mlsanityData to 7 Oct 2026

Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models

arXiv 2604.08557 ↗First posted 17 Mar 2026cs.CL cs.AIcited by 1

On the map: Diffusion models → Discrete and text diffusion

also in 2 more
Abstract (arXiv)

Safety alignment in diffusion language models (dLLMs) relies on a single load-bearing assumption: that committed tokens are permanent. We show that violating this assumption, by re-masking committed refusal tokens and injecting a short affirmative prefix, achieves 74-82% ASR on HarmBench across all three publicly available safety-tuned dLLMs, rising to 92-98% with a generic 8-token compliance prefix. We call this attack TrajHijack; it is the first trajectory-level attack on dLLMs, requires no gradient computation, and generalizes across SFT and preference-optimized (VRPO) models. Three findings emerge. First, the vulnerability is irreducibly two-component: re-masking alone (4.4%) and prefix alone (5.7%) both fail. Second, gradient optimization via a differentiable Gumbel-softmax chain consistently degrades ASR (41.5% vs. 76.1%), because continuous perturbations push token distributions off-manifold. Third, A2D (the strongest published dLLM defense) is more vulnerable to TrajHijack (89.9%) than the undefended model (76.1%): its silent-refusal training removes the contextual resistance that trajectory-level attacks must overcome, an effect we call the Defense Inversion Effect.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Discrete and text diffusion, one of 14 directions in Diffusion models. Builds on 23 of its 29 references that are in the map. First posted on arXiv 17 Mar 2026.

Builds on

23 of 29 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025Activation Steering for Masked Diffusion Language Models30 Dec
  2. 2025A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models27 Sep
  3. 2025Diffusion Language Models Know the Answer Before Decoding27 Aug
  4. 2025Dream 7B: Diffusion Large Language Models21 Aug
  5. 2025Large Language Diffusion Models14 Feb
  6. 2024Simple and Effective Masked Diffusion Language Models11 Jun
  7. 2023Discrete Diffusion Modeling by Estimating the Ratios of the Data Distribution25 Oct

Other references · 16

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,708
  4. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,665
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  7. 2016The Concrete Distribution: A Continuous Relaxation of Discrete Random Variablescited by 1,135
  8. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  9. 2023Are aligned neural networks adversarially aligned?cited by 305
  10. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 273
  11. 2025Mercury: Ultra-Fast Language Models Based on Diffusioncited by 225
  12. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMscited by 32
4 more
  1. 2025Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generationcited by 24
  2. 2025Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Positioncited by 11
  3. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerabilitycited by 10
  4. 2026Safer by Diffusion, Broken by Context: Diffusion LLM's Safety Blessing and Its Failure Modecited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Adaptive Steering and Remasking for Safe Generation in Diffusion Language Models
  2. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
  3. 2026Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models
  4. 2026CoDR: Training-Free Confidence-Drift Remasking for Diffusion Language Models
  5. 2026Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
  6. 2026Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Models
  7. 2026CaRE Compute-aware Remasking Evaluation Protocol for Masked Diffusion Language Models
  8. 2026Remask, Don't Replace: Token-to-Mask Refinement in Diffusion Language Models