mlsanityData to 7 Oct 2026

Diffusion LLMs are Natural Adversaries for any LLM

arXiv 2511.00203 ↗First posted 31 Oct 2025cs.LG stat.MLcited by 7

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

We introduce a novel framework that transforms the resource-intensive (adversarial) prompt optimization problem into an efficient, amortized inference task. Our core insight is that pretrained, non-autoregressive generative LLMs, such as Diffusion LLMs, which model the joint distribution over prompt-response pairs, can serve as powerful surrogates for prompt search. This approach enables the direct conditional generation of prompts, effectively replacing costly, per-instance discrete optimization with a small number of parallelizable samples. We provide a probabilistic analysis demonstrating that under mild fidelity assumptions, only a few conditional samples are required to recover high-reward (harmful) prompts. Empirically, we find that the generated prompts are low-perplexity, diverse jailbreaks that exhibit strong transferability to a wide range of black-box target models, including robustly trained and proprietary LLMs. Beyond adversarial prompting, our framework opens new directions for red teaming, automated prompt optimization, and leveraging emerging Flow- and Diffusion-based LLMs.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 47 of its 52 references that are in the map. First posted on arXiv 31 Oct 2025.

Builds on

47 of 52 references.

Closest ancestors · 16

Same direction, newest first

  1. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections10 Oct
  2. 2025REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective24 Feb
  3. 2024Best-of-N Jailbreaking4 Dec
  4. 2024An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks21 Oct
  5. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  6. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs22 Jul
  7. 2024Efficient Adversarial Training in LLMs with Continuous Attacks24 May
  8. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  9. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  10. 2024Attacking Large Language Models with Projected Gradient Descent14 Feb
  11. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space14 Feb
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
4 more
  1. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  2. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  3. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Models4 Sep
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 31

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2025Qwen3 Technical Reportcited by 8,195
  3. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2025Gemma 3 Technical Reportcited by 1,686
  7. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  8. 2023Enhancing Chat Language Models by Scaling High-quality Instructional Conversationscited by 825
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  10. 2025Dream 7B: Diffusion Large Language Modelscited by 515
  11. 2025Phi-4-Mini Technical Report: Compact yet Powerful Multimodal Language Models via Mixture-of-LoRAscited by 491
  12. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
19 more
  1. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 273
  2. 2022Tutorial on amortized optimizationcited by 83
  3. 2023Effective Prompt Extraction from Language Modelscited by 83
  4. 2025Energy-Weighted Flow Matching for Offline Reinforcement Learningcited by 70
  5. 2023Language Model Inversioncited by 66
  6. 2020Reliable Graph Neural Networks via Robust Aggregationcited by 43
  7. 2024Extracting Prompts by Inverting LLM Outputscited by 40
  8. 2023A Theoretical Justification for Image Inpainting using Denoising Diffusion Probabilistic Modelscited by 37
  9. 2024A Probabilistic Perspective on Unlearning and Alignment for Large Language Modelscited by 21
  10. 2025LLM-Safety Evaluations Lack Robustnesscited by 16
  11. 2021Identifying Untrustworthy Predictions in Neural Networks by Geometric Gradient Analysiscited by 13
  12. 2024Unlocking Point Processes through Point Set Diffusioncited by 12
  13. 2021Markpainting: Adversarial Machine Learning meets Inpaintingcited by 9
  14. 2025Sampling-aware Adversarial Attacks Against Large Language Modelscited by 9
  15. 2025Adversarial Alignment for LLMs Requires Simpler, Reproducible, and More Measurable Objectivescited by 8
  16. 2025Joint Relational Database Generation via Graph-Conditional Diffusion Modelscited by 8
  17. 2025Edit-Based Flow Matching for Temporal Point Processescited by 7
  18. 2025Energy-Weighted Flow Matching: Unlocking Continuous Normalizing Flows for Efficient and Scalable Boltzmann Samplingcited by 6
  19. 2025MAIA: An Inpainting-Based Approach for Music Adversarial Attackscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 6.

7 papers.

  1. 2026A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustnesscited by 20
  2. 2025GCG Attack On A Diffusion LLMcited by 1
  3. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Modelscited by 1
  4. 2026Closing the Distribution Gap in Adversarial Training for LLMscited by 0
  5. 2026All you need to break LLMs are Black-Box, Adapting, Efficient, Transferable, Harmful, Applicable ... Attackscited by 0
  6. 2026Greedy Coordinate Diffusion: Effective and Semantically Coherent Adversarial Attacks via Diffusion Guidancecited by 0
  7. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploitscited by 0