mlsanityData to 14 Oct 2026

Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Position

arXiv 2508.12398 ↗First posted 17 Aug 2025cs.CR cs.AI cs.CLcited by 11

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Diffusion Large Language Models (dLLMs) have recently emerged as a competitive non-autoregressive paradigm due to their unique training and inference approach. However, there is currently a lack of safety study on this novel architecture. In this paper, we present the first analysis of dLLMs' safety performance and propose a novel safety alignment method tailored to their unique generation characteristics. Specifically, we identify a critical asymmetry between the defender and attacker in terms of security. For the defender, we reveal that the middle tokens of the response, rather than the initial ones, are more critical to the overall safety of dLLM outputs; this seems to suggest that aligning middle tokens can be more beneficial to the defender. The attacker, on the contrary, may have limited power to manipulate middle tokens, as we find dLLMs have a strong tendency towards a sequential generation order in practice, forcing the attack to meet this distribution and diverting it from influencing the critical middle tokens. Building on this asymmetry, we introduce Middle-tOken Safety Alignment (MOSA), a novel method that directly aligns the model's middle generation with safe refusals exploiting reinforcement learning. We implement MOSA and compare its security performance against eight attack methods on two benchmarks. We also test the utility of MOSA-aligned dLLM on coding, math, and general reasoning. The results strongly prove the superiority of MOSA.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 37 of its 52 references that are in the map. First posted on arXiv 17 Aug 2025.

Builds on

37 of 52 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  2. 2024Uncovering Logit Suppression Vulnerabilities in LLM Safety Alignment20 May

Other references · 35

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  4. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  6. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  8. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,719
  9. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  10. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  11. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  12. 2024Simple and Effective Masked Diffusion Language Modelscited by 848
23 more
  1. 2020Aligning AI With Shared Human Valuescited by 723
  2. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  3. 2024Simplified and Generalized Masked Diffusion for Discrete Datacited by 626
  4. 2021Argmax Flows and Multinomial Diffusion: Learning Categorical Distributionscited by 574
  5. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  6. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  7. 2022A Continuous Time Framework for Discrete Denoising Modelscited by 451
  8. 2024Your Absorbing Discrete Diffusion Secretly Models the Conditional Distributions of Clean Datacited by 381
  9. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 285
  10. 2024Scaling Diffusion Language Models via Adaptation from Autoregressive Modelscited by 274
  11. 2025MMaDA: Multimodal Large Diffusion Language Modelscited by 250
  12. 2022DiffusionBERT: Improving Generative Masked Language Models with Diffusion Modelscited by 214
  13. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulationcited by 214
  14. 2024Scaling up Masked Diffusion Models on Textcited by 199
  15. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMscited by 172
  16. 2023AR-Diffusion: Auto-Regressive Diffusion Model for Text Generationcited by 118
  17. 2024AdvPrefix: An Objective for Nuanced LLM Jailbreakscited by 25
  18. 2025Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactionscited by 15
  19. 2025Dialogue Injection Attack: Jailbreaking LLMs through Context Manipulationcited by 14
  20. 2024An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizercited by 11
  21. 2025Adversarial Preference Learning for Robust LLM Alignmentcited by 7
  22. 2024Alignment with Preference Optimization Is All You Need for LLM Safetycited by 5
  23. 2025Exploiting Prefix-Tree in Structured Output Interfaces for Enhancing Jailbreak Attackingcited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 7.

11 papers.

  1. 2025DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Modelscited by 12
  2. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerabilitycited by 10
  3. 2025A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Modelscited by 9
  4. 2025Every Step Counts: Decoding Trajectories as Authorship Fingerprints of dLLMscited by 4
  5. 2026Safer by Diffusion, Broken by Context: Diffusion LLM's Safety Blessing and Its Failure Modecited by 4
  6. 2026Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Modelscited by 2
  7. 2026MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Modelscited by 1
  8. 2026Backdooring Masked Diffusion Language Modelscited by 0
  9. 2026Robust and Generalizable Safety Steering for Text-to-Image Diffusion Transformerscited by 0
  10. 2026Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Modelscited by 0
  11. 2026DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
  2. 2025Safety Alignment Depth in Large Language Models: A Markov Chain Perspective
  3. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs
  4. 2026Aligned but Fragile: Enhancing LLM Safety Robustness via Zeroth-Order Optimization
  5. 2024Towards Comprehensive Post Safety Alignment of Large Language Models via Safety Patching
  6. 2026When Autoregressive Consistency Hurts Safety Alignment
  7. 2026Safety at One Shot: Patching Fine-Tuned LLMs with A Single Instance
  8. 2025On Almost Surely Safe Alignment of Large Language Models at Inference-Time