mlsanityData to 14 Oct 2026

GPO-V: Jailbreak Diffusion Vision Language Model by Global Probability Optimization

arXiv 2605.07399 ↗First posted 8 May 2026cs.CVcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 2 more
Abstract (arXiv)

Diffusion Vision-Language Models (dVLMs), built upon the non-causal foundations of Diffusion Large Language Models (dLLMs), have demonstrated remarkable efficacy in multimodal tasks by departing from the traditional autoregressive generation paradigm. While dVLMs appear inherently robust against conventional jailbreak tactics, which we categorize as Fixed Prefix Optimization (FPO) (e.g., anchoring responses with "Sure, here is"), this perceived resilience is deceptive. Our investigation into the safety landscape of dVLMs reveals a unique refusal pattern: Immediate Refusal and Progressive Refusal. We find that while FPO-based attacks often fail by triggering the latter, the progressive refinement process itself uncovers a novel, latent attack surface. To exploit this vulnerability, we propose Global Probability Optimization (GPO), a general jailbreak paradigm designed specifically for the denoising trajectory of masked diffusion models. Unlike prefix-based methods, GPO manipulates the global generative dynamics to bypass guardrails in diffusion language models. Building on this, we introduce GPO-V, the first visual-modality jailbreak framework tailored for dVLMs. Empirical results demonstrate that GPO-V produces stealthy perturbations with exceptional cross-model transferability, revealing a critical security gap in non-sequential generative architectures. Our findings underscore the critical urgency of addressing safety alignment in dVLMs. These results necessitate an immediate and fundamental re-evaluation of current defense paradigms to mitigate the unique risks of diffusion-based generation. Our code is available at: https://anonymous.4open.science/r/GPO-V-0250.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 40 of its 44 references that are in the map. First posted on arXiv 8 May 2026.

Builds on

40 of 44 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models28 May
  2. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul

Other references · 38

  1. 2017Attention Is All You Needcited by 60,361
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2020Denoising Diffusion Implicit Modelscited by 9,781
  5. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  6. 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,974
  7. 2022Flow Matching for Generative Modelingcited by 5,702
  8. 2023Sigmoid Loss for Language Image Pre-Trainingcited by 3,109
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  10. 2023Consistency Modelscited by 1,822
  11. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,719
  12. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
26 more
  1. 2025Large Language Diffusion Modelscited by 912
  2. 2024Simple and Effective Masked Diffusion Language Modelscited by 848
  3. 2016Universal adversarial perturbationscited by 784
  4. 2023Discrete Diffusion Modeling by Estimating the Ratios of the Data Distributioncited by 745
  5. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  6. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  7. 2025Dream 7B: Diffusion Large Language Modelscited by 544
  8. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  9. 2025Fast-dLLM: Training-free Acceleration of Diffusion LLM by Enabling KV Cache and Parallel Decodingcited by 420
  10. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
  11. 2022A Survey on Generative Diffusion Modelcited by 240
  12. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 189
  13. 2025LLaDA-V: Large Language Diffusion Models with Visual Instruction Tuningcited by 148
  14. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Modelscited by 110
  15. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 92
  16. 2025LaViDa: A Large Diffusion Language Model for Multimodal Understandingcited by 84
  17. 2024Diffusion Models in Low-Level Vision: A Surveycited by 74
  18. 2024Don't Say No: Jailbreaking LLM by Suppressing Refusalcited by 56
  19. 2022Bidirectional Language Models Are Also Few-shot Learnerscited by 48
  20. 2025EEdit: Rethinking the Spatial and Temporal Redundancy for Efficient Image Editingcited by 45
  21. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMscited by 34
  22. 2025A Survey on Parallel Text Generation: From Parallel Decoding to Diffusion Language Modelscited by 30
  23. 2025Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generationcited by 26
  24. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Modelscited by 25
  25. 2024Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Modelscited by 15
  26. 2025From Denoising to Refining: A Corrective Framework for Vision-Language Diffusion Modelcited by 9

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models
  2. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerability
  3. 2026Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
  4. 2026Mosaic: Multimodal Jailbreak against Closed-Source VLMs via Multi-View Ensemble Optimization
  5. 2025VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models
  6. 2025Simulated Ensemble Attack: Transferring Jailbreaks Across Fine-tuned Vision-Language Models
  7. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models
  8. 2024Failures to Find Transferable Image Jailbreaks Between Vision-Language Models