Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
2026-08-07 • Machine Learning
Machine LearningArtificial Intelligence
AI summaryⓘ
The authors study how diffusion-based large language models (DLLMs) handle safety, finding that their safety features are limited and can be transferred between models. They show that DLLMs inherit safety weaknesses from earlier models, which can be exploited through neuron-focused attacks to bypass safety controls. Using this insight, the authors develop a new method called SN-Guided Diffusion that steers the model away from risky outputs, achieving strong success in bypassing safety filters across several models with low computational cost. Their approach improves understanding of how safety mechanisms work in DLLMs and provides a practical jailbreak technique.
Diffusion Large Language ModelsSafety AlignmentNeuron MappingSelf-PruningTransfer AttackJailbreakingBlack-Box AttackPrompt SeparabilityAUROCWeighted Loss
Authors
Elena Dumitrescu, Gert Lek, Lydia Y. Chen, Jérémie Decouchant
Abstract
Diffusion Large Language Models (DLLMs) replace autoregressive next-token prediction with iterative parallel denoising, yet their internal safety mechanisms remain poorly understood. In this work, we investigate DLLMs both as targets and as adversaries, exposing mechanistic vulnerabilities in diffusion-based alignment. We first show that safety alignment in DLLMs remains sparse and transferable across architectures. DLLMs initialized from autoregressive predecessors inherit the same mechanistic safety footprint as their source models, enabling transfer attacks via direct safety neuron mapping and pruning. Self-pruning increases attack success rates (ASR) from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream, while transfer pruning from Qwen2.5 increases ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM. Building on these findings, we introduce SN-Guided Diffusion, a fully offline black-box jailbreak framework that steers the diffusion process away from safety-triggering regions using a weighted safety neuron loss, which achieves near-perfect prompt separability (AUROC = 1.0 for benign-vs-jailbreak discrimination). Across multiple open and proprietary targets, our method achieves a transfer ASR of up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite, while requiring only 20 generation episodes per prompt. Compared to prior jailbreaking frameworks, our method achieves competitive transferability with orders-of-magnitude lower generation cost. Our codebase is available at https://github.com/ellyoana/sn-guided-diffusion.