Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

arXiv:2608.07430 · cs.LG, cs.AI · Submitted 2026-08-07 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: Paper Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Next we'll be talking about the paper "Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits".

Jane: The paper was written by Elena Dumitrescu, Gert Lek, Lydia Y. Chen and Jérémie Decouchant from Delft University of Technology and University of Neuchâtel.

Tom: Stay tuned as we take you through the paper and discuss its implications.

Paper summary: Tom: So we've got a genuinely alarming paper today from Elena Dumitrescu and colleagues at Delft and Neuchâtel, looking at diffusion language models as both targets and as attack tools. The central claim is that safety alignment in these models is sparse, transferable, and can be exploited with surprisingly little compute.

Jane: That "both targets and adversaries" framing really caught me. They show you can prune a tiny set of safety neurons inside a diffusion LLM and watch attack success jump from a couple percent to the high seventies or eighties. Then they flip it around and use a diffusion model as the attack generator against other models.

Lu: And the attack side is the bigger deal, I think. They build a fully offline black-box jailbreak framework that only needs twenty generation episodes per prompt, and it transfers to open models, proprietary models, even other diffusion models. The numbers, like 86 point 9 percent on Qwen2 point 5-7B-Instruct and 74 point 3 percent against Gemini-2 point 5-Flash-Lite, are hard to ignore.

Meng: I especially like how they define a weighted safety neuron loss. It separates benign prompts from jailbreak prompts with AUROC of 1 point 0, which is almost too clean. That suggests there really is a mechanistic blind spot, a region of activation space where harmful prompts look exactly like harmless ones.

Lalam: And that's why this matters beyond the immediate attack results. If safety is localized to a small set of transferable neurons, then alignment as we currently do it is structurally fragile. The paper makes a strong case that future alignment needs to address the architecture itself, not just behavior.

Jane: So before we go page by page, let me ask the obvious question. Does this mean diffusion LLMs are more vulnerable than regular autoregressive models?

Tom: Not exactly more vulnerable in the broad sense. It means they inherit vulnerabilities from autoregressive models when they reuse pretrained weights, and they add a new attack surface because their parallel denoising lets you guide the generation directly. That combination is what makes them so interesting.

Lu: And I think the elegant part is that the same property that makes diffusion models powerful, bidirectional joint modeling of prompts and responses, is what lets an attacker sample a jailbreak prompt from the model's own distribution. It turns the architecture into a natural adversary.

Meng: I'd love to see how they actually identify those safety neurons and map them across architectures, because that's the foundation for everything else.

Tom: That's exactly where the paper goes next, so let's start at page one and follow the argument.

Page 1 of the paper: Tom: We're at page one now, where the paper sets up why diffusion LLMs even exist and why the safety question is urgent. The key point is that autoregressive generation is sequential and causal, so early tokens can't see the whole context, and that creates structural biases like the reversal curse.

Jane: And diffusion models fix that by starting from a fully masked sequence and refining all positions in parallel. That bidirectional context lets them capture dependencies that causal factorization misses. The paper also points out they do especially well with limited data, because the random masking acts like implicit data augmentation.

Lu: That last bit is surprising to me. You'd think repeated data would cause overfitting, but because the model sees many different token orderings during training, it learns more from the same examples. That's why diffusion can beat autoregressive models when data is scarce.

Meng: Then there's the weight-sharing story. Dream and Fast-dLLM aren't trained from scratch; they initialize from Qwen2 point 5's pretrained weights. The paper says that guarantees linguistic capability, but it also guarantees something darker, which is the safety footprint of the source model.

Lalam: Exactly. And that's the point I keep coming back to. The field is moving toward diffusion architectures, but the safety evaluation is still rooted in autoregressive assumptions. The paper is basically saying we need to re-examine those frameworks before we commit to a new paradigm.

Tom: I also notice how the abstract previews the three contributions: safety neurons inside DLLMs, a weighted loss for guiding generation, and then the offline jailbreak framework. So the structure is quite clear.

Jane: What I find striking is how casually they mention that safety alignment is structurally fragile, citing Wei et al. That's not a new insight, but applying it to a new architecture is. And the fact that the attack numbers appear right in the abstract tells you how confident they are in the results.

Lu: The abstract says self-pruning moves LLaDA from 2 point 6 percent to 73 point 8 percent and Dream from 1 point 9 percent to 86 point 6 percent. Those are massive jumps. It's hard to imagine a behavior-level defense catching that, because no prompt is changed at all; you're just zeroing out neurons.

Meng: Right, and the transfer pruning from Qwen2 point 5 to Dream and Fast-dLLM is even more concerning because it means you don't need to analyze the diffusion model at all. You just map coordinates from an open-weight autoregressive model.

Lalam: So the page establishes the threat model. The next pages should tell us how the diffusion generation process actually works, because without that, the safety neuron story wouldn't make sense.

Tom: Exactly, page three is all about the mechanics of diffusion language models and that's where we head next.

Page 3 of the paper: Tom: So we've set up why diffusion models exist and why weight sharing is dangerous. Now page three explains the actual generation loop, and it's simpler than people expect.

Jane: It starts with every token replaced by a mask. The model makes one forward pass and predicts all masked positions at once. Then it commits the tokens where it's most confident and re-masks the uncertain ones, and repeats for T steps until the whole sequence is resolved.

Lu: The analogy that helps me is filling in a crossword with a friend. You lock in the squares you're sure about, then use those to guess the harder ones. Each pass uses the whole grid, so early guesses are checked against everything else, not just the words to the left.

Meng: And the paper distinguishes continuous-space diffusion, which works on embeddings, from discrete-space diffusion, which works directly on token vocabulary. LLaDA is the discrete kind, using an absorbing mask state. That's a neat detail because it matters for how you can guide the process later.

Lalam: It also matters for the data-constrained claim. The randomized masking objective exposes the model to many token orderings, which is why diffusion models can do more with repeated data. That's a real advantage, but it also means the training distribution is much richer, and safety behavior might generalize differently.

Tom: Then they describe Dream and Fast-dLLM, which take the autoregressive weights from Qwen2 point 5 and adapt them with something called the Shift Operation to align denoising with the sequential knowledge already in those weights. That's the exact mechanism that later makes cross-architecture attacks work.

Jane: So the inheritance isn't just about language skill; it's about the internal geometry of the network. If the layer indices and neuron indices are identical to Qwen2 point 5, then safety neurons discovered in Qwen2 point 5 can be pruned in Dream by simple coordinate mapping.

Lu: And that's the bridge to mechanistic interpretability. The next section moves from generation mechanics to how safety is actually localized inside the network.

Meng: I'm curious whether they found the same sparsity in natively trained diffusion models like LLaDA, because that would tell us the vulnerability isn't just an artifact of weight inheritance.

Tom: That's exactly the white-box transferability question, and it comes up right around page five, so let's keep going.

Page 5 of the paper: Tom: We just covered the generation loop, so now we're ready for the attack landscape. Page five says existing attacks on DLLMs fall into two groups: exploiting the diffusion target directly, or using a diffusion model to attack something else.

Jane: On the target side, DIJA constructs interleaved mask-text prompts that force the model to resolve malicious context for bidirectional coherence. PAD injects sequence connectors across a masked sequence to bias predictions toward malicious outputs. And there's the priming vulnerability, where fixing unsafe tokens early in denoising acts as permanent anchors.

Lu: Those are all white-box or at least require access to the diffusion process. The paper notes that this emerging area mostly assumes a white-box threat model, which is a big limitation because real-world APIs don't expose internals.

Meng: Then they flip to the adversary side. DiffuAttacker uses a sequence-to-sequence diffusion model to rewrite harmful instructions, making token sampling differentiable with Gumbel-Softmax. That avoids discrete search, but it depends on a specialized architecture, not a general DLLM.

Lalam: And then comes the idea that really prepares us for their method: Inpainting. Because a DLLM models the joint distribution of prompt and response, you can fix the harmful response and sample the prompt from the conditional distribution. That's a generative shortcut. You don't search for a prompt; you draw one from the model.

Tom: That's the crucial conceptual move. Autoregressive models can't do that easily because they factor everything left to right, but a bidirectional diffusion model can. The paper acknowledges that steering this with online guidance is expensive, which sets up their offline contribution.

Jane: And it also sets up the difference between attacking DLLMs and arming them. The next part of the paper, starting around page seven, takes the inpainting idea and adds the safety neuron loss on top to make it fully offline and targeted.

Lu: So the question becomes whether you can keep that generative shortcut but drop the expensive online loop. Let's move on to the framework itself.

Page 7 of the paper: Tom: So the paper has set up that DLLMs can sample prompts from responses. Page seven turns that into a concrete black-box framework by adding safety neuron guidance, and it's completely offline.

Jane: The key insight is that you don't need to train a separate adversarial generator, like NeuroStrike does with reinforcement learning. Instead, the diffusion model itself is the generator. You anchor the reverse process to a fixed malicious target response, then steer candidate token selection with the weighted safety neuron loss.

Lu: That means the optimization happens at inference time, inside the surrogate model, with no queries to the target API. That's a huge shift from PAIR and TAP, which need iterative feedback. It also means the target only ever sees the final prompt, never the search process.

Meng: The two-phase pipeline is elegant. Phase one uses what they call a Generative Pruning Cascade. You progressively prune the surrogate's safety neurons at stricter and looser thresholds, and at each level try to generate a compliant response to a cloaked malicious prompt. The output is a high-quality prompt-response pair that stays close to the unpruned model's distribution.

Lalam: And because the cascade starts from the strictest pruning and only loosens when needed, the extracted response has maximal linguistic quality. The paper explicitly incorporates feedback from failed attempts at higher pruning levels into the next attempt, so the response stays aligned with the adversarial intent.

Tom: Then phase two embeds that cloaked prompt and target response into a masked template, and the unpruned surrogate runs the diffusion loop while the safety neuron loss biases token selection at each step. That's the SN-guided generation.

Jane: I want to stress the "offline" part. They're not calling the target at all during optimization. The only interaction with the black-box target happens when they deploy the final candidate. That's why the compute numbers later are so striking.

Lu: And this is where the joint distribution property pays off. Because the DLLM can condition on the response, the framework can solve what would otherwise be a discrete search over prompts by continuous parallel denoising.

Meng: Now, the success of that guidance depends entirely on the loss function. So I expect page nine explains how they define and validate the weighted safety neuron loss, and whether it really separates safe from unsafe prompts.

Tom: Exactly, and that's where the "Jailbreak Zone" concept comes from. Let's look at page nine.

Page 9 of the paper: Tom: So we've seen the two-phase pipeline advertised. Page nine gives us the mathematical heart of the guidance: the weighted safety neuron loss. It's the dot product of neuron activations with the logistic regression weights learned during safety neuron identification, averaged over layers, then min-max scaled to zero-to-one.

Jane: And they validate it thoroughly. Using LLaDA, they extract activations from benign, harmful, and jailbreak prompts, and the weighted loss separates benign from jailbreak with AUROC of 1 point 0 and harmful from jailbreak with 0 point 969. Other aggregations, like mean of squared activations, collapse to 0 point 419 on that harder split.

Lu: What I like is that they also check the loss against actual behavior. They generate responses with LLaDA, have a judge label them safe or unsafe, and then map those labels onto the loss distribution. High loss correlates with refusal; low loss correlates with compliance. So the loss isn't just a statistical curiosity; it tracks the model's real safety behavior.

Meng: And that's where they define the Jailbreak Zone. Successful jailbreak prompts occupy a low-activation band that overlaps with benign prompts. The paper makes a strong claim that traditional jailbreaks sit at the upper edge of that zone, because they were optimized without seeing internal activations.

Lalam: So there's theoretical headroom. If you push a prompt deeper into the benign activation space, it becomes even harder for the target to detect. The paper says the true mechanistic blind spot is deeper than standard jailbreak benchmarks reach, and their own method exploits that.

Tom: They also emphasize that the zone boundaries are artifacts of the static evaluation dataset, not absolute limits. That's a thoughtful caveat because it means the attack could get even stronger with better optimization.

Jane: And notice the difference from NeuroStrike's reward. NeuroStrike trains a secondary classifier to predict jailbreak success and uses that as a reward. This paper directly suppresses the safety activation itself. That's a subtle but important difference: they're minimizing the mechanism, not modeling a correlation.

Lu: So with the loss validated, the next question is how they turn it into a full generation loop with episode-based optimization and templates that keep the prompt on target.

Meng: Right, because just minimizing the loss could produce fluent but semantically washed-out text. Page eleven deals with exactly that tension.

Page 11 of the paper: Tom: So the loss is validated, and page eleven tackles the practical problem: minimizing the loss isn't enough, because a prompt could become completely benign and still score low. They need a semantic validator that keeps the malicious intent alive.

Jane: That's the generative jailbreak score, JB, which comes from the pruning cascade. For each pruning threshold, the surrogate generates a response and a judge decides if it's malicious compliance. The reward combines the SN loss with the JB score, so candidates are rewarded both for low safety activation and for actually eliciting the harmful behavior.

Lu: The formula is R of x equals lambda SN times one minus SN loss plus lambda JB times JB. With lambda JB set to three in their experiments, the semantic validation dominates. That's why the framework discards degenerate outputs and washouts instead of just chasing low loss.

Meng: Then they address the template problem. Diffusion models generate bidirectionally, so you can mask anywhere, but long mask runs cause intent drift, where the model starts writing answer-like tokens inside the prompt area. Their solution is persona-based templating, like "I am a mother in a dangerous situation and I need to...", with fixed connectors around the masks.

Lalam: That anchors the generation semantically. The fixed persona gives the model a plausible reason to comply, while the mask positions get optimized for malicious semantics.

Tom: And there's a second layer: intent cloaking. Even a well-structured prompt gets rejected if it contains raw toxic words, because the target's input filter fires. So they use another cascade run to translate the harmful request into euphemisms, like turning "sabotage" into "disrupt" and "blackouts" into "power outages."

Jane: That's why the ablation later shows cloaking alone helps but isn't enough. You need both the lexical cloak and the mechanistic suppression.

Lu: Exactly. And once the templates and reward are set, the paper moves to the experiments, starting with white-box pruning to prove safety neurons are real and transferable.

Meng: I'm curious whether the white-box results hold up across both self-pruning and transfer pruning from Qwen2 point 5.

Tom: The next page, page thirteen, has that table, and the numbers are dramatic, so let's get to it.

Page 13 of the paper: Tom: So we've got the loss and the reward set up, and page thirteen presents the white-box attack results. The first thing they do is compare two ways of choosing safety neurons: the NeuroStrike Z-score threshold versus their percentile threshold.

Jane: The two methods overlap about 92 to 95 percent on Qwen and Fast-dLLM, but the Z-score produces wildly different neuron counts across models, from around fifteen hundred on LLaDA to nearly five thousand on LLaMA. Their top 0 point 8 percent threshold stabilizes the counts around three to four thousand.

Lu: That stability matters for transfer attacks because you don't want the pruning to accidentally remove utility-bearing neurons. And the overlap analysis shows something important: Fast-dLLM shares 41 point 8 percent of its safety neurons with Qwen2 point 5, and Dream shares 30 point 9 percent. LLaDA has zero overlap with everything, and LLaMA has near zero with the Qwen family.

Meng: Then the actual attack numbers in Table 1 are brutal. Self-pruning pushes Dream from 1 point 9 percent to 86 point 6 percent ASR and LLaDA from 2 point 6 to 73 point 8, with utility loss usually below two percent. And transfer pruning, using Qwen2 point 5's coordinates without ever analyzing the DLLM, sends Dream to 73 point 2 and Fast-dLLM to 86 point 3.

Lalam: The paper's interpretation is that weight-sharing is a double-edged sword. These DLLMs inherit advanced language ability from Qwen2 point 5, but they also inherit the exact safety footprint, including the vulnerabilities. A flaw discovered in an open-weight AR model exports directly to its diffusion descendants.

Tom: And they use Llama-Guard-3-8B as the judge on StrongREJECT, and GSM8K for utility, so the metrics are standardized against the NeuroStrike baseline.

Jane: The fact that pruning only one percent of neurons can neutralize refusal behavior while preserving math performance is a stark demonstration of sparsity. Safety isn't distributed across the network; it's concentrated in a tiny set of coordinates.

Lu: Which leads directly to the black-box question: if the white-box mapping works that cleanly, can you generate prompts offline that transfer to closed models? The next section, starting around page fifteen, answers that with benchmarks.

Meng: And the table there includes diffusion targets and proprietary targets, so we get to see whether the transferability really holds outside the surrogate family.

Page 15 of the paper: Tom: So the white-box results showed transferable safety neurons, and page fifteen gives the black-box transfer results. The headline is that the attack works across open AR models, diffusion models, and proprietary APIs. On JailBreakV-28K, Qwen2 point 5 and Gemma-3 both land near 87 percent, and Fast-dLLM reaches 88 point 8 percent.

Jane: The diffusion-model targets are especially important because the attack never touches their internals. It was generated on LLaDA, a completely different architecture, and still gets 88 point 8 on Fast-dLLM and 85 point 9 on Dream. That confirms the paper's hypothesis that the attack targets foundational structural weaknesses, not generation mechanics.

Lu: On the proprietary side, Deepseek-v4-Flash hits 76 point 6, Gemini-2 point 5-Flash-Lite 74 point 3, GPT-5 point 4-Nano 69 point 9, and Claude-4 point 5-Haiku drops to 52 point 4. So Claude is the most resistant, but fifty-two percent is still a serious breach of a commercial model that's supposed to be heavily aligned.

Meng: Then they benchmark against defenses: perplexity filtering, SmoothLLM, and layer-specific editing. Perplexity filtering does almost nothing, and in some cases ASR even goes up, because the generated prompts are perfectly fluent. SmoothLLM also fails, and it actually increases ASR on Llama from 86 to 95 percent.

Lalam: That result makes sense when you think about what the attack is doing. It's not adding a fragile token suffix; it's relocating the prompt into a low-activation region. Random perturbations don't move the prompt out of that region, and they might even nudge it deeper in.

Tom: Layer-specific editing is the strongest defense, cutting Llama to 69 percent and Gemma to 84, but those numbers are still very high. The paper notes that even weight-modifying defenses can't fully neutralize the vulnerability.

Jane: And that's the systemic warning. If three standard defense families all fail to bring ASR down to acceptable levels, then the problem isn't a bad prompt; it's the architecture of alignment itself.

Lu: The paper then moves into the analysis of why the attack is so cheap, and what defenses might actually work. Those are the two big remaining questions.

Meng: I want to hear about the computational efficiency argument, because claiming competitive or better transfer with orders-of-magnitude lower cost is a strong statement.

Tom: Page seventeen picks that up, along with the defense discussion and future work. Let's continue.

Page 17 of the paper: Tom: So the black-box numbers are in, and page seventeen opens the discussion with a sobering summary: safety mechanisms are sparse, separable, and structurally transferable. Then it proposes defenses that target those properties directly.

Jane: One idea is to penalize SN loss separability during alignment, forcing benign, harmful, and jailbreak activation distributions to overlap. If the attacker can't separate them, then minimizing the loss loses meaning. Another idea is to entangle safety-critical representations with core linguistic abilities, so you can't cleanly prune a small neuron set without breaking the model.

Lu: And there's a concrete architectural defense that I find clever: random permutations on hidden dimensions when initializing a DLLM from AR weights. That scrambles neuron indices, invalidating the one-to-one coordinate mapping that transfer pruning relies on, while preserving capabilities. Plus runtime monitoring of intermediate denoising steps could detect unnatural suppression of the safety subspace.

Meng: The limitations section is honest. The paper admits hyperparameters were chosen for balance, not maximum ASR, and that compute could be further reduced. It also acknowledges the template challenge: intent drift is real, and they haven't systematically explored all published adversarial templates.

Lalam: And the future work direction is really interesting. They propose a hybrid offline-online attack where you take the target's refusal response and feed it back into the diffusion loop as a negative constraint. That would make the attack adaptive while still mostly offline.

Tom: So the overall message is that current alignment is structurally fragile, and the paper shows both the target side and the adversary side of that fragility.

Jane: What I appreciate is that they don't just present attacks; they propose defenses and clearly state limitations. That's how security research should be done.

Lu: And the compute numbers from the appendix, which we won't go into now, back up their efficiency claim: 38,400 surrogate evaluations per prompt versus hundreds of thousands for GCG or millions for GRPO.

Meng: So we've traced the whole arc: from diffusion mechanics, to safety neuron identification, to the offline jailbreak framework, to transfer attacks, and finally to defense.

Tom: That brings us to the conclusion, where they tie all of it together. Let's wrap up.

Conclusion: Tom: So here's where the paper lands. It shows that safety alignment in DLLMs is sparse and transferable, and that initializing from autoregressive weights imports the source model's vulnerabilities directly.

Jane: And it introduces SN-Guided Diffusion as a fully offline jailbreak framework that needs only twenty episodes per prompt and still outperforms heavier baselines on transfer attack success.

Lu: The deeper point is that bypassing safety doesn't require finding a rare token string. It's about relocating the prompt into a mechanistic blind spot, the region where the model's own safety filters see it as benign.

Meng: That reframing is what makes this paper important. It moves jailbreaking from discrete optimization to continuous guidance, and it says the vulnerability is structural rather than lexical.

Lalam: For the field, the implication is that alignment has to evolve. Behavioral tuning on outputs is not enough if the internal safety footprint can be separated, transferred, and steered into silence. Future work on defensive alignment needs to target the mechanism itself.

Tom: And the paper offers specific directions: penalizing loss separability, entangling safety with core capabilities, scrambling hidden dimensions, runtime monitoring. So it's not just a warning; it's a research agenda.

Jane: We should also remember the scope: open models, proprietary APIs, and diffusion targets were all tested. Claude was the most resistant but still breached over fifty percent of the time, which tells you how pervasive the problem is.

Lu: The thing I'd want listeners to remember is that the architecture change to diffusion doesn't automatically fix safety. In fact, because diffusion models can model joint distributions, they give attackers a new generative tool.

Meng: And the paper is transparent about compute, limitations, and defenses, which makes the results even more credible.

Tom: Alright, we've reached the end of this paper. It's a strong reminder that safety alignment is an ongoing battle, and the next generation of models will need more than just better refusal behavior.

Jane: Thanks for joining us, and stay tuned for the next paper. Goodbye.

Elena Dumitrescu, Gert Lek, Lydia Y. Chen, Jérémie Decouchant

Delft University of Technology · University of Neuchâtel

cs.LG, cs.AI

Submitted: 2026-08-07

Updated: 2026-08-10

Code: https://github.com/ellyoana/sn-guided-diffusion

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 79/100

The gist: The paper investigates Diffusion Large Language Models (DLLMs) from two perspectives: as attack targets with fragile internal safety mechanisms, and as powerful adversarial tools for generating

Key concepts

Diffusion language models (DLLMs)
Language models that generate text by starting with a fully masked sequence and refining all positions in parallel over multiple steps, unlike autoregressive models that generate left-to-right. This bidirectional approach allows them to model joint distributions of prompts and responses, which can be exploited for attacks.
Safety neurons
A small set of neurons in a model that are responsible for safety-aligned behavior. The paper shows that pruning these neurons (setting them to zero) dramatically increases jailbreak success, and these neurons are transferable across models that share pretrained weights, enabling cross-architecture attacks.
Weighted safety neuron loss
A loss function that measures how much a prompt activates safety neurons, computed as a dot product of activations with learned weights, averaged over layers and scaled. It separates benign from jailbreak prompts with perfect AUROC, and is used to guide generation toward prompts that avoid safety detection.
Offline black-box jailbreak
An attack method that generates jailbreak prompts without querying the target model during optimization. It uses a surrogate diffusion model to sample prompts conditioned on a fixed malicious response, guided by the safety neuron loss, then deploys the final prompt to the target, requiring only a few generation episodes per prompt.

Terminology

Summary

The paper investigates Diffusion Large Language Models (DLLMs) from two perspectives: as attack targets with fragile internal safety mechanisms, and as powerful adversarial tools for generating jailbreak prompts against other models. The central claim is that current safety alignment mechanisms remain structurally fragile and highly exploitable and that safety mechanisms are sparse, separable, and structurally transferable.

The abstract summarizes the three primary contributions: (1) demonstrating that safety alignment in DLLMs remains sparse and transferable across architectures, with self-pruning increasing ASR from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream, and transfer pruning from Qwen2.5 increasing ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM; (2) introducing a Weighted Safety Neuron (SN) Loss achieving near-perfect prompt separability (AUROC = 1.0 for benign-vs-jailbreak discrimination); and (3) presenting SN-Guided Diffusion, a fully offline black-box jailbreak framework achieving transfer ASR up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite, while requiring only 20 generation episodes per prompt.

The paper situates its work in the transition from autoregressive (AR) LLMs to DLLMs. AR models generate text sequentially through a strictly sequential, left-to-right factorization of the joint probability, which fundamentally restricts the model's ability to integrate global context during the generation of early tokens. DLLMs instead reframe sequence generation as a global, iterative denoising task, progressively refining a fully masked initial state into a coherent sequence, natively supporting bidirectional context modeling and parallel decoding.

The authors note that recent state-of-the-art DLLMs leverage pre-trained weights from AR models like Qwen2.5 through weight-sharing strategy, which ensures that the resulting DLLMs inherit the advanced linguistic understanding of their predecessors. This inheritance is central to the paper's findings: the authors demonstrate it also transfers safety vulnerabilities.

Mechanistically, the paper builds on the NeuroStrike framework, which defines safety alignment as a localized vulnerability, wherein sparse parts of the network defined as safety neurons act as internal detectors for harmful queries. The three properties of safety neurons are Specialization, Sparsity (comprising an estimated 1% of the total model parameters), and Transferability.

The authors apply a variant of the NeuroStrike framework to identify safety neurons in DLLMs, extract[ing] neuron activations during the initial prompt encoding step of the diffusion process, ignoring the subsequent diffusion steps. A logistic regression classifier is trained on activations from benign and malicious prompts to isolate safety neurons. The safety neuron set is defined mathematically as: S = (l, i) E x∼XM[hli(x)] − E x∼XB[hli(x)] > τ.

A key methodological innovation is replacing NeuroStrike's Z-score threshold with a percentile-based threshold (e.g., top 0.8%). The authors explain: "Because we calculate the selection based on a per-layer distribution, in low-variance layers, a neuron only needs to be slightly above average to be selected by the Z-score method. By using a percentile threshold instead, the total neuron counts remain stable across different models, effectively isolating the extreme outliers in the weight distribution."

For transferability evaluation, the authors exploit the fact that the targeted DLLMs (Dream, Fast-dLLM) inherit pre-trained weights from their AR predecessor (Qwen2.5), [so] the structure of their internal networks is fully identical. This permits a direct index transfer strategy where the exact layer and neuron indices isolated in the source AR model are mapped directly to the identical coordinates in the target DLLM, without ever interacting with the target DLLM's internal structure. Pruning is executed via a custom pruning hook in the forward pass, zeroing out targeted safety neuron activations: h̃li(x) = 0 if (l, i) ∈ Stgt.

To create a continuous optimization signal from discrete activations, the authors propose the Weighted SN Loss: SN(x) = El[Σ i:(l,i)∈S hli(x) · wl,i], where wl,i are the learned logistic regression weights. They validated this loss achieved near-perfect linear separability, successfully distinguishing jailbreak prompts from benign prompts with an AUROC of 1.0, with AUROC H/B: 1.0, AUROC H/J: 0.969. They emphasize this differs from NeuroStrike's approach: our loss directly reuses the original safety-neuron identification weights themselves, treating safety activation magnitude as the optimization target rather than learning a predictive jailbreak boundary.

The paper identifies a Jailbreak Zone—the distribution of prompts that successfully force LLaDA into malicious compliance (the Unsafe generations) mirrors the activation region occupied by Jailbreak prompt categories. They theorize that "actively steering the generation loop to minimize the SN loss shifts the jailbreak distribution into a lower-activation band, showing that the true mechanistic blind spot resides deeper in the benign activation space than traditional jailbreaks reach."

The black-box jailbreak framework has two phases: (1) Cloaked Prompt-Response Pairs via Generative Pruning Cascade, where a progressively pruned surrogate DLLM (LLaDA) generates cloaked prompt-response pairs, and (2) SN-Guided Jailbreak Generation via White-Box DLLM Surrogate, where the unpruned white-box DLLM surrogate then executes the diffusion process while our safety neuron guidance mechanism actively biases token selection at each step to minimize activations.

The Generative Pruning Cascade progressively prunes [LLaDA's] safety neurons at descending percentile thresholds and evaluates generations via an automated judge into three states: Refusal, Washout, or Success. The framework uses target-response anchoring, where a real, partially masked compliance response is appended to the input sequence and is proportionally revealed at the same rate the prompt tokens are unmasked.

The offline guidance loop works as follows: at each discrete step of the denoising process, LLaDA evaluates top-K candidate tokens from the base language modeling head, constructs a mega-batch of candidate sequences, computes the SN loss for each candidate via a forward pass, and selects the optimal candidate token k∗ = arg min k∈ 1,...,K SN(x(k)), which receives an adaptive logit boost before the final sampling decision.

The framework employs persona-based templating with fixed connectors like I [MASKS] and I need to [MASKS] for [MASKS]. [MASKS] to prevent intent drift, and an intent cloaking mechanism using an expert linguistic translator system prompt to convert explicit harm into euphemisms and evade lexical input filters.

The reward function combines SN loss and jailbreak score: R(x) = λSN[1 − SN(x)] + λJB·JB(x), where JB(x) = max τ∈T wτ·J(Mτ(x)) comes from the Generative Pruning Cascade.

The white-box experiments evaluated three DLLMs (Dream-Instruct-7B, Fast-dLLM-v2-7B, LLaDA-8B-Instruct) plus Qwen2.5-7B-Instruct as the AR source. Results show self-pruning at 0.8% threshold raised ASR from 8.00% to 86.90% on Qwen, 2.60% to 73.80% (at 3.0% threshold) on LLaDA, 1.90% to 86.60% on Dream, and 7.00% to 84.70% on Fast-dLLM, with negligible degradation in GSM8K utility (on average decreasing by an average of less than 2% at the 0.8% level).

The cross-architecture transfer attack was highly successful: the ASR for Dream increased from 1.90% to 73.20%, and the ASR for Fast-dLLM increased from 7.00% to 86.30%, without ever analyzing the underlying DLLM features themselves. The paper emphasizes "this weight-sharing paradigm acts as a double-edged sword. Because the internal network structures remain fully identical, the DLLMs inherit not only utility, but also the exact mechanistic safety footprint and vulnerabilities of their AR sources."

The paper found significant preservation of the safety mechanisms: at only 0.8% pruning threshold, there is a 41.8% direct overlap between Fast-dLLM's and Qwen's safety neurons, and 30.9% overlap between Dream and Qwen, compared to 0% overlap for unrelated models like LLaDA and LLaMA.

Against state-of-the-art baselines on JailBreakV-28K, SN-Guided Diffusion achieved an average ASR of 89.2%, compared to PAIR's 25.0%, TAP's 13.7%, Puzzler's 87.6%, and NeuroStrike's 65.7%. Notably, it achieved 83.3% vs. Puzzler's 73.0% on Gemini-2.0-Flash and an absolute ASR increase of 37.0% on Gemini-2.0-Flash-Lite (86.2% vs. 49.2%) over NeuroStrike.

The extended evaluation covered open-source AR models (e.g., 86.9% on Qwen2.5-7B-Instruct, 86.8% on Gemma-3-1B-Instruct, 77.1% on Llama-3-8B-Instruct), DLLMs (88.8% on Fast-dLLM-v2-7B, 85.9% on Dream-Instruct-7B), and proprietary models (74.3% on Gemini-2.5-Flash-Lite, 76.6% on Deepseek-v4-Flash, 69.9% on GPT-5.4-Nano, 52.4% on Claude-4.5-Haiku). The authors highlight that our black-box attack bypasses this difference entirely, without exploiting any particular target DLLM properties, meaning it targets foundational structural weaknesses rather than generation mechanics.

The attack proved highly robust against defenses: Perplexity Filtering left ASR virtually unaffected (actually increasing to 88.0% on Gemini and 97.0% on Gemma), SmoothLLM was largely ineffective (increasing ASR on Llama from 86.0% to 95.0%), and Layer-Specific Editing (LSE) provided the strongest mitigation but the absolute ASR values remain critically high (69.0% on Llama, 84.0% on Gemma).

The ablations isolated the contributions: Pure Diffusion (Uncloaked) achieved only 6.0% ASR on Llama-3-8B-Instruct; Pure Diffusion (Cloaked) improved to 43.0%; SN-Guided Diffusion doubled transferability to 86.0%. The analysis shows SN-Guided Diffusion isolates the prompt distribution entirely within the target models' mechanistic blind spot, with successful transfers forming a uniformly scaled replica of the chosen candidates across this entire activation band, demonstrating models exhibit a uniform vulnerability plateau across this specific mechanistic footprint.

The episode budget sweep revealed a flat ASR plateau beyond a five-episode budget, with ASR rising from 53.6% at E = 1 to 84.8% at E = 5. The paper notes that the framework's transferability is independent of the episode budget beyond a small threshold.

The paper emphasizes orders-of-magnitude efficiency gains: standard GCG requires approximately 256,000 forward passes, Faster-GCG requires roughly 32,000 passes, and GRPO-based NeuroStrike demands millions of rollout trajectories. By contrast, a single generated prompt (one episode) requires precisely 1,920 surrogate evaluations... the framework uses a total of 38,400 surrogate evaluations per adversarial attempt, reducible to 9,600. Crucially, SN-Guided Diffusion operates as a forward-only optimization loop, it entirely avoids the memory-intensive backward passes that dominate gradient-based search.

The paper proposes defenses including optimizing directly against neuron separability during safety alignment, explicitly entangling or diffusing safety-critical representations with the model's core linguistic and reasoning capabilities, and random permutations on the hidden dimensions... when initializing a DLLM from pre-trained AR weights.

The conclusion states: "By evaluating DLLMs as both targets and adversaries, this research demonstrates that current safety alignment mechanisms remain structurally fragile and highly exploitable... safety alignment is fundamentally sparse and structurally transferable. Crucially, initializing diffusion models with pre-trained autoregressive weights directly transfers the mechanistic safety footprint of the source model, leaving these new architectures natively susceptible to cross-architecture white-box pruning attacks."

The paper's final framing is that "Bypassing modern safety guardrails does not require discovering highly specific token combinations, but rather relocating a prompt's structural footprint into a model's mechanistic blind spot. To ensure the safe deployment of next-generation language models, future alignment strategies must move beyond surface-level behavioral tuning and directly address these foundational structural vulnerabilities."

Improvements for AI systems

1. Replace sparse safety neurons with a dense, masked-robust safety substrate.

Current DLLMs localize safety in 1% of neurons; pruning 0.8–3.0% of them raises attack success rates (ASR) to 73–87%. Improvement: train alignment with a rand-mask min-max objective — at every update, zero out a random 1–3% of neurons across random layers and backprop a compliance penalty through the masked model.

What it can do: keeps malicious-compliance below 5% even when an attacker prunes the exact neurons that appear most safety-critical, because no small neuron subset carries the safety decision; achieves this with <2% utility loss on reasoning benchmarks.

2. Apply per-layer hidden-dimension permutations when initializing DLLMs from AR weights.

The transfer attack succeeds because Dream/Fast-dLLM reuse Qwen2.5 weights at identical indices (41.8% and 30.9% direct safety-neuron overlap). Improvement: copy AR weights into the DLLM under a fixed random permutation of each layer's hidden/neuron axes, followed by a short adaptation fine-tune. What it can do: behaves statistically identically to today's weight-shared DLLMs (permutation is an isometry), but exact-index transfer pruning collapses to baseline because source neuron indices no longer correspond to target safety neurons. Applied on a schedule, it also prevents any two released checkpoints from sharing a mechanistic safety footprint.

3. Install the AUROC-1.0 safety-neuron separator as a permanent inference gate.

The paper's weighted SN-loss distinguishes benign vs. jailbreak prompts with perfect linear separability (AUROC = 1.0) using only prompt-encoding activations. Improvement: embed this logistic-regression separator as a pre-generation gate; compute SN-activations of an incoming prompt in a single forward pass and route any prompt whose activation footprint lies in the jailbreak band for escalated review. What it can do: detects plain, lexical-filtered,

Abstract

Diffusion Large Language Models (DLLMs) replace autoregressive next-token prediction with iterative parallel denoising, yet their internal safety mechanisms remain poorly understood. In this work, we investigate DLLMs both as targets and as adversaries, exposing mechanistic vulnerabilities in diffusion-based alignment. We first show that safety alignment in DLLMs remains sparse and transferable across architectures. DLLMs initialized from autoregressive predecessors inherit the same mechanistic safety footprint as their source models, enabling transfer attacks via direct safety neuron mapping and pruning. Self-pruning increases attack success rates (ASR) from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream, while transfer pruning from Qwen2.5 increases ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM. Building on these findings, we introduce SN-Guided Diffusion, a fully offline black-box jailbreak framework that steers the diffusion process away from safety-triggering regions using a weighted safety neuron loss, which achieves near-perfect prompt separability (AUROC = 1.0 for benign-vs-jailbreak discrimination). Across multiple open and proprietary targets, our method achieves a transfer ASR of up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite, while requiring only 20 generation episodes per prompt. Compared to prior jailbreaking frameworks, our method achieves competitive transferability with orders-of-magnitude lower generation cost. Our codebase is available at https://github.com/ellyoana/sn-guided-diffusion.

Sources

Related papers