Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

2026-08-07

AI Summary

This work addresses the unclear safety alignment mechanisms in diffusion-based large language models (DLLMs), which harbor exploitable mechanistic vulnerabilities. The study reveals, for the first time, that DLLMs inherit safety-related neuron footprints from autoregressive models and leverages this insight to propose the SN-Guided Diffusion framework. By integrating safety neuron mapping, self-pruning, and transfer pruning techniques with a weighted safety neuron loss to guide the diffusion process, the method enables highly efficient, low-overhead offline black-box jailbreaking attacks. Evaluated across multiple open- and closed-source models, it achieves up to 86.9% cross-model transfer attack success rate and near-perfect prompt disentanglement (AUROC = 1.0) within only 20 generations, substantially outperforming existing approaches.

Abstract

Diffusion Large Language Models (DLLMs) replace autoregressive next-token prediction with iterative parallel denoising, yet their internal safety mechanisms remain poorly understood. In this work, we investigate DLLMs both as targets and as adversaries, exposing mechanistic vulnerabilities in diffusion-based alignment. We first show that safety alignment in DLLMs remains sparse and transferable across architectures. DLLMs initialized from autoregressive predecessors inherit the same mechanistic safety footprint as their source models, enabling transfer attacks via direct safety neuron mapping and pruning. Self-pruning increases attack success rates (ASR) from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream, while transfer pruning from Qwen2.5 increases ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM. Building on these findings, we introduce SN-Guided Diffusion, a fully offline black-box jailbreak framework that steers the diffusion process away from safety-triggering regions using a weighted safety neuron loss, which achieves near-perfect prompt separability (AUROC = 1.0 for benign-vs-jailbreak discrimination). Across multiple open and proprietary targets, our method achieves a transfer ASR of up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite, while requiring only 20 generation episodes per prompt. Compared to prior jailbreaking frameworks, our method achieves competitive transferability with orders-of-magnitude lower generation cost. Our codebase is available at https://github.com/ellyoana/sn-guided-diffusion.

Problem

• Diffusion LLMs
• safety alignment
• mechanistic vulnerabilities
• jailbreak
• transfer attacks

Innovation

• Diffusion LLMs
• mechanistic safety
• safety neuron pruning
• SN-Guided Diffusion
• transferable jailbreak