Speedbumps: Rejection Attacks on Speculative Decoding
The research introduces Speedbump, an adversarial suffix attack that exploits how draft and target models interact during speculative decoding. By appending a malicious suffix, attackers can force the system to reject more draft tokens early in the process. This increases the number of required target model forward passes per generated token, effectively inflating inference costs without changing output quality.