Inference Optimization Attacks

Speculative decoding attacks, batching vulnerabilities, continuous batching exploitation, and how optimization for speed creates security gaps in LLM inference.

Production LLM deployments optimize aggressively for throughput and latency. Inference optimizations -- speculative decoding, continuous batching, flash attention, tensor parallelism -- each introduce distinct attack surfaces. The core tension is that sharing computation across requests improves efficiency but creates cross-request interference channels.

Speculative Decoding Attacks

Speculative decoding uses a small draft model to predict tokens that the large target model verifies. Accepted predictions skip expensive target model forward passes.

Architecture

┌──────────────┐     Candidate tokens     ┌──────────────┐
│  Draft Model │ ──────────────────────── │ Target Model  │
│  (1-3B)      │  "The quick brown fox"   │ (70B+)        │
│  Fast, cheap │ ────────────────────────│ Slow, accurate│
└──────────────┘     Accept/Reject        └──────────────┘

Attack Vector: Draft Model Manipulation

The draft model is smaller, less robust, and often less aligned than the target model. If an attacker can manipulate the draft model (through supply chain or model replacement), accepted tokens bypass the target model's safety properties:

# Speculative decoding verification
def speculative_verify(draft_tokens, target_model, prompt):
    """Target model checks draft predictions in parallel."""
    target_logits = target_model(prompt + draft_tokens)
 
    accepted = []
    for i, token in enumerate(draft_tokens):
        draft_prob = draft_model_prob(token, context=prompt + accepted)
        target_prob = target_logits[i].softmax(-1)[token].item()
 
        # Accept if target model agrees (modified rejection sampling)
        if random.random() < min(1, target_prob / draft_prob):
            accepted.append(token)
        else:
            # Resample from adjusted distribution
            corrected = resample(target_logits[i], draft_logits[i])
            accepted.append(corrected)
            break  # reject remaining draft tokens
 
    return accepted

Continuous Batching Vulnerabilities

Continuous batching (also called iteration-level batching) dynamically adds and removes requests from a running batch. This creates several cross-request channels.

Cross-Request Interference

In a continuous batch, all requests share the same forward pass through the model. Although requests use separate KV caches and attention masks, they share:

Timing Side-Channel via Batching

import time
import asyncio
 
async def probe_batch_occupancy(api_url: str) -> dict:
    """Measure latency variance to infer batch occupancy.
    High variance = dynamic batching with variable load.
    Consistent fast = low occupancy.
    Consistent slow = high occupancy."""
 
    latencies = []
    for _ in range(50):
        start = time.perf_counter()
        await send_request(api_url, "Hello", max_tokens=1)
        latencies.append(time.perf_counter() - start)
        await asyncio.sleep(0.1)
 
    return {
        "mean": sum(latencies) / len(latencies),
        "variance": variance(latencies),
        "min": min(latencies),
        "max": max(latencies),
    }

Flash Attention Security Considerations

Flash Attention computes exact attention but changes the memory access pattern. While it produces identical mathematical results to standard attention, implementation bugs can create vulnerabilities:

Tensor Parallelism Side Channels

Tensor parallelism splits model layers across GPUs. Inter-GPU communication (via NVLink or InfiniBand) creates network-observable side channels:

Exploitable Signals

1. Communication volume -- Activation tensor sizes correlate with input sequence length
2. Timing patterns -- AllReduce synchronization creates observable latency patterns
3. Memory allocation -- GPU memory usage visible through NVIDIA management APIs on shared systems

# On shared GPU systems, monitor peer GPU memory usage
# to infer other tenants' inference patterns
import pynvml
pynvml.nvmlInit()
 
def monitor_peer_gpu_memory(gpu_indices: list, duration_s: float):
    """Sample GPU memory usage to detect inference activity."""
    samples = []
    start = time.time()
    while time.time() - start < duration_s:
        snapshot = {}
        for idx in gpu_indices:
            handle = pynvml.nvmlDeviceGetHandleByIndex(idx)
            info = pynvml.nvmlDeviceGetMemoryInfo(handle)
            snapshot[idx] = info.used
        samples.append(snapshot)
        time.sleep(0.01)
    return samples

Optimization Security Trade-off Matrix

Assessment Methodology

1. 1

   Map the inference stack

   Identify which optimizations are enabled: speculative decoding, continuous batching, prefix caching, quantization level, parallelism strategy.

2. 2

   Test cross-request interference

   Send concurrent requests with known content and measure whether one request's characteristics (length, content, timing) are observable from another.

3. 3

   Profile timing side channels

   Measure latency distributions under varying server load to characterize the information leakage through timing.

4. 4

   Verify draft model integrity

   If speculative decoding is used, verify the draft model's provenance and safety properties independently.

5. 5

   Document trade-offs

   Report which optimizations create what risk level, with recommendations for the deployment's specific threat model.

Related Topics

• Model Architecture Attack Vectors -- Architecture attack surface overview
• KV Cache Poisoning -- Cache-specific attacks
• Quantization Attacks -- Precision reduction risks
• API Security -- Application-layer inference security

References

• Fast Inference from Transformers via Speculative Decoding (Leviathan et al., 2023) -- Speculative decoding
• Orca: A Distributed Serving System for Transformer-Based Generative Models (Yu et al., 2022) -- Continuous batching