mlsanityData to 14 Oct 2026

Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation

arXiv 2507.19227 ↗First posted 25 Jul 2025cs.CLcited by 26

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 3 more
Abstract (arXiv)

Large Language Diffusion Models (LLDMs) exhibit comparable performance to LLMs while offering distinct advantages in inference speed and mathematical reasoning tasks.The precise and rapid generation capabilities of LLDMs amplify concerns of harmful generations, while existing jailbreak methodologies designed for Large Language Models (LLMs) prove limited effectiveness against LLDMs and fail to expose safety vulnerabilities.Successful defense cannot definitively resolve harmful generation concerns, as it remains unclear whether LLDMs possess safety robustness or existing attacks are incompatible with diffusion-based architectures.To address this, we first reveal the vulnerability of LLDMs to jailbreak and demonstrate that attack failure in LLDMs stems from fundamental architectural differences.We present a PArallel Decoding jailbreak (PAD) for diffusion-based language models. PAD introduces Multi-Point Attention Attack, which guides parallel generative processes toward harmful outputs that inspired by affirmative response patterns in LLMs. Experimental evaluations across four LLDMs demonstrate that PAD achieves jailbreak attack success rates by 97%, revealing significant safety vulnerabilities. Furthermore, compared to autoregressive LLMs of the same size, LLDMs increase the harmful generation speed by 2x, significantly highlighting risks of uncontrolled misuse.Through comprehensive analysis, we provide an investigation into LLDM architecture, offering critical insights for the secure deployment of diffusion-based language models.

Key facts. Cited by 26 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 26 of its 34 references that are in the map. First posted on arXiv 25 Jul 2025.

Builds on

26 of 34 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr

Other references · 25

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2022Training language models to follow instructions with human feedbackcited by 15,971
  4. 2024The Llama 3 Herd of Modelscited by 14,715
  5. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,719
  6. 2024A Survey on LLM-as-a-Judgecited by 1,423
  7. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  8. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  10. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Ciphercited by 423
  11. 2025Fast-dLLM: Training-free Acceleration of Diffusion LLM by Enabling KV Cache and Parallel Decodingcited by 420
  12. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 387
13 more
  1. 2023Principle-Driven Self-Alignment of Language Models from Scratch with Minimal Human Supervisioncited by 318
  2. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 285
  3. 2025MMaDA: Multimodal Large Diffusion Language Modelscited by 250
  4. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  5. 2022DiffusionBERT: Improving Generative Masked Language Models with Diffusion Modelscited by 214
  6. 2024Scaling up Masked Diffusion Models on Textcited by 199
  7. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 192
  8. 2022The Carbon Footprint of Machine Learning Training Will Plateau, Then Shrinkcited by 184
  9. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 175
  10. 2025dLLM-Cache: Accelerating Diffusion Large Language Models with Adaptive Cachingcited by 169
  11. 2025LLaDA-V: Large Language Diffusion Models with Visual Instruction Tuningcited by 148
  12. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialoguecited by 66
  13. 2024ChatBug: A Common Vulnerability of Aligned LLMs Induced by Chat Templatescited by 30

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 22.

26 papers.

Sort:

By area:

  1. 2025DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Modelscited by 12
  2. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerabilitycited by 10
  3. 2025A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Modelscited by 9
  4. 2025Every Step Counts: Decoding Trajectories as Authorship Fingerprints of dLLMscited by 4
  5. 2026Safer by Diffusion, Broken by Context: Diffusion LLM's Safety Blessing and Its Failure Modecited by 4
  6. 2026Unsafe by Reciprocity: How Generation-Understanding Coupling Undermines Safety in Unified Multimodal Modelscited by 2
  7. 2026Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Modelscited by 2
  8. 2026The Safety-Aware Denoiser for Text Diffusion Modelscited by 2
  9. 2026TrustLDM: Benchmarking Trustworthiness in Language Diffusion Modelscited by 2
  10. 2026Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Modelscited by 1
  11. 2026Differences in Text Generated by Diffusion and Autoregressive Language Modelscited by 1
  12. 2026MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Modelscited by 1
14 more
  1. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Modelscited by 1
  2. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploitscited by 1
  3. 2026GPO-V: Jailbreak Diffusion Vision Language Model by Global Probability Optimizationcited by 0
  4. 2026BadDLM: Backdooring Diffusion Language Models with Diverse Targetscited by 0
  5. 2026Machine Unlearning for Masked Diffusion Language Modelscited by 0
  6. 2026Backdooring Masked Diffusion Language Modelscited by 0
  7. 2026Extracting Training Data from Diffusion Language Models via Infillingcited by 0
  8. 2026Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Modelscited by 0
  9. 2026Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Modelscited by 0
  10. 2026DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Modelscited by 0
  11. 2026In-Place Instruction Following in Diffusion Language Modelscited by 0
  12. 2026Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysiscited by 0
  13. 2026Noise Out, Bias In: Targeted Bias Injection in Diffusion Language Models via Closed-Loop Activation Steeringcited by 0
  14. 2026The Tokens Strike Back: Safety-Aware Denoising with Directional Embedding-based Revisioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024DiffusionAttacker: Diffusion-Driven Prompt Manipulation for LLM Jailbreak
  2. 2024Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models
  3. 2026Defending Large Language Models Against Jailbreak Attacks via In-Decoding Safety-Awareness Probing
  4. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs
  5. 2023Latent Jailbreak: A Benchmark for Evaluating Text Safety and Output Robustness of Large Language Models
  6. 2024An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks
  7. 2024Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspective
  8. 2025EquaCode: A Multi-Strategy Jailbreak Approach for Large Language Models via Equation Solving and Code Completion