mlsanityData to 14 Oct 2026

The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs

arXiv 2507.11097 ↗First posted 15 Jul 2025cs.CLcited by 34

On the map: Efficient LLM inference and serving → Diffusion LLM and MoE inference

also in 1 more
Abstract (arXiv)

Diffusion-based large language models (dLLMs) have recently emerged as a powerful alternative to autoregressive LLMs, offering faster inference and greater interactivity via parallel decoding and bidirectional modeling. However, despite strong performance in code generation and text infilling, we identify a fundamental safety concern: existing alignment mechanisms fail to safeguard dLLMs against context-aware, masked-input adversarial prompts, exposing novel vulnerabilities. To this end, we present DIJA, the first systematic study and jailbreak attack framework that exploits unique safety weaknesses of dLLMs. Specifically, our proposed DIJA constructs adversarial interleaved mask-text prompts that exploit the text generation mechanisms of dLLMs, i.e., bidirectional modeling and parallel decoding. Bidirectional modeling drives the model to produce contextually consistent outputs for masked spans, even when harmful, while parallel decoding limits model dynamic filtering and rejection sampling of unsafe content. This causes standard alignment mechanisms to fail, enabling harmful completions in alignment-tuned dLLMs, even when harmful behaviors or unsafe instructions are directly exposed in the prompt. Through comprehensive experiments, we demonstrate that DIJA significantly outperforms existing jailbreak methods, exposing a previously overlooked threat surface in dLLM architectures. Notably, our method achieves up to 100% keyword-based ASR on Dream-Instruct, surpassing the strongest prior baseline, ReNeLLM, by up to 78.5% in evaluator-based ASR on JailbreakBench and by 37.7 points in StrongREJECT score, while requiring no rewriting or hiding of harmful content in the jailbreak prompt. Our findings underscore the urgent need for rethinking safety alignment in this emerging class of language models. Code is available at https://github.com/ZichenWen1/DIJA.

Key facts. Cited by 34 papers in the map (data through 14 Oct 2026). Placed in Diffusion LLM and MoE inference, one of 12 directions in Efficient LLM inference and serving. Builds on 58 of its 72 references that are in the map. First posted on arXiv 15 Jul 2025.

Builds on

58 of 72 references.

References · 58

  1. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  3. 2023GPT-4 Technical Reportcited by 18,396
  4. 2024The Llama 3 Herd of Modelscited by 14,715
  5. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  6. 2020Denoising Diffusion Implicit Modelscited by 9,781
  7. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  8. 2022Scalable Diffusion Models with Transformerscited by 6,054
  9. 2024Qwen2.5 Technical Reportcited by 4,942
  10. 2024GPT-4o System Cardcited by 4,588
  11. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  12. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,719
38 more
  1. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  4. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  5. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  6. 2023Discrete Diffusion Modeling by Estimating the Ratios of the Data Distributioncited by 745
  7. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  8. 2024Simplified and Generalized Masked Diffusion for Discrete Datacited by 626
  9. 2021Argmax Flows and Multinomial Diffusion: Learning Categorical Distributionscited by 574
  10. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  11. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  12. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  13. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  14. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  15. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  16. 2022A Continuous Time Framework for Discrete Denoising Modelscited by 451
  17. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
  18. 2023The Reversal Curse: LLMs trained on "A is B" fail to learn "B is A"cited by 407
  19. 2024A StrongREJECT for Empty Jailbreakscited by 385
  20. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  21. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  22. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 285
  23. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  24. 2025MMaDA: Multimodal Large Diffusion Language Modelscited by 250
  25. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 247
  26. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 244
  27. 2023Multilingual Jailbreak Challenges in Large Language Modelscited by 240
  28. 2025Mercury: Ultra-Fast Language Models Based on Diffusioncited by 235
  29. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  30. 2024Scaling up Masked Diffusion Models on Textcited by 199
  31. 2025DiffuCoder: Understanding and Improving Masked Diffusion Models for Code Generationcited by 187
  32. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 156
  33. 2025ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoningcited by 151
  34. 2025LLaDA-V: Large Language Diffusion Models with Visual Instruction Tuningcited by 148
  35. 2024DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakerscited by 101
  36. 2025LaViDa: A Large Diffusion Language Model for Multimodal Understandingcited by 84
  37. 2023Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinkingcited by 81
  38. 2024MJ-Bench: Is Your Multimodal Reward Model Really a Good Judge for Text-to-Image Generation?cited by 66

50 most cited of 58 All 58 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 8; 2026: 26.

34 papers.

Sort:

By area:

  1. 2025AudioMarathon: A Comprehensive Benchmark for Long-Context Audio Understanding and Efficiency in Audio LLMscited by 22
  2. 2025Prune2Drive: A Plug-and-Play Framework for Accelerating Vision-Language Models in Autonomous Drivingcited by 16
  3. 2025Thinking Inside the Mask: In-Place Prompting in Diffusion LLMscited by 13
  4. 2025DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Modelscited by 12
  5. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerabilitycited by 10
  6. 2025A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Modelscited by 9
  7. 2025D3ToM: Decider-Guided Dynamic Token Merging for Accelerating Diffusion MLLMscited by 5
  8. 2025Every Step Counts: Decoding Trajectories as Authorship Fingerprints of dLLMscited by 4
  9. 2026Safer by Diffusion, Broken by Context: Diffusion LLM's Safety Blessing and Its Failure Modecited by 4
  10. 2026Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Modelscited by 2
  11. 2026Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Modelscited by 2
  12. 2026The Safety-Aware Denoiser for Text Diffusion Modelscited by 2
22 more
  1. 2026TrustLDM: Benchmarking Trustworthiness in Language Diffusion Modelscited by 2
  2. 2026Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Modelscited by 1
  3. 2026Differences in Text Generated by Diffusion and Autoregressive Language Modelscited by 1
  4. 2026Adaptive Steering and Remasking for Safe Generation in Diffusion Language Modelscited by 1
  5. 2026MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Modelscited by 1
  6. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Modelscited by 1
  7. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploitscited by 1
  8. 2026GPO-V: Jailbreak Diffusion Vision Language Model by Global Probability Optimizationcited by 0
  9. 2026BadDLM: Backdooring Diffusion Language Models with Diverse Targetscited by 0
  10. 2026Backdooring Masked Diffusion Language Modelscited by 0
  11. 2026Extracting Training Data from Diffusion Language Models via Infillingcited by 0
  12. 2026DAIN: Dynamic Agent-Based Interaction Network for Efficient and Collaborative Multimodal Reasoningcited by 0
  13. 2026ProWAFT: A ROMA-LPD Instance for Workload-Aware and Dynamic Fault Tolerance in FPGA-Based CNN Acceleratorscited by 0
  14. 2026Subliminal Clocks: Latent Time Modelling in Diffusion Language Modelscited by 0
  15. 2026Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Modelscited by 0
  16. 2026Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Modelscited by 0
  17. 2026DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Modelscited by 0
  18. 2026In-Place Instruction Following in Diffusion Language Modelscited by 0
  19. 2026Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysiscited by 0
  20. 2026FastGuide: Accelerating Reward Guidance for Diffusion Large Language Modelscited by 0
  21. 2026Noise Out, Bias In: Targeted Bias Injection in Diffusion Language Models via Closed-Loop Activation Steeringcited by 0
  22. 2026The Tokens Strike Back: Safety-Aware Denoising with Directional Embedding-based Revisioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation
  2. 2025Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Position
  3. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks
  4. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  5. 2026Adversarial Reframing: A Framework for Targeted Generation in Language Models
  6. 2025AdversariaLLM: A Unified and Modular Toolbox for LLM Robustness Research
  7. 2025Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs
  8. 2025BitBypass: A New Direction in Jailbreaking Aligned Large Language Models with Bitstream Camouflage