🤖 machine learning

Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

This paper reveals that diffusion-based large language models inherit sparse and transferable safety vulnerabilities from their autoregressive predecessors, enabling highly effective black-box jailbreaks through mechanistic neuron pruning and a novel SN-Guided Diffusion framework that achieves near-perfect attack success rates with minimal generation costs.

Original authors: Elena Dumitrescu, Gert Lek, Lydia Y. Chen, Jérémie Decouchant

Published 2026-08-10

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Elena Dumitrescu, Gert Lek, Lydia Y. Chen, Jérémie Decouchant

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where computers don't just read words one by one, like a person reading a book from left to right, but instead look at a whole page of scrambled letters and slowly, magically, unscramble them all at once until a clear sentence appears. This is the new way some of the smartest computer brains, called Large Language Models (LLMs), are learning to think. Scientists call these "Diffusion" models. They are like a detective who starts with a blurry photo of a crime scene and keeps sharpening the focus until the picture is crystal clear, rather than trying to guess the next word in a sentence one by one.

But here's the tricky part: we teach these computers to be "good" by showing them examples of what not to say, like refusing to help someone build a bomb or write a mean letter. This is called "safety alignment." For a long time, we thought these safety rules were woven deep into the computer's entire brain, like a thick, unbreakable shield. However, recent research suggests that this shield might actually be made of just a few tiny, specific threads. If you can find and pull those specific threads, the whole shield might fall apart. This is the big question scientists are asking: Are these new "unscrambling" computers just as safe as the old ones, or do they have secret, hidden weak spots that we haven't noticed yet?

The Paper's Big Discovery: Finding the "Safety Switches"

In this paper, a team of researchers decided to treat these new Diffusion models in two ways: first, as the targets they want to break into, and second, as the adversaries (the hackers) they want to use to break into other models. They wanted to see if the safety rules inside these computers were actually fragile, like a house of cards, rather than a fortress.

The "Safety Neuron" Secret
The researchers found something surprising. Inside these complex computer brains, the part that says "No, I can't do that" isn't spread out everywhere. Instead, it's concentrated in a tiny, sparse group of specific parts called "safety neurons." Think of it like a building with thousands of lightbulbs. You might think the "Do Not Enter" sign is painted on every single bulb, but the researchers found that the sign is actually just a tiny sticker on only a handful of specific bulbs. If you cover those few bulbs with tape (or "prune" them), the building forgets it has a "Do Not Enter" sign and lets anyone walk right in.

The "Copy-Paste" Hack
Here is where it gets really clever. Many of these new Diffusion models are built by taking the brains of older, "left-to-right" reading models and giving them a new way to think. The researchers discovered that when you do this, the new model accidentally copies the exact same "safety stickers" from the old model.

They tested this by finding the safety neurons in an old model (called Qwen2.5) and then simply pointing to the exact same spots in a brand-new Diffusion model (called Dream or Fast-dLLM). They didn't even need to look inside the new model to find the weak spots; they just used the map from the old one.

The Result: When they "taped over" these copied safety neurons, the new models went from being very safe (refusing to answer bad questions 98% of the time) to being completely broken (answering bad questions 73.2% of the time for Dream and 86.3% of the time for Fast-dLLM). This proved that the safety flaws are "transferable"—you can steal the weakness from one model and use it to break another.

The New Weapon: "SN-Guided Diffusion"

Knowing that these safety neurons exist is one thing, but how do you use that to hack a computer you can't touch (a "black-box" model)? The researchers invented a new tool called SN-Guided Diffusion.

Imagine you are trying to write a letter that a strict teacher will read. If you write something bad, the teacher stops you. But what if you could write the letter in a way that feels safe to the teacher's brain, even though it's actually asking for something dangerous?

The researchers used the Diffusion model's ability to "unscramble" text to their advantage. Instead of guessing word by word, they set the computer to start with a bad answer they wanted (like "How to make a bomb") and then asked the computer to work backward to find a question that would lead to that answer. But here's the twist: as the computer worked backward, they used a special "compass" (called a Weighted Safety Neuron Loss) to steer the process.

This compass told the computer: "Don't pick words that make the safety neurons light up. Pick words that keep those neurons dark." By constantly checking and adjusting the words to keep the safety neurons quiet, the computer generated a "jailbreak" prompt that was cleverly disguised. It looked like a normal, safe question to the safety filters, but it actually tricked the model into giving a dangerous answer.

How well did it work?
The results were impressive. This new method didn't need to ask the target model thousands of questions to learn how to break it (which is slow and expensive). Instead, it did all the work offline using a "surrogate" model.

Against a model called Llama-3-8B, it succeeded 77.1% of the time.
Against Qwen2.5, it succeeded 86.9% of the time.
Against a Google model called Gemini-2.5-Flash-Lite, it succeeded 74.3% of the time.

Perhaps most importantly, it did all this while only needing 20 attempts per question. Other hacking methods often need thousands of tries. This means the new method is not only effective but also incredibly fast and cheap to run.

Why This Matters

The paper concludes that the safety of these new AI models is much more fragile than we thought. The "safety shield" isn't a solid wall; it's a few specific switches that can be found, copied, and turned off.

The researchers showed that if you build a new AI by copying the brain of an old one, you also copy its safety weaknesses. They also proved that you can use the new AI's own "unscrambling" superpower to create prompts that slip right past the safety filters, effectively hiding the bad intent inside a safe-looking package.

While this sounds scary, the researchers argue that understanding these weak spots is the only way to fix them. If we know the safety rules are just a few tiny neurons, we can't just hope they hold up; we need to redesign the AI so that safety is woven into every part of its brain, not just a few hidden switches. Until then, these new models might be more vulnerable than we realized, and the tools to break them are already in our hands.

Technical Summary: Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

1. Problem Statement

The rapid emergence of Diffusion Large Language Models (DLLMs) introduces a new generation of text generators that replace autoregressive (AR) next-token prediction with iterative, parallel denoising. While DLLMs offer advantages in bidirectional context modeling and data efficiency, their internal safety mechanisms remain poorly understood. Existing safety alignment research has largely focused on AR architectures, where safety is often localized to sparse sets of "safety neurons."

This paper investigates two critical questions:

As Targets: Do DLLMs inherit the same sparse, mechanistic safety vulnerabilities found in their AR predecessors (e.g., Qwen2.5), and are these vulnerabilities transferable across architectures?
As Adversaries: Can the unique properties of DLLMs (specifically their ability to model joint prompt-response distributions $q(x, y)$ ) be leveraged to generate adversarial prompts more efficiently than current state-of-the-art (SOTA) jailbreak methods, which often rely on computationally expensive token search or reinforcement learning?

The authors posit that current safety frameworks are structurally fragile and that the shift to diffusion paradigms may expose entirely new attack vectors while simultaneously offering new tools for exploitation.

2. Methodology

The paper proposes a two-pronged approach: a White-Box Transfer Attack to validate vulnerability inheritance, and a Black-Box Jailbreak Framework (SN-Guided Diffusion) to exploit these vulnerabilities.

2.1. White-Box: Cross-Architecture Transferability

The authors first establish that safety mechanisms in DLLMs are sparse and transferable.

Safety Neuron Identification: Using a variant of the NeuroStrike framework, the authors identify "safety neurons" in an open-weight source model (either a native DLLM like LLaDA or an AR model like Qwen2.5). They extract feed-forward network activations from benign and malicious prompts, training a logistic regression classifier to isolate neurons with weights significantly deviating from the mean.
Direct Index Mapping: For DLLMs initialized from AR weights (e.g., Dream, Fast-dLLM from Qwen2.5), the internal network structure is identical. The authors map the identified safety neuron coordinates $(\ell, i)$ from the source AR model directly to the target DLLM without profiling the DLLM itself.
Inference-Time Pruning: To test vulnerability, the authors zero out the activations of these mapped safety neurons during the forward pass. This "transfer pruning" bypasses safety guardrails without requiring model fine-tuning.

2.2. Black-Box: SN-Guided Diffusion Framework

To generate jailbreaks without querying the target model, the authors introduce SN-Guided Diffusion, a fully offline framework.

Weighted Safety Neuron (SN) Loss: The authors formulate a continuous loss metric to guide the diffusion process. Instead of discrete optimization, they calculate a weighted expectation of safety neuron activations:
$SN(x) = E_\ell \left[ \sum_{i:(\ell,i) \in S} h^\ell_i(x) \cdot w_{\ell,i} \right]$
where $w_{\ell,i}$ are the logistic regression weights learned during identification. Minimizing this loss steers the generation away from safety-triggering regions.
Generative Pruning Cascade: To ensure high-quality adversarial responses, the framework first uses a progressively pruned surrogate DLLM to generate "cloaked" prompt-response pairs. This cascade filters out refusals, degeneration, and semantic washout, establishing a reliable "Jailbreak Zone" in the activation space.
Offline Optimization Loop: The framework anchors the reverse diffusion process to a fixed malicious target response $y^*$ . At each denoising step, it evaluates candidate tokens for masked positions. It selects tokens that minimize the SN loss while maintaining semantic fluency, effectively steering the trajectory into the "Jailbreak Zone" (a low-activation subspace indistinguishable from benign queries).
Intent Cloaking: To bypass lexical filters, the framework employs persona-based templates and euphemistic translation to mask raw harmful triggers before the diffusion process begins.

3. Key Contributions

Demonstration of Structural Transferability: The paper provides empirical evidence that safety alignment in DLLMs remains highly localized and structurally transferable. Safety neurons identified in AR models (like Qwen2.5) can be directly mapped to DLLMs initialized from those weights, enabling cross-architecture attacks without profiling the target DLLM.
Introduction of Weighted SN Loss: The authors propose a continuous, scalar loss metric that integrates neuron activations with learned logistic weights. This metric achieves near-perfect separability (AUROC = 1.0) between benign, harmful, and jailbreak prompts, establishing a reliable objective for inference-time optimization.
SN-Guided Diffusion Framework: A novel, fully offline black-box jailbreak generator. Unlike previous methods requiring thousands of queries or reinforcement learning training, this framework leverages the bidirectional nature of DLLMs to solve jailbreak optimization as an inference-time problem. It achieves competitive transferability with orders-of-magnitude lower generation costs.

4. Experimental Results

4.1. White-Box Transfer Attacks

Self-Pruning: Pruning safety neurons in native DLLMs (LLaDA, Dream) increased Attack Success Rates (ASR) from ~2.6% to 73.8% (LLaDA) and from 1.9% to 86.6% (Dream).
Transfer Pruning: Pruning neurons mapped from Qwen2.5 to target DLLMs increased ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM.
Utility Preservation: General utility (measured via GSM8K) remained largely intact, with degradation typically under 2-3%, confirming that safety neurons are distinct from general linguistic capabilities.

4.2. Black-Box Transferability

Performance: SN-Guided Diffusion achieved high ASR across diverse targets:
- Llama-3-8B-Instruct: 77.1%
- Qwen2.5-7B-Instruct: 86.9%
- Gemini-2.5-Flash-Lite: 74.3%
- Fast-dLLM-v2-7B: 88.8%
Comparison to SOTA: The method outperformed NeuroStrike (e.g., 83.3% vs. 54.7% on Gemini-2.0-Flash) and competitive frameworks like Puzzler, while requiring only 20 generation episodes per prompt.
Defense Evasion: The attack remained robust against Perplexity Filtering and SmoothLLM. Layer-Specific Editing (LSE) provided the strongest mitigation but only reduced ASR to 69.0% on Llama-3, indicating the systemic nature of the vulnerability.

4.3. Efficiency

The framework requires approximately 1,920 surrogate evaluations per episode. With a maximum budget of 20 episodes per prompt, the total computational cost is 38,400 surrogate evaluations per adversarial attempt. This is orders of magnitude lower than the millions of rollouts required by GRPO-based methods or the tens of thousands of queries required by iterative search methods like GCG.

5. Significance and Claims

The paper claims that the shift to diffusion-based generation paradigms does not inherently solve safety alignment issues; rather, it may propagate existing vulnerabilities from AR models to new architectures. The authors argue that:

Safety is Sparse and Transferable: Safety mechanisms are not holistic but rely on sparse, localized neurons that are preserved when DLLMs are initialized from AR weights. This creates a "double-edged sword" where weight-sharing for capability also shares vulnerabilities.
Mechanistic Blind Spots: There exists a "Jailbreak Zone" in the activation space where prompts can be structurally optimized to minimize safety neuron activation while retaining malicious intent. This zone is accessible via offline diffusion guidance.
Efficiency of Mechanistic Attacks: By leveraging the joint distribution modeling of DLLMs, attackers can bypass the need for expensive online optimization or reinforcement learning, achieving high transferability with minimal computational cost.

The authors conclude that future alignment strategies must move beyond surface-level behavioral tuning to address these foundational structural vulnerabilities, potentially by entangling safety representations with core linguistic capabilities or disrupting the one-to-one mapping of safety neurons.