Adversarial speculative reasoning paper — rejecting drafts on purpose — What does it mean?

The news. On November 3, 2026, researchers at Subconscious Systems posted Subconscious Adversarial Speculative Reasoning Improves Long Horizon Agents. They measured that speculative verification adds more numerical noise to later slots of a block, then trained the draft model to be rejected at an agent's decision points. On the DeepSWE coding benchmark, GLM-5.3-nvfp4 rose from 60.6% to 67.6% with the target model unchanged. Read the paper →

Picture the clerk with a stack of forms. Each verification pass is one page: the clerk stamps all the lines at once, and the ink gets fainter the further down a line sits. Line 0 is as crisp as a single stamp; by the last line, large smudges are about twice as common. An ordinary assistant (the draft) hands over lines the clerk agrees with, so the signature line lands wherever it happens to fall, often low on the page where the stamp is faint. The adversarial assistant proposes the side to avoid at the signature line, and writes routine lines as usual. The clerk crosses it out and rewrites the line at the top of a fresh page, where the stamp is sharpest. The clerk and the stamping rule stay the same; only the position of the ink moves.

Start with what speculative decoding promises. The target scores a block of draft tokens in one forward pass, and the rejection-sampling rule (see the verification algorithm) accepts a prefix and resamples the first rejected position, so every committed token follows the target's distribution. That guarantee is stated for an idealized target, a fixed function from prefix to distribution. Hosted models are not fixed functions: the paper points to low-precision weights, quantized KV caches and sparse attention. The authors reran the same forward pass on an identical prefix and compared top-k log-probabilities. On GLM-5.3 with an 8-token DFlash block, slot 0 is exactly as noisy as single-token decoding, and noise then grows by roughly 4% per slot, with log-probability shifts above 2 nats nearly twice as common at the last slot. DeepSeek-V4.1-Flash with a 6-token DSPARK block shows about half the absolute noise but the same roughly 4% growth. Verification is lossless in distribution but not neutral in precision.

The draft cannot change what the target outputs, but it does control where blocks end. When the draft is rejected, the replacement token is sampled from the residual distribution and becomes slot 0 of the next verification block, so its KV entries, and those of the tokens after it, are computed from the most precise slot. A draft trained only for acceptance agrees through routine text and into a decision, so where the decision lands is chance. The adversarial draft proposes, at decision points, the side the target should reject; elsewhere it stays an ordinary high-acceptance draft. This differs from relaxing verification to steer outputs (see relaxed vs exact verification): here verification stays exact. The trained draft is a draft-model variant.

Finding the decision points is itself automated. A judge, the target model itself, labels each stretch of reasoning and returns the committing sentence verbatim, at most 35 words. Preferences then split behavior at that point into a good side and a bad side. On GLM-5.3, decisions framed by principle or evidence were correct about 70% of the time against 36% for decisions framed by likelihood or risk; on DeepSeek-V4.1-Flash the preferred side is running a test before committing to a plan. The draft is trained with DPO on fork pairs, two continuations sharing every token up to the decision, in the reverse direction: it learns to favor the side the target should avoid. The good decision, when the target makes it, then arrives through resampling at slot 0, while the bad one is proposed by the draft and accepted from noisier later slots. Note what this does not do: it cannot make the target reason better, it only changes how precisely the good decisions are written, which is why this is a planning-and-reflection tool rather than a model upgrade.

A worked example shows the cost side (illustrative, using the paper's DeepSeek-V4.1-Flash figures of 2.5 expected accepted draft tokens per block before training and 2.46 after). Assume one target token is also committed per verification step. Hold the agent turn at 10,000 generated tokens. Before training that is 3.5 tokens per step, so about 2,857 steps; after training it is 3.46 tokens per step, so about 2,890 steps. That is roughly 33 extra verification steps, about 1.2% more, for a decision-making accuracy gain. On GLM-5.3 the expected accepted length was 2.28 both before and after. The paper summarizes the trade as up to about 2% decoding speed.

What the paper reports

DeepSWE reports the share of 113 tasks whose hidden tests all pass; NL2Repo-Bench reports mean test pass rate over 104 generated repositories. Both targets are served with only the draft swapped. The gain is reportedly not from a better model, because the verified distribution did not change. The authors' explanation, that decisions written at higher precision persist better over a long horizon, is stated as a hypothesis, and the evidence is two targets, two draft architectures and two coding benchmarks. The trained part is small: 0.06% to 0.28% of hosted parameters, for example the 2.15B parameters of the transformer layers in GLM-5.3's DFlash draft.

Goes deeper in: LLM Serving → Speculative Decoding → The Verification Algorithm

Related explainers

• RCSD — accept/reject draft training — another way to train a draft from accept and reject signals
• Relaxed vs exact verification — the opposite choice: loosen the verifier instead
• PPOW — window-level RL for drafters — the acceptance-length view of draft training
• Prefix-cache nondeterminism in agents — another way serving-side numerical noise reaches agent behavior