mlsanityData to 14 Oct 2026

DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models

arXiv 2509.24296 ↗First posted 29 Sep 2025cs.CL cs.AIcited by 12

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

The rapid advancement of Diffusion Large Language Models (dLLMs) introduces unprecedented vulnerabilities that are fundamentally distinct from Autoregressive LLMs, stemming from their iterative and parallel generation mechanisms. In this paper, we conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics. Experimental results reveal a harmful bias inherent in the standard greedy remasking strategy and identify a critical phenomenon we term Denoising-path Dependence, where the safety of early-stage tokens decisively influences the final output. These findings also indicate that while current decoding strategies constitute a significant vulnerability, dLLMs possess a substantial intrinsic safety potential. To unlock this potential, we propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach: Stochastic Annealing Remasking dynamically introduces controlled randomness to mitigate greedy selection bias, while Block-level Audit and Repair exploits internal model representations for autonomous risk detection and guided correction. Comprehensive experiments on four dLLMs demonstrate DiffuGuard's exceptional effectiveness, reducing Attack Success Rate against six diverse jailbreak methods from 47.9% to 14.7% while preserving model utility and efficiency. Our code is available at: https://github.com/niez233/DiffuGuard.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 56 of its 68 references that are in the map. First posted on arXiv 29 Sep 2025.

Builds on

56 of 68 references.

Closest ancestors · 17

Same direction, newest first

  1. 2025Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation25 Jul
  2. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs15 Jul
  3. 2025KDA: A Knowledge-Distilled Attacker for Generating Diverse Prompts to Jailbreak LLMs5 Feb
  4. 2024FlipAttack: Jailbreak LLMs via Flipping2 Oct
  5. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models26 Jun
  6. 2024How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden States9 Jun
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  8. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue27 Feb
  9. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  10. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
  11. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
5 more
  1. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  2. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  3. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM18 Sep
  4. 2023Detecting Language Model Attacks with Perplexity27 Aug
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 39

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  3. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  4. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  5. 2023A Survey of Large Language Modelscited by 2,576
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  7. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  8. 2025Large Language Diffusion Modelscited by 912
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  10. 2025Dream 7B: Diffusion Large Language Modelscited by 544
  11. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  12. 2022DiffuSeq: Sequence to Sequence Text Generation with Diffusion Modelscited by 450
27 more
  1. 2025Fast-dLLM: Training-free Acceleration of Diffusion LLM by Enabling KV Cache and Parallel Decodingcited by 420
  2. 2025Block Diffusion: Interpolating Between Autoregressive and Diffusion Language Modelscited by 409
  3. 2023Principle-Driven Self-Alignment of Language Models from Scratch with Minimal Human Supervisioncited by 318
  4. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 285
  5. 2025Mercury: Ultra-Fast Language Models Based on Diffusioncited by 235
  6. 2024Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Promptscited by 205
  7. 2025d1: Scaling Reasoning in Diffusion Large Language Models via Reinforcement Learningcited by 186
  8. 2025Seed Diffusion: A Large-Scale Diffusion Language Model with High-Speed Inferencecited by 178
  9. 2025dLLM-Cache: Accelerating Diffusion Large Language Models with Adaptive Cachingcited by 169
  10. 2025LLaDA-V: Large Language Diffusion Models with Visual Instruction Tuningcited by 148
  11. 2025Safety Tax: Safety Alignment Makes Your Large Reasoning Models Less Reasonablecited by 122
  12. 2025Accelerating Diffusion LLMs via Adaptive Parallel Decodingcited by 112
  13. 2025GuardReasoner: Towards Reasoning-based LLM Safeguardscited by 100
  14. 2025A Survey on Diffusion Language Modelscited by 78
  15. 2022SeqDiffuSeq: Text Diffusion with Encoder-Decoder Transformerscited by 64
  16. 2025Discrete Diffusion in Large Language and Multimodal Models: A Surveycited by 61
  17. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 42
  18. 2025Beyond Fixed: Training-Free Variable-Length Denoising for Diffusion Large Language Modelscited by 34
  19. 2025Time Is a Feature: Exploiting Temporal Dynamics in Diffusion Language Modelscited by 33
  20. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
  21. 2025How Should We Enhance the Safety of Large Reasoning Models: An Empirical Studycited by 18
  22. 2025Exploring the Potential of Diffusion Large Language Models in Code Generationcited by 16
  23. 2025Unveiling the Potential of Diffusion Large Language Model in Controllable Generationcited by 15
  24. 2025Thinking Inside the Mask: In-Place Prompting in Diffusion LLMscited by 13
  25. 2025Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Positioncited by 11
  26. 2024DiffLM: Controllable Synthetic Data Generation via Diffusion Language Modelscited by 9
  27. 2025DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Promptcited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 12.

12 papers.

  1. 2026Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Modelscited by 1
  2. 2026Evaluation without Generation: Non-Generative Assessment of Harmful Model Specialization with Applications to CSAMcited by 1
  3. 2026Adaptive Steering and Remasking for Safe Generation in Diffusion Language Modelscited by 1
  4. 2026MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Modelscited by 1
  5. 2026LLMs + Security = Troublecited by 0
  6. 2026Machine Unlearning for Masked Diffusion Language Modelscited by 0
  7. 2026Backdooring Masked Diffusion Language Modelscited by 0
  8. 2026D2-Monitor: Dynamic Safety Monitoring for Diffusion LLMs via Hesitation Signalscited by 0
  9. 2026Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Codecited by 0
  10. 2026Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysiscited by 0
  11. 2026Temporally-Resolved Token Attribution Reveals the Generation Dynamics of Diffusion Language Modelscited by 0
  12. 2026Noise Out, Bias In: Targeted Bias Injection in Diffusion Language Models via Closed-Loop Activation Steeringcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerability
  2. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
  3. 2026Safer by Diffusion, Broken by Context: Diffusion LLM's Safety Blessing and Its Failure Mode
  4. 2026Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models
  5. 2025A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models
  6. 2026Defending Large Language Models Against Jailbreak Attacks via In-Decoding Safety-Awareness Probing
  7. 2024Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models
  8. 2026BadDLM: Backdooring Diffusion Language Models with Diverse Targets