Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
Ranking
Overall
69
Content
80
Popularity
42
Observed public metrics from 1 member.
Merged summary
TL;DR - An arXiv preprint showing that safety alignment in diffusion LLMs (DLLMs) is sparse, localized in identifiable "safety neurons," and inherited from the autoregressive models they were initialized from — making them both easy to jailbreak and effective as attack engines against other models.
- Safety neuron pruning breaks alignment: self-pruning raises attack success rate from 2.6%→73.8% on LLaDA and 1.9%→86.6% on Dream; transfer pruning using neurons mapped from Qwen2.5 reaches 73.2% on Dream and 86.3% on Fast-dLLM, evidencing a shared mechanistic safety footprint across architectures.
- The proposed SN-Guided Diffusion is a fully offline, black-box jailbreak that steers iterative denoising away from safety-triggering regions via a weighted safety-neuron loss, with reported AUROC = 1.0 separating benign from jailbreak prompts.
- Attacks transfer to third-party targets: up to 77.1% ASR on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% on Gemini-2.5-Flash-Lite, using only 20 generation episodes per prompt — orders of magnitude cheaper than prior jailbreak frameworks.
- Practical implication: initializing DLLMs from aligned autoregressive checkpoints imports their vulnerabilities, so alignment likely needs to be redone (not inherited) for diffusion-based decoding; code is released publicly.
Sources (1)
Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
Public signals
Semantic Scholar citations 0 · Semantic Scholar influential citations 0
TL;DR - An arXiv preprint showing that safety alignment in diffusion LLMs (DLLMs) is sparse, localized in identifiable "safety neurons," and inherited from the autoregressive models they were initialized from — making them both easy to jailbreak and effective as attack engines against other models.
- Safety neuron pruning breaks alignment: self-pruning raises attack success rate from 2.6%→73.8% on LLaDA and 1.9%→86.6% on Dream; transfer pruning using neurons mapped from Qwen2.5 reaches 73.2% on Dream and 86.3% on Fast-dLLM, evidencing a shared mechanistic safety footprint across architectures.
- The proposed SN-Guided Diffusion is a fully offline, black-box jailbreak that steers iterative denoising away from safety-triggering regions via a weighted safety-neuron loss, with reported AUROC = 1.0 separating benign from jailbreak prompts.
- Attacks transfer to third-party targets: up to 77.1% ASR on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% on Gemini-2.5-Flash-Lite, using only 20 generation episodes per prompt — orders of magnitude cheaper than prior jailbreak frameworks.
- Practical implication: initializing DLLMs from aligned autoregressive checkpoints imports their vulnerabilities, so alignment likely needs to be redone (not inherited) for diffusion-based decoding; code is released publicly.