mlsanityData to 14 Oct 2026

A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models

arXiv 2509.23286 ↗First posted 27 Sep 2025cs.CL cs.AIcited by 9

On the map: Diffusion models → Discrete and text diffusion

also in 2 more
Abstract (arXiv)

Diffusion large language models (dLLMs) enable any-order generation, but this flexibility enlarges the attack surface: harmful spans may appear at arbitrary positions, and template-based prefilling attacks such as DIJA bypass response-level refusals. We introduce A2D (Any-Order, Any-Step Defense), a token-level alignment method that aligns dLLMs to emit an [EOS] refusal signal whenever harmful content arises. By aligning safety directly at the token-level under randomized masking, A2D achieves robustness to both any-decoding-order and any-step prefilling attacks under various conditions. It also enables real-time monitoring: dLLMs may begin a response but automatically terminate if unsafe continuation emerges. On safety benchmarks, A2D consistently prevents the generation of harmful outputs, slashing DIJA success rates from over 80% to near-zero (1.3% on LLaDA-8B-Instruct, 0.0% on Dream-v0-Instruct-7B), and thresholded [EOS] probabilities allow early rejection, yielding up to 19.3x faster safe termination.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in Discrete and text diffusion, one of 14 directions in Diffusion models. Builds on 66 of its 70 references that are in the map. First posted on arXiv 27 Sep 2025.

Builds on

66 of 70 references.

Closest ancestors · 11

Same direction, newest first

  1. 2025DiffuCoder: Understanding and Improving Masked Diffusion Models for Code Generation25 Jun
  2. 2025Discrete Diffusion in Large Language and Multimodal Models: A Survey16 Jun
  3. 2025Accelerated Sampling from Masked Diffusion Models via Entropy Bounded Unmasking30 May
  4. 2025Dimple: Discrete Diffusion Multimodal Large Language Model with Parallel Decoding22 May
  5. 2025Large Language Diffusion Models14 Feb
  6. 2025Train for the Worst, Plan for the Best: Understanding Token Ordering in Masked Diffusions10 Feb
  7. 2024Simplified and Generalized Masked Diffusion for Discrete Data6 Jun
  8. 2024Your Absorbing Discrete Diffusion Secretly Models the Conditional Distributions of Clean Data6 Jun
  9. 2023Discrete Diffusion Modeling by Estimating the Ratios of the Data Distribution25 Oct
  10. 2022DiffusionBERT: Improving Generative Masked Language Models with Diffusion Models28 Nov
  11. 2022SSD-LM: Semi-autoregressive Simplex-based Diffusion Language Model for Text Generation and Modular Control31 Oct

Other references · 55

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  5. 2025Qwen3 Technical Reportcited by 8,820
  6. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  7. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  8. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  9. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,886
  10. 2024GPT-4o System Cardcited by 4,588
  11. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,100
  12. 2017Deep reinforcement learning from human preferencescited by 3,912
38 more
  1. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
  2. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  3. 2021Program Synthesis with Large Language Modelscited by 3,637
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  5. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  6. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
  7. 2019PIQA: Reasoning about Physical Commonsense in Natural Languagecited by 2,883
  8. 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,879
  9. 2024Qwen2 Technical Reportcited by 2,120
  10. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,719
  11. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  13. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  14. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  15. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  16. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  17. 2023RLAIF vs. RLHF: Scaling Reinforcement Learning from Human Feedback with AI Feedbackcited by 625
  18. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  19. 2024Large Language Models: A Surveycited by 525
  20. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  21. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  22. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  23. 2024A StrongREJECT for Empty Jailbreakscited by 385
  24. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  25. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 285
  26. 2024PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preferencecited by 261
  27. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  28. 2025MMaDA: Multimodal Large Diffusion Language Modelscited by 250
  29. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 244
  30. 2025Mercury: Ultra-Fast Language Models Based on Diffusioncited by 235
  31. 2025LLaDA-V: Large Language Diffusion Models with Visual Instruction Tuningcited by 148
  32. 2024Attacks, Defenses and Evaluations for LLM Conversation Safety: A Surveycited by 130
  33. 2025Accelerating Diffusion LLMs via Adaptive Parallel Decodingcited by 112
  34. 2025LaViDa: A Large Diffusion Language Model for Multimodal Understandingcited by 84
  35. 2025STAIR: Improving Safety Alignment with Introspective Reasoningcited by 77
  36. 2025Open Problems in Machine Unlearning for AI Safetycited by 51
  37. 2023Bypassing the Safety Training of Open-Source LLMs with Priming Attackscited by 50
  38. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMscited by 34

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 9.

9 papers.

  1. 2026Safer by Diffusion, Broken by Context: Diffusion LLM's Safety Blessing and Its Failure Modecited by 4
  2. 2026Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Modelscited by 2
  3. 2026Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Modelscited by 1
  4. 2026Adaptive Steering and Remasking for Safe Generation in Diffusion Language Modelscited by 1
  5. 2026MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Modelscited by 1
  6. 2026Machine Unlearning for Masked Diffusion Language Modelscited by 0
  7. 2026Backdooring Masked Diffusion Language Modelscited by 0
  8. 2026D2-Monitor: Dynamic Safety Monitoring for Diffusion LLMs via Hesitation Signalscited by 0
  9. 2026Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
  2. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerability
  3. 2025DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models
  4. 2025Any-Depth Alignment: Unlocking Innate Safety Alignment of LLMs to Any-Depth
  5. 2026Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
  6. 2026When Autoregressive Consistency Hurts Safety Alignment
  7. 2025Decoding One Safety Trigger Token for Balancing Safety and Usability in Large Language Models
  8. 2025Differentiated Directional Intervention A Framework for Evading LLM Safety Alignment