mlsanityData to 7 Oct 2026

BadDLM: Backdooring Diffusion Language Models with Diverse Targets

arXiv 2605.09397 ↗First posted 10 May 2026cs.CRcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion language models (DLMs) have recently emerged as an alternative modeling paradigm to autoregressive (AR) language models, enabling parallel generation and bidirectional context modeling. Yet their security implications, particularly their vulnerability to backdoor attacks, remain underexplored. We propose BadDLM, a unified framework for studying backdoor attacks against DLMs with diverse targets. We introduce a trigger-aware training objective that emphasizes target-relevant positions in poisoned samples, and theoretically prove that this objective is equivalent to training under an induced forward masking distribution. Unlike backdoors in autoregressive models, which typically manipulate next-token prediction, this characterization indicates that BadDLM can implant backdoors by exploiting the forward masking process. We instantiate BadDLM across different target levels: concept injection (BadDLM_Concept), semantic attribute steering (BadDLM_Attribute), alignment bypass (BadDLM_Align), and code payload injection (BadDLM_Payload). Experiments on mainstream open-source DLMs show that BadDLM achieves strong attack effectiveness across diverse targets while largely preserving benign utility, and remains effective against defenses designed for AR backdoors. Our findings expose a new class of security risks in diffusion-based language generation and call for defenses tailored to DLM denoising dynamics.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 51 of its 60 references that are in the map. First posted on arXiv 10 May 2026.

Builds on

51 of 60 references.

Closest ancestors · 7

Same direction, newest first

  1. 2026Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models24 Feb
  2. 2025Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation25 Jul
  3. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model17 Feb
  4. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models12 Jun
  5. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning7 May
  6. 2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targets10 Mar
  7. 2022How to Backdoor Diffusion Models?11 Dec

Other references · 44

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  3. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  4. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  5. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  6. 2021Measuring Mathematical Problem Solving With the MATH Datasetcited by 5,203
  7. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,710
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  9. 2024MMLU-Pro: A More Robust and Challenging Multi-Task Language Understanding Benchmarkcited by 1,758
  10. 2022WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agentscited by 1,197
  11. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
32 more
  1. 2022Diffusion-LM Improves Controllable Text Generationcited by 1,006
  2. 2025Large Language Diffusion Modelscited by 872
  3. 2024Simple and Effective Masked Diffusion Language Modelscited by 800
  4. 2025Dream 7B: Diffusion Large Language Modelscited by 515
  5. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
  6. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  7. 2025Train for the Worst, Plan for the Best: Understanding Token Ordering in Masked Diffusionscited by 208
  8. 2025Seed Diffusion: A Large-Scale Diffusion Language Model with High-Speed Inferencecited by 173
  9. 2025LLaDA2.0: Scaling Up Diffusion Language Models to 100Bcited by 154
  10. 2024Simple Guidance Mechanisms for Discrete Diffusion Modelscited by 148
  11. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  12. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 143
  13. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 135
  14. 2023Universal Jailbreak Backdoors from Poisoned Human Feedbackcited by 120
  15. 2020Trojaning Language Models for Fun and Profitcited by 80
  16. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
  17. 2023Composite Backdoor Attacks Against Large Language Modelscited by 63
  18. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  19. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
  20. 2025Diffusion Language Models are Super Data Learnerscited by 45
  21. 2023Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injectionscited by 37
  22. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMscited by 32
  23. 2025Accelerated Diffusion Models via Speculative Samplingcited by 30
  24. 2024Is poisoning a real threat to LLM alignment? Maybe more so than you thinkcited by 27
  25. 2019Importance Resampling for Off-policy Predictioncited by 26
  26. 2024Models Are Codes: Towards Measuring Malicious Code Poisoning Attacks on Pre-trained Model Hubscited by 16
  27. 2019Robust Importance Weighting for Covariate Shiftcited by 14
  28. 2025Injecting Universal Jailbreak Backdoors into LLMs in Minutescited by 13
  29. 2025Are Your LLM-based Text-to-SQL Models Secure? Exploring SQL Injection via Backdoor Attackscited by 6
  30. 2024Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishabilitycited by 5
  31. 2024Securing Multi-turn Conversational Language Models From Distributed Backdoor Triggerscited by 5
  32. 2026Backdooring Bias in Large Language Modelscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
  2. 2026Backdooring Masked Diffusion Language Models
  3. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerability
  4. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
  5. 2026Tuning Just Enough: Lightweight Backdoor Attacks on Multi-Encoder Diffusion Models
  6. 2025AutoBackdoor: Automating Backdoor Attacks via LLM Agents
  7. 2026Patcher: Post-Hoc Patching of Backdoored Large Language Models
  8. 2026Membership Inference Attacks Against Fine-tuned Diffusion Language Models