The Devil behind the mask: An emergent safety vulnerability of Diffusion
  LLMs
Diffusion-based large language models (dLLMs) have recently emerged as a
powerful alternative to autoregressive LLMs, offering faster inference and
greater interactivity via parallel decoding and bidirectional modeling.
However, despite strong performance in code generation and text infilling, we
identify a fundamental safety concern: existing alignment mechanisms fail to
safeguard dLLMs against context-aware, masked-input adversarial prompts,
exposing novel vulnerabilities. To this end, we present DIJA, the first
systematic study and jailbreak attack framework that exploits unique safety
weaknesses of dLLMs. Specifically, our proposed DIJA constructs adversarial
interleaved mask-text prompts that exploit the text generation mechanisms of
dLLMs, i.e., bidirectional modeling and parallel decoding. Bidirectional
modeling drives the model to produce contextually consistent outputs for masked
spans, even when harmful, while parallel decoding limits model dynamic
filtering and rejection sampling of unsafe content. This causes standard
alignment mechanisms to fail, enabling harmful completions in alignment-tuned
dLLMs, even when harmful behaviors or unsafe instructions are directly exposed
in the prompt. Through comprehensive experiments, we demonstrate that DIJA
significantly outperforms existing jailbreak methods, exposing a previously
overlooked threat surface in dLLM architectures. Notably, our method achieves
up to 100% keyword-based ASR on Dream-Instruct, surpassing the strongest prior
baseline, ReNeLLM, by up to 78.5% in evaluator-based ASR on JailbreakBench and
by 37.7 points in StrongREJECT score, while requiring no rewriting or hiding of
harmful content in the jailbreak prompt. Our findings underscore the urgent
need for rethinking safety alignment in this emerging class of language models.
Code is available at https://github.com/ZichenWen1/DIJA.
687dd6672e8db0930be6f115
Zichen Wen
claimed_verified
2025-07-21T14:21:58.863Z
653b8c3e97a4d71d950e2f20
/avatars/b68880022e14556d0be58c69615db3be.svg
Zichen Wen
user
zichenwen
687dd6672e8db0930be6f116
Jiashu Qu
claimed_verified
2025-07-21T08:29:23.761Z
66b980d66d490d845f8a697e
/avatars/6ab2d08436851063f55baaadae8c4bc0.svg
Joshua Qu
user
Joshua999
687dd6672e8db0930be6f117
Dongrui Liu
687dd6672e8db0930be6f118
Zhiyuan Liu
687dd6672e8db0930be6f119
Ruixi Wu
687dd6672e8db0930be6f11a
Yicun Yang
687dd6672e8db0930be6f11b
Xiangqi Jin
687dd6672e8db0930be6f11c
Haoyun Xu
687dd6672e8db0930be6f11d
Xuyang Liu
687dd6672e8db0930be6f11e
Weijia Li
687dd6672e8db0930be6f11f
Chaochao Lu
687dd6672e8db0930be6f120
Jing Shao
687dd6672e8db0930be6f121
Conghui He
687dd6672e8db0930be6f122
Linfeng Zhang
The Devil behind the mask: An emergent safety vulnerability of Diffusion
  LLMs
Diffusion-based large language models (dLLMs) have recently emerged as a
powerful alternative to autoregressive LLMs, offering faster inference and
greater interactivity via parallel decoding and bidirectional modeling.
However, despite strong performance in code generation and text infilling, we
identify a fundamental safety concern: existing alignment mechanisms fail to
safeguard dLLMs against context-aware, masked-input adversarial prompts,
exposing novel vulnerabilities. To this end, we present DIJA, the first
systematic study and jailbreak attack framework that exploits unique safety
weaknesses of dLLMs. Specifically, our proposed DIJA constructs adversarial
interleaved mask-text prompts that exploit the text generation mechanisms of
dLLMs, i.e., bidirectional modeling and parallel decoding. Bidirectional
modeling drives the model to produce contextually consistent outputs for masked
spans, even when harmful, while parallel decoding limits model dynamic
filtering and rejection sampling of unsafe content. This causes standard
alignment mechanisms to fail, enabling harmful completions in alignment-tuned
dLLMs, even when harmful behaviors or unsafe instructions are directly exposed
in the prompt. Through comprehensive experiments, we demonstrate that DIJA
significantly outperforms existing jailbreak methods, exposing a previously
overlooked threat surface in dLLM architectures. Notably, our method achieves
up to 100% keyword-based ASR on Dream-Instruct, surpassing the strongest prior
baseline, ReNeLLM, by up to 78.5% in evaluator-based ASR on JailbreakBench and
by 37.7 points in StrongREJECT score, while requiring no rewriting or hiding of
harmful content in the jailbreak prompt. Our findings underscore the urgent
need for rethinking safety alignment in this emerging class of language models.
Code is available at https://github.com/ZichenWen1/DIJA.
DIJA is a framework that exploits safety weaknesses in diffusion-based large language models by constructing adversarial prompts, demonstrating significant vulnerabilities in their alignment mechanisms.
diffusion-based large language models dLLMs autoregressive LLMs parallel decoding bidirectional modeling adversarial prompts DIJA jailbreak attack framework context-aware masked-input text generation mechanisms dynamic filtering rejection sampling harmful completions alignment-tuned dLLMs keyword-based ASR evaluator-based ASR JailbreakBench StrongREJECT score