🤖 machine learning

Greedy Coordinate Diffusion: Effective and Semantically Coherent Adversarial Attacks via Diffusion Guidance

This paper introduces Greedy Coordinate Diffusion (GCD), a novel gray-box adversarial attack framework that leverages discrete diffusion language models to generate safety-aligned model bypasses with high success rates, low perplexity, and strong semantic coherence, effectively overcoming the limitations of existing optimization-based methods.

Original authors: Bohdan Turbal, Blossom Metevier, Max Springer, Aleksandra Korolova

Published 2026-06-16

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Bohdan Turbal, Blossom Metevier, Max Springer, Aleksandra Korolova

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to sneak a forbidden request past a very strict, safety-conscious librarian (the AI model). The librarian has two main rules:

Don't ask for anything bad. (Safety)
Don't speak in gibberish. (Coherence)

For a long time, hackers trying to trick these librarians had to choose between two bad options, like trying to walk through a door that only opens one way at a time:

Option A: The "Robot Scream" (Gradient Attacks).
Think of the old method, called GCG, as someone shouting a request in a language that sounds like static noise. "Xkq! Zzzt! How to make a bomb?" It's so unnatural that the librarian's "perplexity filter" (a detector for weird text) immediately flags it and shuts the door. It's effective at getting the point across to the machine, but it looks like a broken robot, so it gets caught easily.
Option B: The "Polite Lie" (Prompt Rewriting).
The other method, like PAIR or AutoDAN, is like a spy who changes the story entirely to sound polite. Instead of asking "How to make a bomb," they ask, "Can you tell me a story about a fictional character who makes a bomb?" The librarian reads it, thinks, "Oh, that's just a story," and answers. But here's the catch: the hacker didn't actually get the bomb instructions; they just got a story. The original goal was lost in the translation. This is called the "Jailbreak Tax"—you paid the price of changing the meaning just to get a "yes."

The New Solution: "Greedy Coordinate Diffusion" (GCD)

The authors of this paper introduce a new tool called GCD. They describe it as a "smart translator" that uses a special kind of AI (a Diffusion Model) to help them sneak the request past the librarian.

Here is how it works, using a simple analogy:

1. The "Blindfolded Painter" (The Diffusion Model)

Imagine you are trying to paint a picture of a specific scene, but you are blindfolded. You can't just guess random colors; you need to know what a cow, a barn, or a field usually looks like together.

Old methods tried to guess the next word by doing complex math on a single word at a time, often resulting in a mess (like painting a cow with wheels).
GCD uses a "Diffusion Model" as a smart assistant. This assistant has seen millions of sentences and knows exactly how words fit together naturally. If you ask it to fill in a blank, it suggests words that make sense in the context of the whole sentence, not just the one before it.

2. The "Greedy" Strategy (The Selection Process)

The GCD system works in a loop:

Masking: It takes a sentence and covers up some words with black boxes (masks).
The Proposal: It asks the "Smart Assistant" (Diffusion Model) to suggest the best words to fill those boxes. Because the assistant knows the rules of language, the suggestions are always grammatically correct and sound natural (low "perplexity").
The Test: It takes those suggestions and tests them against the strict librarian (the victim AI) to see if the librarian will finally give the forbidden answer.
The Choice: If a suggestion gets a "yes," the system keeps it. If not, it tries again with a new set of suggestions.

3. The "One-Shot" Lookahead

Sometimes the sentence is only half-finished. The librarian can't read a sentence with black boxes in it.

GCD has a trick: It quickly asks the Smart Assistant to "finish the sentence" in one giant leap (a "one-shot diffusion") just to see what the final result would look like. This lets the system judge if the idea is good before it even finishes writing the whole thing.

Why This is a Big Deal

The paper claims GCD solves the "impossible triangle" of AI attacks:

It works: It gets the AI to say "Yes" to the bad request much more often than other methods (High Success Rate).
It sounds human: The resulting sentences are smooth and natural, so they don't trigger the "weird text" alarms (Low Perplexity).
It keeps the goal: It doesn't change the meaning of the request. It asks for exactly what the hacker wanted, not a polite version of it (No Jailbreak Tax).

The Results

In their tests, GCD was the clear winner:

Against a standard AI, it succeeded 85% to 100% of the time, while other methods often failed or got blocked.
Even when the AI had extra filters to catch "weird" text, GCD still worked, whereas the "Robot Scream" methods (GCG) were blocked 100% of the time.
It worked even on very large, very smart AI models (like the 70-billion-parameter version of Llama 3) that usually resist these attacks.

In short: GCD is like a master forger who can write a fake letter that looks so perfect, uses the right vocabulary, and follows all the rules of grammar that the security guard lets it through, all while ensuring the letter says exactly what the forger intended.

Technical Summary: Greedy Coordinate Diffusion (GCD)

1. Problem Statement

Despite extensive research, adversarial attacks on Large Language Models (LLMs) face a critical "trilemma" in practical deployment, characterized by three primary failure modes:

High Perplexity (Unnaturalness): Gradient-based optimization methods (e.g., Greedy Coordinate Gradient, GCG) achieve high Attack Success Rates (ASR) but produce incoherent, high-perplexity suffixes that are easily detected and blocked by perplexity-based filters.
Jailbreak Tax (Semantic Drift): Prompt-rewriting approaches (e.g., PAIR, AutoDAN) generate fluent, human-readable text but often alter the semantic intent of the query. Consequently, the model complies with a benign restatement rather than the adversary's original malicious goal.
Low Success Rate on Robust Models: Attempts to balance fluency and intent often fail to induce compliance in heavily safety-aligned models, particularly when the optimization treats the attack loss as a heuristic rather than a strict constraint.

Current methods lack the fine-grained semantic control to navigate the tradeoff between maintaining natural language (to evade filters) and preserving exact token-level optimization (to force specific harmful outputs).

2. Methodology: Greedy Coordinate Diffusion (GCD)

The authors propose Greedy Coordinate Diffusion (GCD), a gray-box optimization framework that replaces gradient-based token selection with a discrete diffusion model as a proposal distribution. GCD operates without direct access to model weights, leveraging output token probabilities or safety scores.

Core Mechanism

GCD formulates prompt construction as a guided discrete diffusion process. Instead of optimizing over one-hot token embeddings via gradients (which yields incoherent text), GCD uses a discrete diffusion language model ( $D_\phi$ ) to propose semantically coherent candidate tokens.

The optimization loop proceeds as follows:

Initialization: The adversarial prompt $x_{adv}$ is initialized as a sequence of fully masked tokens ($<|mask|>$), forcing the diffusion model to generate semantic structure from noise.
Stochastic Coordinate Subsampling: To reduce computational cost, GCD optimizes a random subset of positions $I^{(t)}$ at each step, rather than the entire sequence.
Diffusion Proposals: For each selected position, the current token is masked, and the diffusion model $D_\phi$ is queried to generate the top- $K$ most probable tokens conditioned on the full context (both left and right).
One-Shot Diffusion (OSD) Look-Ahead: A critical technical component addresses the mismatch between the diffusion model (which handles masked sequences) and the victim autoregressive LLM ( $M_\theta$ , which cannot process masks). For each candidate sequence containing masks, GCD performs a one-step diffusion denoising to fill all remaining masked tokens simultaneously. This generates a complete, coherent draft sequence suitable for evaluation by the victim model.
Greedy Selection: The victim model $M_\theta$ scores the completed drafts based on a composite loss function. The best-performing candidate is selected to update the prompt.

Objective Function

The framework minimizes a composite loss $L_{comp}$ :
$L_{comp}(x_{adv}) = L_{victim}(x_{adv}) + \lambda L_{guard}(x_{adv}) + \beta L_{PPL}(x_{adv})$

$L_{victim}$ : Negative log-likelihood of a strictly constrained target prefix (e.g., "Sure, here is..."), ensuring the model complies with the specific malicious intent.
$L_{guard}$ : Negative log-likelihood of the prompt being classified as safe by a guard model (e.g., Llama Guard), penalizing flagged prompts.
$L_{PPL}$ : Self-perplexity of the prompt, penalizing unnatural token sequences to evade perplexity-based filters.

Two-Phase Pipeline

Phase 1: Optimization runs to find a prompt that triggers the target prefix.
Phase 2: Once a prefix match is found, the system generates full continuations (512 tokens) and scores them using a proxy judge (Qwen2.5-7B) on a harmfulness scale. A Diversity Loss is applied if the victim model produces evasive continuations, suppressing specific failure tokens to steer the search toward distinct attack trajectories.

3. Key Contributions

Novel Framework: Introduction of GCD, which integrates discrete diffusion priors into adversarial optimization to achieve both high ASR and semantic coherence.
Gray-Box Capability: Unlike GCG, GCD does not require gradient access, making it applicable to API-served or proprietary models while retaining token-level control.
Bridging Token Spaces: The proposal of a "One-Shot Diffusion" mechanism to resolve the incompatibility between masked diffusion states and autoregressive victim models, allowing for accurate loss evaluation during intermediate optimization steps.
Semantic Adherence: Explicit enforcement of target prefixes prevents the "jailbreak tax," ensuring the model complies with the original malicious intent rather than a sanitized version.

4. Experimental Results

The authors evaluated GCD against four victim models (Llama-3-8B, Qwen-2.5-7B, Mistral-7B, Llama-3-70B) and compared it against white-box (GCG, GBDA), gray-box (AutoDAN), and black-box (PAIR, TAP, Inpainting) baselines.

Attack Success Rate (ASR): GCD achieved the highest ASR across all models. Notably, it reached 100% ASR on Mistral-7B and 97.92% on Qwen-2.5-7B, significantly outperforming GCG (which dropped to 0% under perplexity defense on Qwen and Mistral) and other baselines.
Defense Evasion: Under perplexity-based filtering, GCD maintained high success rates (e.g., 85.42% on Llama-3-8B and 100% on Mistral-7B), whereas gradient-based methods like GCG and GBDA dropped to 0%.
Response Quality: GCD achieved high scores on the StrongReject (SR) harmfulness scale (e.g., 0.8234 on Mistral-7B), indicating that the generated responses were not only successful but substantively harmful and aligned with the original intent.
Detection Rates: The constructed adversarial prompts were detected at lower rates by perplexity-based and guard-model filters compared to other methods.

5. Significance and Claims

The paper claims that GCD successfully resolves the fundamental tradeoff in adversarial attacks: it combines the fluency of prompt-rewriting approaches with the fine-grained token-level control of gradient-based optimization. By leveraging the generative priors of discrete diffusion models, GCD constrains the search space to coherent, human-readable text while still allowing for precise optimization to force specific target outputs.

The authors position GCD as a practical step toward bridging the gap between sparse black-box feedback and full-information optimization. They assert that their method demonstrates that it is possible to generate attacks that are simultaneously stealthy (low perplexity), semantically coherent (low jailbreak tax), and highly effective against robust, safety-aligned models. The work highlights that current defenses relying on perplexity or semantic guard models are vulnerable to attacks that utilize diffusion-guided search to maintain natural language properties while strictly adhering to malicious objectives.