推测解码泄露用户查询，攻击者可凭数据包特征识别输入内容。
When Speculation Spills Secrets: Side Channels via Speculative Decoding In LLMs
- 通过监控每轮生成的正确/错误候选词数量，提取输入指纹。
- 在温度0.3时，4种方案下识别准确率超75%，最高达100%。
- 适合关注LLM安全、侧信道防御的研究者与部署工程师。
部署的大语言模型常采用推测解码技术并行生成和验证多个候选词以提升吞吐量与降低延迟。本文揭示了一种新型侧信道攻击：通过监测每轮迭代的词元数量或数据包大小，攻击者可推断出与输入相关的推测模式。在研究原型与生产级vLLM服务框架上的实验表明，攻击者能以超过75%的准确率（温度0.3）区分50个提示中的用户查询——REST（100%）、LADE（91.6%）、BiLD（95.2%）、EAGLE（77.6%）。即使在温度1.0下，准确率仍远高于2%随机基线（REST 99.6%、LADE 61.2%、BiLD 63.6%、EAGLE 24%）。此外，攻击者还可以超过25词元/秒的速度泄露用于预测的机密数据存储内容。为此，我们提出并评估了包括数据包填充与迭代级词元聚合在内的多种缓解方案。
原文摘要 · Abstract (English)
Deployed large language models (LLMs) often rely on speculative decoding, a technique that generates and verifies multiple candidate tokens in parallel, to improve throughput and latency. In this work, we reveal a new side-channel whereby input-dependent patterns of correct and incorrect speculations can be inferred by monitoring per-iteration token counts or packet sizes. In evaluations using research prototypes and production-grade vLLM serving frameworks, we show that an adversary monitoring these patterns can fingerprint user queries (from a set of 50 prompts) with over 75% accuracy across four speculative-decoding schemes at temperature 0.3: REST (100%), LADE (91.6%), BiLD (95.2%), and EAGLE (77.6%). Even at temperature 1.0, accuracy remains far above the 2% random baseline - REST (99.6%), LADE (61.2%), BiLD (63.6%), and EAGLE (24%). We also show the capability of the attacker to leak confidential datastore contents used for prediction at rates exceeding 25 tokens/sec. To defend against these, we propose and evaluate a suite of mitigations, including packet padding and iteration-wise token aggregation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。