pt(x)αtsd(x) p_t(x) _t^sd(x) =pt(x)min(1,qt(x)pt(x)) =p_t(x) (1, q_t(x)p_t(x) ) (39) =min(pt(x),qt(x)). = (p_t(x),q_t(x) ). (40) Since ∑u(pt(u)−qt(u))=0 _u(p_t(u)-q_t(u))=0, the positive and negative parts have equal total mass, so the rejection probability satisfies 1−u∼pt[αtsd(u)] 1-E_u p_t[ _t^sd(u)] =∑u∈(pt(u)−qt(u))+ = _u (p_t(u)-q_t(u))_+ (41) =∑u∈(qt(u)−pt(u))+. = _u (q_t(u)-p_t(u))_+. (42) Substituting both into (17) gives q~tsd(x) q_t^sd(x) =qt(x), =q_t(x), (43) which completes the proof. ∎ A-C Proof of Theorem 2 Proof. Let α¯t≜u∼pt[αt(u)] α_t _u p_t[ _t(u)] and α¯tsd≜u∼pt[αtsd(u)] α_t^sd _u p_t[ _t^sd(u)]. Substituting q~t q_t from Theorem 1 and qtq_t from Corollary 1, TV(q~t,qt) ( q_t,q_t) =12∑x∈|pt(x)αt(x)+(1−α¯t)Rt(x) = 12 _x |p_t(x) _t(x)+(1- α_t)R_t(x) −pt(x)αtsd(x)−(1−α¯tsd)Rtsd(x)|. -p_t(x) _t^sd(x)-(1- α_t^sd)R_t^sd(x) |. (44) Using the definition δt(x)=αt(x)−αtsd(x) _t(x)= _t(x)- _t^sd(x), which gives α¯t−α¯tsd=pt[δt] α_t- α_t^sd=E_p_t[ _t], we collect terms: TV(q~t,qt) ( q_t,q_t) =12∑x∈|pt(x)δt(x)−pt[δt]Rtsd(x) = 12 _x |p_t(x) _t(x)-E_p_t[ _t]R_t^sd(x) +(1−α¯t)(Rt(x)−Rtsd(x))|. +(1- α_t) (R_t(x)-R_t^sd(x) ) |. (45) Applying the triangle inequality separates the contribution of the acceptance from that of the recovery, which yields TV(q~t,qt) ( q_t,q_t) ≤12∑x∈|pt(x)δt(x)−pt[δt]Rtsd(x)| ≤ 12 _x |p_t(x) _t(x)-E_p_t[ _t]R_t^sd(x) | +(1−α¯t)TV(Rt,Rtsd). +(1- α_t)TV(R_t,R_t^sd). (46) For the first term, we apply the triangle inequality once more and use the condition ∑xRtsd(x)=1 _xR_t^sd(x)=1. This yields 12∑x∈|pt(x)δt(x)−pt[δt]Rtsd(x)| 12 _x |p_t(x) _t(x)-E_p_t[ _t]R_t^sd(x) | ≤12pt[|δt|]+12|pt[δt]|≤pt[|δt|], ≤ 12E_p_t[| _t|]+ 12 |E_p_t[ _t] | _p_t[| _t|], (47) where the last step uses |pt[δt]|≤pt[|δt|]|E_p_t[ _t]| _p_t[| _t|]. Combining both bounds gives the stated inequality. ∎ A-D Proof of Theorem 3 Proof. Let TVt(x∣x<t)≜q~t(x∣x<t)−qt(x∣x<t)TV_t(x x_<t) q_t(x x_<t)-q_t(x x_<t) be the signed pointwise deviation. Define hybrids H(s)H^(s) using q~t q_t for t≤st≤ s and qtq_t for t>st>s, so H(0)=QH^(0)=Q and H(T)=Q~H^(T)= Q. Telescoping over the hybrid chain yields: Q~[M]−Q[M]=∑t=1T(H(t)[M]−H(t−1)[M]). _ Q[M]-E_Q[M]= _t=1^T (E_H^(t)[M]-E_H^(t-1)[M] ). (48) Since H(t)H^(t) and H(t−1)H^(t-1) differ only at position t and share the same prefix marginal Q~<t Q_<t, the t-th term equals Δt _t, where Δt≜x<t∼Q~<t[∑x∈TVt(x∣x<t)μt(x,x<t)]. _t _x_<t Q_<t [ _x TV_t(x x_<t) _t(x;x_<t) ]. (49) Hence Q~[M]−Q[M]=∑tΔtE_ Q[M]-E_Q[M]= _t _t. For each fixed x<tx_<t, the TV-oscillation inequality gives |∑xTVt(x∣x<t)μt(x,x<t)|≤TVt(x<t)⋅osc(μt(⋅,x<t)) | _xTV_t(x x_<t) _t(x;x_<t) | _t(x_<t)·osc ( _t(·;x_<t) ). Taking expectations over x<t∼Q~<tx_<t Q_<t, |Δt|≤x<t∼Q~<t[TVt(x<t)⋅osc(μt(⋅,x<t))]. | _t| _x_<t Q_<t [TV_t(x_<t)·osc ( _t(·;x_<t) ) ]. (50) Summing over t and applying the triangle inequality gives |Q~[M]−Q[M]|≤Γ|E_ Q[M]-E_Q[M]|≤ . The uniform bound (26) then follows by bounding TVt(x<t)≤TVtTV_t(x_<t) _t and osc(μt(⋅,x<t))≤osc(μt)osc( _t(·;x_<t)) ( _t) pointwise for each prefix x<tx_<t. ∎ A-E Proof of Proposition 1 Proof. Expanding the definitions of αtη _t^η and RtηR_t^η gives q~tη q_t^η =(1−ηt)qt+ηtq~t =(1- _t)q_t+ _t q_t +ηt(1−ηt)(α¯t−α¯tsd)(Rt−Rtsd). + _t(1- _t)( α_t- α_t^sd)(R_t-R_t^sd). (51) Therefore, by the triangle inequality, TV(q~tη,qt) ( q_t^η,q_t) ≤ηtTV(q~t,qt) ≤ _tTV( q_t,q_t) +ηt(1−ηt)|α¯t−α¯tsd|TV(Rt,Rtsd). + _t(1- _t)| α_t- α_t^sd|TV(R_t,R_t^sd). (52) Taking uniform upper bounds over prefixes and substituting this result into Theorem 3 yields |Q~η[M]−Q[M]|≤min∑t=1T(ηtTVt+ϵt)It,1. |E_ Q^η[M]\!-\!E_Q[M] |\!≤\! \ _t=1^T( _tTV_t+ _t)I_t,1 \. (53) ∎ Appendix B Lossless Baseline Table XIV compares the PRR and SPD of lossless SD, average lossy SD, and SecureSD across four tasks and two model pairs. TABLE XIV: Lossless baseline. PRR and SPD are measured relative to target decoding. Lossy and SecureSD (STEP, L=1L=1) are averaged over six lossy-SD methods. Task PRR↑ SPD↑ (×) Lossless Lossy SecureSD Lossless Lossy SecureSD Qwen3-0.6B/8B Jailbreak 1.019 .782 1.052 1.049 1.543 1.569 Prompt Inj. .915 .700 .814 1.057 1.439 1.425 HumanEval .947 .874 .866 1.646 1.762 1.754 GSM8K 1.000 .932 .978 1.807 1.818 1.811 Llama3-1B/8B Jailbreak .909 .682 .724 1.326 1.736 1.754 Prompt Inj. .983 .755 .854 1.364 1.444 1.430 HumanEval .933 .814 .832 1.849 1.854 1.855 GSM8K .976 .915 .930 1.764 1.853 1.852 Appendix C Ethics Considerations Stakeholder Analysis Consider three stakeholder groups: ∙ Model providers and infrastructure operators who deploy LLM serving systems and develop serving frameworks (e.g., vLLM, TensorRT-LLM, and SGLang) that support lossy speculative decoding. Our findings reveal that relaxed verification, an efficiency optimization usually evaluated only on utility benchmarks, can substantially weaken jailbreak and prompt injection resilience. This can inform safer verification designs and the inclusion of security evaluation when tuning inference optimizations. The potential negative impact is that an adversary could preferentially target services that deploy aggressive relaxed verification. ∙ End users of LLM systems, whose safety depends on the target model’s alignment being preserved at inference time. They may benefit from defenses that keep the system’s behavior consistent with the safety-aligned target model, while unprotected lossy speculative decoding could expose them to more harmful responses or to unintended actions triggered by prompt injection in downstream applications. ∙ Researchers and practitioners studying LLM systems, who benefit from understanding that inference optimizations are security-relevant components. Our work characterizes the security–utility asymmetry and its origin in early-position draft tokens, and may motivate further defensive research, while this analysis could also guide attackers toward settings where existing defenses are weaker. Mitigation We took steps to minimize harm to the identified stakeholders and promote defensive progress. ∙ For model providers and infrastructure operators, a practical defense: Alongside the measurement, we propose SecureSD, which restores safety and security performance close to that of lossless speculative decoding while preserving efficiency and utility. ∙ For end users, no real-world harm: All experiments used public benchmarks (WildJailbreak, JailbreakBench, HarmBench, AdvBench, OpenPromptInjection, AgentDojo, HumanEval, and GSM8K) and open-weight models (Qwen3 and Llama3 families) deployed locally in controlled offline environments. We did not use private user data, interact with real users, or issue attack queries to production services. GPT-4o-mini is used only as an LLM-as-a-judge to classify model outputs, and we do not include harmful model generations in the paper. ∙ For researchers and practitioners, no new attack technique: All jailbreak and prompt injection inputs are drawn from existing public datasets, and our adaptive attack only applies a simple prefix-delaying transformation to them. We release the code of SecureSD and the Jailbreak-SD benchmark, which is constructed solely from existing public datasets, to support reproducible defensive research rather than to provide exploit guidance. Recommended Future Safeguards Real-world systems should incorporate safeguards addressing risks to both infrastructure operators and end users. Specifically, prior to deployment, systems utilizing relaxed verification must be evaluated against safety and security benchmarks alongside standard utility metrics, with acceptance rates capped at levels where any security degradation remains strictly tolerable. Justification for Research Lossy speculative decoding improves LLM inference efficiency and is already supported by mainstream serving frameworks, but its security implications remain largely unexplored. Identifying these risks and providing a practical defense is essential to ensure that efficiency gains do not silently compromise the safety and security of LLM systems. Appendix D Meta-Review The following meta-review was prepared by the program committee for the 2027 IEEE Symposium on Security and Privacy (S&P) as part of the review process as detailed in the call for papers. D-A Summary The paper studies lossy speculative decoding and identifies a security–utility asymmetry. The resilience of the system against jailbreak and prompt-injection degrades substantially earlier and faster than standard utility metrics. This is attributed to the disproportionate impact (and susceptibility) of the early tokens. To address this, the work proposes a defence – SecureSD – the lowers attack effectiveness. D-B Scientific Contributions • Identifies an Impactful Vulnerability • Provides a Valuable Step Forward in an Established Field D-C Reasons for Acceptance 1. The work identifies a new threat by observing that under lossy speculative decoding, the susceptibility of the attacks degrades faster than model utility. 2. The work introduces the first defence to address this – SecureSD – that relies on interpolating between the draft and judge models to get the output distribution closer to that of lossless speculative decoding. It leverages the known insight that early tokens have higher impact on attack effectiveness. D-D Noteworthy Concerns 1. The security guarantees of SecureSD and the evaluation of the adaptive attacks are a good first step, but overall limited. Appendix E Response to the Meta-Review We thank the reviewers and would like to clarify SecureSD’s scope. SecureSD mitigates the additional security degradation introduced by lossy speculative decoding, with target-only decoding as its security reference. It does not claim to eliminate the target model’s existing vulnerabilities or provide universal adversarial robustness. Our adaptive evaluation directly targets SecureSD’s design by delaying malicious generation beyond its early-token correction window. The results in Table 12 show that SecureSD retains mitigation benefits under this defense-aware attack. We acknowledge that evaluating more diverse adaptive strategies is an important direction for future work.