Energy landscape explains why diffusion model jailbreaks work
Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
Artificial Intelligence
Summary
Some language models are designed to avoid harmful or unsafe responses, but attackers find clever ways to trick them. The authors show that these tricks work by either hiding bad requests at the start or pushing the model’s internal process over an invisible energy barrier to unsafe outputs. By studying the model’s ‘energy landscape,’ they develop new ways to detect these attacks early, making sure harmful content is blocked. Tests on several language models show their detection methods catch all successful attacks.
What this means in practice
- •For ai safety engineers: Detect and block harmful jailbreak attempts on diffusion-based language models using energy landscape signals without retraining.
- •For ai infrastructure teams: Monitor language model outputs for security breaches by tracking kinetic energy changes during response generation.
Authors
Thong Bach, Dung Nguyen, Thao Minh Le, Truyen Tran
Abstract
Existing attacks and defenses for diffusion-based large language models (dLLMs) target specific vulnerabilities but lack a shared framework explaining why attacks succeed. We propose one by interpreting safety alignment as shaping the denoising energy landscape: a well-aligned model routes harmful queries toward safe outputs through an energy barrier that separates the two regions. Current jailbreak attacks reduce to two strategies for circumventing this barrier: obscuring the query's safety disposition at initialisation, or intervening mid-trajectory to force the denoising path across the energy barrier. From this perspective and the result that masked diffusion models minimise kinetic energy during denoising, we derive three complementary, training-free detection signals: a step-0 ratio that reads the initial safety disposition from the logit distribution before generation begins, and two trajectory-velocity signals that track kinetic energy in complementary subspaces of the logit space. An attack must either reveal its intent at initialisation or expend kinetic energy to cross the barrier in at least one monitored subspace, so the three signals cover each other's blind spots in the energy budget by construction. Evaluation across three dense dLLMs (LLaDA-8B, LLaDA-1.5, Dream-7B) and a sparse mixture-of-experts dLLM (LLaDA-MoE-7B) confirms this complementarity. In stress tests of known attacks, every configuration that evades detection also fails to produce harmful content, suggesting that the detection and barrier-crossing thresholds are hard to separate.