Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

TL;DR - An arXiv preprint showing that safety alignment in diffusion LLMs (DLLMs) is sparse, localized in identifiable "safety neurons," and inherited from the autoregressive models they were initialized from — making them both easy to jailbreak and effective as attack engines against other models.

• Safety neuron pruning breaks alignment: self-pruning raises attack success rate from 2.6%→73.8% on LLaDA and 1.9%→86.6% on Dream; transfer pruning using neurons mapped from Qwen2.5 reaches 73.2% on Dream and 86.3% on Fast-dLLM, evidencing a shared mechanistic safety footprint across architectures.
• The proposed SN-Guided Diffusion is a fully offline, black-box jailbreak that steers iterative denoising away from safety-triggering regions via a weighted safety-neuron loss, with reported AUROC = 1.0 separating benign from jailbreak prompts.
• Attacks transfer to third-party targets: up to 77.1% ASR on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% on Gemini-2.5-Flash-Lite, using only 20 generation episodes per prompt — orders of magnitude cheaper than prior jailbreak frameworks.
• Practical implication: initializing DLLMs from aligned autoregressive checkpoints imports their vulnerabilities, so alignment likely needs to be redone (not inherited) for diffusion-based decoding; code is released publicly.