Mistletoe: A Stealthy Acceleration-Collapse Attack Against Speculative Decoding in Large Language Models

Researchers propose a stealthy attack method against speculative decoding in large language models, Mistletoe, which can substantially weaken inference acceleration while maintaining output quality and perplexity. The attack exploits the hidden attack surface formed by the unavoidable mismatch between the draft model and target model distributions, jointly optimizing a degradation objective that reduces draft-target consistency and a semantic preservation objective that constrains the target model's output distribution, and introduces a null-space projection mechanism that projects the degradation gradient outside the local semantic preservation direction to resolve the conflict between the two objectives. Experiments on various speculative decoding systems show that Mistletoe significantly reduces the average acceptance length τ, causing acceleration to collapse and lowering average token throughput. The authors point out that speculative decoding introduces a mechanism-level attack surface beyond existing output robustness, and LLM acceleration systems need more robust designs.