mlsanityData to 14 Oct 2026

Only What You've Signed up For: Secure Workflows with Constrained Diffusion Agents

arXiv 2610.15177 ↗First posted 10 Oct 2026cs.LG cs.CRcited by 0

On the map: Diffusion models → Discrete and text diffusion

also in 2 more
Abstract (arXiv)

As agentic AI systems take on increasingly complex and consequential tasks, securing them against prompt injection becomes critical. Existing defenses often rely on detecting or reasoning about injected malicious instructions and can therefore remain vulnerable to adaptive attacks that optimize the injection itself. Diffusion language models (dLLMs), an emerging framework for language generation, offer a new opportunity for security enforcement: by iteratively refining their sequence wide predictions, they enable broader-scope constraint enforcement throughout generation. This paper introduces Policy-Constrained Diffusion Agents (CoDA), a framework that enforces task dependent security policies directly within the denoising process of diffusion language models. At each denoising step, CoDA projects token distributions onto a policy-compliant set, maintaining constraint satisfaction throughout generation. We evaluate CoDA across state-of-the-art diffusion language model families under both static and adaptive prompt-injection attacks. Results demonstrate substantial reductions in attack success rate with competitive task utility and practical inference overhead.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Discrete and text diffusion, one of 14 directions in Diffusion models. Builds on 26 of its 34 references that are in the map. First posted on arXiv 10 Oct 2026.

Builds on

26 of 34 references.

Closest ancestors · 8

Same direction, newest first

  1. 2026Simple Self-Conditioning Adaptation for Masked Diffusion Models28 Apr
  2. 2025Loopholing Discrete Diffusion: Deterministic Bypass of the Sampling Wall22 Oct
  3. 2025Dream 7B: Diffusion Large Language Models21 Aug
  4. 2025DiffuCoder: Understanding and Improving Masked Diffusion Models for Code Generation25 Jun
  5. 2025Constrained Discrete Diffusion12 Mar
  6. 2025Large Language Diffusion Models14 Feb
  7. 2024Simple and Effective Masked Diffusion Language Models11 Jun
  8. 2023Discrete Diffusion Modeling by Estimating the Ratios of the Data Distribution25 Oct

Other references · 18

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  2. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  4. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 538
  5. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  6. 2025Agent Laboratory: Using LLM Agents as Research Assistantscited by 425
  7. 2025LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Modelscited by 285
  8. 2025Mercury: Ultra-Fast Language Models Based on Diffusioncited by 235
  9. 2024Simple Guidance Mechanisms for Discrete Diffusion Modelscited by 155
  10. 2022Concrete Score Matching: Generalized Score Matching for Discrete Datacited by 148
  11. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
  12. 2025LlamaFirewall: An open source guardrail system for building secure AI agentscited by 127
6 more
  1. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agentscited by 125
  2. 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agentscited by 99
  3. 2024Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchycited by 67
  4. 2025Contextual Agent Security: A Policy for Every Purposecited by 59
  5. 2025IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agentscited by 54
  6. 2026AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocationscited by 38

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerability
  2. 2026Mask-Aware Policy Gradients for Diffusion Language Models
  3. 2025Learning Unmasking Policies for Diffusion Language Models
  4. 2026Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models
  5. 2026Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models
  6. 2025Design Patterns for Securing LLM Agents against Prompt Injections
  7. 2026Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models
  8. 2025DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents