GCG Attack On A Diffusion LLM

TL;DR

This work assesses the robustness of diffusion-based LLMs to Greedy Coordinate Gradient (GCG) style adversarial prompts. It adapts GCG to diffusion LLMs by evaluating three attack variants (prefix perturbations, random suffix, and Qwen-seeded suffix) on the open-source LLaDA platform using AdvBench prompts, guided by a diffusion-specific log-likelihood loss that optimizes prompt modifications. Key findings show prefix-based attacks outperform suffix-based ones, while the loss objective often does not reliably predict adversarial success, with diffusion models exhibiting jittery loss and occasional garbage outputs under attack. The study highlights diffusion-LM vulnerabilities, encourages alternative optimization/evaluation strategies, and points to future work on more robust/fine-tuned diffusion LLMs and improved defense-oriented testing.

Abstract

While most LLMs are autoregressive, diffusion-based LLMs have recently emerged as an alternative method for generation. Greedy Coordinate Gradient (GCG) attacks have proven effective against autoregressive models, but their applicability to diffusion language models remains largely unexplored. In this work, we present an exploratory study of GCG-style adversarial prompt attacks on LLaDA (Large Language Diffusion with mAsking), an open-source diffusion LLM. We evaluate multiple attack variants, including prefix perturbations and suffix-based adversarial generation, on harmful prompts drawn from the AdvBench dataset. Our study provides initial insights into the robustness and attack surface of diffusion language models and motivates the development of alternative optimization and evaluation strategies for adversarial analysis in this setting.

Figures (2)

• Figure 1: Comparison of attack success across attack types
• Figure 2: Loss evolution across three adversarial examples.