← Back to all news
arXiv Machine Learning By Jinwei Gan, Zifeng Cheng, Zhiwei Jiang, Ran Sun, Shiping Ge, Qing Gu

Harmful Responses Are Jailbreak Templates: Transferring Autoregressive Jailbreaks to Diffusion Language Models

Read the original on arXiv Machine Learning →

The paper introduces RMT-Jailbreak, a method that transfers autoregressive jailbreak attacks to diffusion large language models (dLLMs). By masking tokens in a harmful response generated by an autoregressive model, the approach creates a high‑mask‑ratio template that, when fed to a dLLM, prompts it to reconstruct the harmful content. Experiments show that this technique effectively transfers jailbreak attacks across different models, highlighting a new vulnerability in diffusion-based language models.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv Machine Learning.

Related stories

arXiv AI
Jun 4

MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

arXiv:2606. 04027v1 Announce Type: cross Abstract: Diffusion large language models (dLLMs) generate text by iteratively denoising partially masked sequences under bidirectional context, exposing a safety surface distinct from autoregressive LLMs.

By Yingzi Ma, Zhengyue Zhao, Xiaogeng Liu, Minhui Xue, Yue Zhao, Chaowei Xiao
llmsdiffusionreinforcement-learningbenchmarkssafety
More like this →
arXiv AI
Aug 20

Jailbreaking in the Haystack

The paper "Jailbreaking in the Haystack" introduces NINJA, a jailbreak technique that exploits long-context language models by appending benign, model-generated content to harmful user goals. It demonstrates that the position of harmful goals within the context is crucial for safety, and shows that NINJA significantly boosts attack success rates on models such as LLaMA, Qwen, Mistral, and Gemini. Unlike previous methods, NINJA is low-resource, transferable, less detectable, and compute‑optimal, revealing that carefully crafted benign long contexts can expose fundamental vulnerabilities in modern LMs.

By Rishi Rajesh Shah, Chen Henry Wu, Shashwat Saxena, Ziqian Zhong, Alexander Robey, Aditi Raghunathan
llmsagentsbenchmarkssafety
More like this →
arXiv Computer Vision
Oct 7

The Linear Geometry of Interpretable Tokens: Jailbreaking Attacks and Defenses for Unlearned Diffusion Models

The paper investigates how diffusion models, even after fine‑tuning to unlearn harmful concepts, still retain a linear residual of those concepts in token embeddings. It introduces SubAttack, a jailbreak method that extracts this residual by learning orthogonal attack tokens composed of interpretable textual elements, and SubDefense, a plug‑and‑play defense that projects out the same subspace to suppress the residual. Experiments show SubAttack outperforms prior attacks in power and transferability, while SubDefense offers stronger robustness and better preservation of safe generation quality.

By Siyi Chen, Yimeng Zhang, Sijia Liu, Qing Qu
ragdiffusionfine-tuningsafety
More like this →