mlsanityData to 14 Oct 2026

Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models

arXiv 2609.00495 ↗First posted 31 Aug 2026cs.CL cs.AIcited by 0

On the map: Diffusion models → Discrete and text diffusion

also in 2 more
Abstract (arXiv)

Diffusion large language models (dLLMs) generate text through iterative denoising rather than left-to-right decoding. This generation paradigm introduces two axes that can influence safety alignment: when tokens are generated during denoising and where they appear in the response. In this paper, we measure dLLM safety behavior under harmful prompts by tracing intermediate token distributions and commitment decisions throughout denoising. Our analysis shows that refusal signals are concentrated in early denoising steps and leading response positions, and the tokens committed early can strongly shape the final safety outcome. Our measurements further show that the denoising step and persistence of refusal-token commitment are important for understanding dLLM safety. Based on these findings, we propose Refusal-Aware Early Commitment (RAEC), a simple training-free decoding method that commits persistent refusal signals from early steps. Experiments on LLaDA and Dream show that RAEC reduces attack success rates while largely preserving utility. The code is available at https://github.com/Glresearch1/RAEC.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Discrete and text diffusion, one of 14 directions in Diffusion models. Builds on 26 of its 35 references that are in the map. First posted on arXiv 31 Aug 2026.

Builds on

26 of 35 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models27 Sep
  2. 2025Dream 7B: Diffusion Large Language Models21 Aug
  3. 2024Simplified and Generalized Masked Diffusion for Discrete Data6 Jun
  4. 2023Discrete Diffusion Modeling by Estimating the Ratios of the Data Distribution25 Oct
  5. 2022DiffusionBERT: Improving Generative Masked Language Models with Diffusion Models28 Nov
  6. 2022SSD-LM: Semi-autoregressive Simplex-based Diffusion Language Model for Text Generation and Modular Control31 Oct

Other references · 20

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  3. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  4. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  5. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,719
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  7. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  8. 2022Diffusion-LM Improves Controllable Text Generationcited by 1,027
  9. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  10. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  11. 2022A Continuous Time Framework for Discrete Denoising Modelscited by 451
  12. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
8 more
  1. 2025SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilitiescited by 136
  2. 2025STAR-1: Safer Alignment of Reasoning LLMs with 1K Datacited by 68
  3. 2025The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMscited by 34
  4. 2025Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generationcited by 26
  5. 2024Nudging: Inference-time Alignment of LLMs via Guided Decodingcited by 23
  6. 2025Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Positioncited by 11
  7. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerabilitycited by 10
  8. 2026Few Tokens, Big Leverage: Preserving Safety Alignment by Constraining Safety Tokens during Fine-tuningcited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
  2. 2026Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models
  3. 2025DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models
  4. 2026Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
  5. 2025An Embarrassingly Simple Defense Against LLM Abliteration Attacks
  6. 2026Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment
  7. 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
  8. 2026Adaptive Steering and Remasking for Safe Generation in Diffusion Language Models