Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models

• URL: http://arxiv.org/abs/2604.08557v2
• Date: Mon, 13 Apr 2026 05:20:53 GMT
• Title: Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models
• Abstract summary: Safety alignment in diffusion language models (dLLMs) relies on a single load-bearing assumption: committed tokens are permanent.<n>We show that by re-masking committed refusal tokens and injecting a short affirmative prefix, achieves 74-82% ASR on HarmBench.<n>We call this attack TrajHijack; it is the first trajectory-level attack on dLLMs, requires no computation, and generalizes across SFT and preference-optimized (VRPO) models.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Safety alignment in diffusion language models (dLLMs) relies on a single load-bearing assumption: that committed tokens are permanent. We show that violating this assumption, by re-masking committed refusal tokens and injecting a short affirmative prefix, achieves 74-82% ASR on HarmBench across all three publicly available safety-tuned dLLMs, rising to 92-98% with a generic 8-token compliance prefix. We call this attack TrajHijack; it is the first trajectory-level attack on dLLMs, requires no gradient computation, and generalizes across SFT and preference-optimized (VRPO) models. Three findings emerge. First, the vulnerability is irreducibly two-component: re-masking alone (4.4%) and prefix alone (5.7%) both fail. Second, gradient optimization via a differentiable Gumbel-softmax chain consistently degrades ASR (41.5% vs. 76.1%), because continuous perturbations push token distributions off-manifold. Third, A2D (the strongest published dLLM defense) is more vulnerable to TrajHijack (89.9%) than the undefended model (76.1%): its silent-refusal training removes the contextual resistance that trajectory-level attacks must overcome, an effect we call the Defense Inversion Effect.

Related papers

• Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits [5.982945107343805]
  We show that safety alignment inDLLMs remains sparse and transferable across architectures.<n>We introduce SN-Guided Diffusion, a fully offline black-box jailbreak framework.<n>Our method achieves competitive transferability with orders-of-magnitude lower generation cost.
  arXiv  Detail & Related papers  (2026-08-07T17:17:18Z)
• CHERRY: Compressed Hierarchical Experts with Recurrent Representational Yield [1.2203679037551938]
  We study three techniques for training compute-efficient language models.<n>SGT concentrates supervision on the 15% of output tokens that carry semantic payload.<n> depth compression with recurrent recovery.<n>We validate these techniques on CHERRY-1.8B, a Korean foundation model.
  arXiv  Detail & Related papers  (2026-06-30T15:14:38Z)
• MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models [53.05463623673949]
  MaskForge is a fully black-box adaptive attack that casts dLLM red-teaming as optimized search over a growing library of structural patterns.<n>It achieves an average attack success rate of 79.3%, a 17.6% improvement over the strongest competing dLLM baseline.
  arXiv  Detail & Related papers  (2026-06-01T18:10:21Z)
• Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection [5.902327401962825]
  We present Reflect-Guard, a method that augments LLM-based safety classifiers with chain-of-thought self-reflection capabilities.<n>Our approach distills analytical reasoning from GPT-4o-mini into structured annotations, then trains Llama-Guard-3-8B via QLoRA to generate logical self-reflections.<n>Using only 1000 training examples and updating just 0.5% of model parameters, Reflect-Guard achieves substantial improvements on two challenging benchmarks.
  arXiv  Detail & Related papers  (2026-05-24T02:58:21Z)
• BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learning [73.46118996284888]
  Research on backdoor attacks against multimodal contrastive learning models faces two key challenges: stealthiness and persistence.<n>We propose BadCLIP++, a unified framework that tackles both challenges.<n>For stealthiness, we introduce a semantic-fusion QR micro-trigger that embeds imperceptible patterns near task-relevant regions.<n>For persistence, we stabilize trigger embeddings via radius shrinkage and centroid alignment.
  arXiv  Detail & Related papers  (2026-02-19T08:31:16Z)
• A Fragile Guardrail: Diffusion LLM's Safety Blessing and Its Failure Mode [51.43498132808724]
  We show that Diffusion large language models (D-LLMs) have intrinsic robustness against jailbreak attacks.<n>We identify a simple yet effective failure mode, termed context nesting, where harmful requests are embedded within structured benign contexts.<n>We show that this simple strategy is sufficient to bypass D-LLMs' safety blessing, achieving state-of-the-art attack success rates.
  arXiv  Detail & Related papers  (2026-01-30T23:08:14Z)
• Make Anything Match Your Target: Universal Adversarial Perturbations against Closed-Source MLLMs via Multi-Crop Routed Meta Optimization [49.30177419529011]
  We study a more stringent setting, Universal Targeted Transferable Adversarial Attacks (UTTAA)<n>A single perturbation must consistently steer arbitrary inputs toward a specified target across unknown commercial MLLMs.<n>We propose M CRMO-Attack, which stabilizes supervision via Multi-Crop Aggregation with an Attention-Guided Crop.
  arXiv  Detail & Related papers  (2026-01-30T17:03:24Z)
• ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models [67.15960154375131]
  Large reasoning models (LRMs) extend large language models with explicit multi-step reasoning traces.<n>This capability introduces a new class of prompt-induced inference-time denial-of-service (PI-DoS) attacks that exploit the high computational cost of reasoning.<n>We present ReasoningBomb, a reinforcement-learning-based PI-DoS framework that is guided by a constant-time surrogate reward.
  arXiv  Detail & Related papers  (2026-01-29T18:53:01Z)
• Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks [10.7231991032233]
  Large Language Model (LLM) agents are powering a growing share of interactive web applications, yet remain vulnerable to misuse and harm.<n>We present the Online Harassment Agentic Benchmark consisting of: (i) a synthetic multi-turn harassment conversation dataset, (ii) a multi-agent (e.g., harasser, victim) simulation informed by repeated game theory, (iii) three jailbreak methods attacking agents across memory, planning, and fine-tuning, and (iv) a mixed-methods evaluation framework.
  arXiv  Detail & Related papers  (2025-10-16T01:27:44Z)
• DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models [50.21378052667732]
  We conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics.<n>We propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach.
  arXiv  Detail & Related papers  (2025-09-29T05:17:10Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.