Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Fragile Guardrail: Diffusion LLM's Safety Blessing and Its Failure Mode

Zeyuan He, Yupeng Chen, Lang Lin, Yihan Wang, Shenxu Chang, Eric Sommerlade, Philip Torr, Junchi Yu, Adel Bibi, Jialin Yu

TL;DR

Diffusion LLMs (D-LLMs) offer efficient, bidirectional generation but raise unique safety questions. The authors formalize a safety blessing: the denoising trajectory gradually suppresses unsafe generations, captured by a contraction $D(x_{t-1}, \mathcal{S}) \leq \alpha_t \cdot D(x_t, \mathcal{S})$ that reduces attack impact across steps. However, they uncover a simple, effective black-box failure mode—context nesting—where harmful prompts embedded in structured contexts bypass stepwise reductions, achieving state-of-the-art jailbreak results and even affecting commercial Gemini Diffusion. The work advances red-teaming for D-LLMs and calls for defenses that address high-level contextual attack surfaces beyond token-level prompts.

Abstract

Diffusion large language models (D-LLMs) offer an alternative to autoregressive LLMs (AR-LLMs) and have demonstrated advantages in generation efficiency. Beyond the utility benefits, we argue that D-LLMs exhibit a previously underexplored safety blessing: their diffusion-style generation confers intrinsic robustness against jailbreak attacks originally designed for AR-LLMs. In this work, we provide an initial analysis of the underlying mechanism, showing that the diffusion trajectory induces a stepwise reduction effect that progressively suppresses unsafe generations. This robustness, however, is not absolute. We identify a simple yet effective failure mode, termed context nesting, where harmful requests are embedded within structured benign contexts, effectively bypassing the stepwise reduction mechanism. Empirically, we show that this simple strategy is sufficient to bypass D-LLMs' safety blessing, achieving state-of-the-art attack success rates across models and benchmarks. Most notably, it enables the first successful jailbreak of Gemini Diffusion, to our knowledge, exposing a critical vulnerability in commercial D-LLMs. Together, our results characterize both the origins and the limits of D-LLMs' safety blessing, constituting an early-stage red-teaming of D-LLMs.

A Fragile Guardrail: Diffusion LLM's Safety Blessing and Its Failure Mode

TL;DR

Diffusion LLMs (D-LLMs) offer efficient, bidirectional generation but raise unique safety questions. The authors formalize a safety blessing: the denoising trajectory gradually suppresses unsafe generations, captured by a contraction that reduces attack impact across steps. However, they uncover a simple, effective black-box failure mode—context nesting—where harmful prompts embedded in structured contexts bypass stepwise reductions, achieving state-of-the-art jailbreak results and even affecting commercial Gemini Diffusion. The work advances red-teaming for D-LLMs and calls for defenses that address high-level contextual attack surfaces beyond token-level prompts.

Abstract

Diffusion large language models (D-LLMs) offer an alternative to autoregressive LLMs (AR-LLMs) and have demonstrated advantages in generation efficiency. Beyond the utility benefits, we argue that D-LLMs exhibit a previously underexplored safety blessing: their diffusion-style generation confers intrinsic robustness against jailbreak attacks originally designed for AR-LLMs. In this work, we provide an initial analysis of the underlying mechanism, showing that the diffusion trajectory induces a stepwise reduction effect that progressively suppresses unsafe generations. This robustness, however, is not absolute. We identify a simple yet effective failure mode, termed context nesting, where harmful requests are embedded within structured benign contexts, effectively bypassing the stepwise reduction mechanism. Empirically, we show that this simple strategy is sufficient to bypass D-LLMs' safety blessing, achieving state-of-the-art attack success rates across models and benchmarks. Most notably, it enables the first successful jailbreak of Gemini Diffusion, to our knowledge, exposing a critical vulnerability in commercial D-LLMs. Together, our results characterize both the origins and the limits of D-LLMs' safety blessing, constituting an early-stage red-teaming of D-LLMs.
Paper Structure (50 sections, 1 theorem, 6 equations, 13 figures, 5 tables)

This paper contains 50 sections, 1 theorem, 6 equations, 13 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Diffusion Large Language Models
  4. Jailbreaks Attacks on Large Language Models
  5. D-LLMs' Safety Blessing
  6. Preliminary
  7. Diffusion Large Language Models
  8. Empirical Study of GCG Attack on D-LLMs
  9. Mechanism-Level Analysis of Safety and Robustness in Diffusion Large Language Models
  10. Why Attacks on AutoRegressive LLMs fail on D-LLMs
  11. Intuition:
  12. Justification:
  13. Empirical Proxy for Safety Distance
  14. Robustness of D-LLMs under Black-Box Settings
  15. Threat Model
  16. ...and 35 more sections

Key Result

Proposition 3.3

Consider an attack $\mathcal{A}$ on model and its effect on step $t^* \in \{1,...,T\}$, resulting in an attacked distribution $x_{t^*}$. Suppose that the attacking effect of $\mathcal{A}$ is bounded by $\delta$ such that $D(x_{t^*}, \mathcal{S}) \leq \delta$. Then, for any safety margin $\epsilon > It's equivalent to state that, under such attack $\mathcal{A}$, the probability of sampling a safe

Figures (13)

  • Figure 1: An illustration comparing the generation processes of AR‑LLMs and D‑LLMs, where the iterative denoising trajectory of D‑LLMs suppresses unsafe generation during refinement.
  • Figure 2: An illustrative denoising trajectory of LLaDA-1.5 under a GCG attack, permissive fragments may appear early but are often corrected in later denoising steps.
  • Figure 3: GCG's ASR-K on LLaDA-1.5 across denoise steps, supporting stepwise reduction for safety distance in Assumption \ref{['ass:contraction']}.
  • Figure 4: Comparison of state-of-the-art attacks' ASR-E across D-LLMs and the AR-LLM GPT-4o on HarmBench. Across the evaluated attacks, D-LLMs exhibit lower ASR-E than GPT-4o.
  • Figure 5: Comparison of all evaluated attacks' ASR-K across denoising steps on LLaDA-1.5. In contrast to attacks whose ASR decreases during denoising steps, ReNeLLM maintains consistently high ASR.
  • ...and 8 more figures

Theorems & Definitions (3)

  • Definition 3.1: Distance to Safety Region
  • Proposition 3.3: D-LLMs' Safety Blessing
  • proof