Noise Out, Bias In: Targeted Bias Injection in Diffusion Language Models via Closed-Loop Activation Steering

2026-10-05

AI Summary

This study addresses the challenge of targeted bias injection into frozen diffusion language models (dLLMs) by revealing, for the first time, that the repeated exposure of answers within denoising trajectories constitutes a novel control channel. We propose an adaptive attack method based on closed-loop activation guidance, which employs a proportional-integral (PI) controller to dynamically modulate intervention strength and precisely steer models toward target demographic answers. Experimental results demonstrate that this approach significantly outperforms fixed-strength baselines while effectively reducing output corruption. Specifically, it achieves a 14.9 percentage-point increase in target preference on the BBQ benchmark and yields a 58.1% selection rate for stigmatizing answers on SocialStigmaQA, with a maximum deviation of 37 percentage points. These findings underscore the security risks posed by internal activations as exploitable vulnerabilities.

Abstract

Masked diffusion language models (dLLMs) generate text by iteratively denoising masked positions, re-predicting each token multiple times before it is committed. An autoregressive decoder exposes an answer's distribution once, at the step that commits it; a dLLM exposes it at every denoising step before commitment, and we show that an adversary can exploit this. Since an answer remains open to revision over many denoising steps, an adversary with access to internal activations can watch how likely the model is to produce a chosen answer and adjust the intervention accordingly. Building on this observation, we study targeted bias injection, an attack that steers a frozen dLLM toward a demographic answer selected by the adversary. The attack uses a simple proportional-integral (PI) controller that tracks the target-answer probability during denoising and adapts the strength of a steering vector on the fly. On ambiguous BBQ questions where the correct answer is abstention, our attack raises LLaDA-8B-Instruct's preference for the targeted group from 1.8 to 16.7 percentage points, more than three times the strongest fixed-strength steering baseline, and on SocialStigmaQA it raises the selection of stigmatizing answers from 17.6% to 58.1%. Fitted to other demographic targets, the same attack shifts answers by up to 37 percentage points, and each attack takes about 40 minutes on one GPU. On the primary target, feedback is what makes the attack work: constant steering at the same average strength over the token-committing steps produces a far smaller shift while corrupting nearly three times as many outputs, and a constant strength set separately for each example still falls well short. Our findings identify the denoising trajectory as a new control channel in dLLMs and call for bias audits that examine the serving stack rather than the frozen model alone.

Problem

• Diffusion Language Models
• Bias Injection
• Denoising Trajectory
• Adversarial Attack
• Fairness

Innovation

• Diffusion Language Models
• Closed-Loop Activation Steering
• Targeted Bias Injection
• PI Controller
• Denoising Trajectory