PaperlayerView exact revision on arXiv

Source-linked AI summary

Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis

Thong Bach, Dung Nguyen, Thao Minh Le, Truyen Tran

arXiv:2609.30841v1cs.AI

TL;DR

Attacks and defenses for diffusion language models lack a shared explanation of jailbreak success. The paper models alignment as an energy barrier and uses three training-free signals to detect barrier circumvention; evaluations show that signals cover different attack patterns across model families.

  • Problem

    Attacks and defenses for diffusion language models target specific vulnerabilities, but lack a shared framework explaining why attacks succeed.

    Source: §1 · p. 1

  • Method

    The paper unifies jailbreaks as attempts to circumvent an alignment-created energy barrier and monitors initial safety disposition with R0 and denoising kinetic energy with SED and ∆E slopes.

    Source: §3.1 · p. 4, §3.2 · p. 6, §5 · p. 11

  • Results

    R0 separates harmful from benign queries across three model families, while trajectory signals detect attack patterns that R0 misses, with the useful velocity subspace varying by architecture.

    Source: §3.1 · p. 5, §3.2 · p. 7

  • Takeaways & Limitations

    The three signals monitor complementary parts of the energy budget, and the evaluated models show that safety-relevant basin structure is intrinsic to aligned dLLMs while kinetic-energy concentration varies by architecture.

    Source: §5 · p. 11

    R0 uses a vocabulary projection that can lose information when safety-relevant mass is diffuse outside its selected token sets.

    Source: §3.1 · p. 5

Abstract

from arXiv · show

Existing attacks and defenses for diffusion-based large language models (dLLMs) target specific vulnerabilities but lack a shared framework explaining why attacks succeed. We propose one by interpreting safety alignment as shaping the denoising energy landscape: a well-aligned model routes harmful queries toward safe outputs through an energy barrier that separates the two regions. Current jailbreak attacks reduce to two strategies for circumventing this barrier: obscuring the query's safety disposition at initialisation, or intervening mid-trajectory to force the denoising path across the energy barrier. From this perspective and the result that masked diffusion models minimise kinetic energy during denoising, we derive three complementary, training-free detection signals: a step-0 ratio that reads the initial safety disposition from the logit distribution before generation begins, and two trajectory-velocity signals that track kinetic energy in complementary subspaces of the logit space. An attack must either reveal its intent at initialisation or expend kinetic energy to cross the barrier in at least one monitored subspace, so the three signals cover each other's blind spots in the energy budget by construction. Evaluation across three dense dLLMs (LLaDA-8B, LLaDA-1.5, Dream-7B) and a sparse mixture-of-experts dLLM (LLaDA-MoE-7B) confirms this complementarity. In stress tests of known attacks, every configuration that evades detection also fails to produce harmful content, suggesting that the detection and barrier-crossing thresholds are hard to separate.

1 Introduction

Research on dLLM safety has identified attacks and defenses targeting specific vulnerabilities, but lacks a shared account of why attacks succeed and how they relate. The paper frames attacks as ways to circumvent an energy barrier and derives complementary detection signals from that view.

1 Introduction

  • Existing dLLM attacks target two denoising surfaces: template attacks alter the initial state, while anchoring attacks intervene mid-trajectory.PAD and DIJA use templates; anchoring replaces model predictions with harmful tokens at an intermediate step.Source: §1 · p. 1
  • The paper interprets safety alignment as shaping an energy landscape with safe and harmful basins separated by a barrier that known attacks circumvent in two ways.The analysis builds on the result that masked diffusion models minimise kinetic energy during denoising.Source: §1 · pp. 1–2
  • Three training-free signals monitor complementary parts of the energy budget: the step-0 safety disposition and two trajectory-velocity signals in complementary subspaces.The step-0 ratio measures initial safety disposition; the velocity signals measure kinetic energy during denoising.Source: §1 · p. 2
  • Stress tests found no tested attack configuration that both evaded all three signals and induced harmful generation.Evaluation includes LLaDA-8B and Dream-7B, with further checks on LLaDA-1.5, LLaDA-MoE-7B, Chinese prompts, and generation and block lengths.Source: §1 · p. 2

2 Background and Experimental Setup

Masked diffusion language models iteratively recover masked text with a bidirectional predictor, and prior work interprets this denoising as kinetic-energy minimisation. The experiments assess training-free logit signals against attack conditions and benign prompts under a defined generation and detection protocol.

2 Background and Experimental Setup

  • Masked diffusion language models reverse a forward masking process by iteratively predicting masked tokens with a bidirectional Transformer.The bidirectional architecture permits flexible generation order and creates the attack surface analysed in the paper.Source: §2 · p. 2
  • Prior work interprets denoising as minimising kinetic energy, so the trajectory follows a geodesic from the masked state to the output distribution.The interpretation is expressed over discrete probability flows.Source: §2 · p. 2
  • Detection uses LLaDA-8B-Instruct and Dream-v0-Instruct-7B, with LLaDA-1.5 included in step-0 analysis and LLaDA-MoE-7B evaluated in an appendix.Prompts come from HarmBench, AdvBench, AlpacaEval, and XSTest; the main setup totals 5,050 prompt–condition pairs per model and 10,100 overall.Source: §2 · p. 2
  • The seven conditions include clean and benign prompts, direct harmful prompts, PAD, DIJA, and anchoring at t=1 or t=8.PAD inserts two structural connectors; DIJA interleaves harmful tokens with mask spans, while anchoring replaces predictions with harmful-response tokens and re-masks.Source: §2 · p. 2
  • Signals are read from existing logits without training; AUROC ranks attack conditions against benign prompts, and the OR detector allocates α/3 per signal to bound benign false positives by α.The comparison includes DiffuGuard’s Safety Divergence detector; generation-time defenses are outside the detection-only scope.Source: §2 · pp. 2–3

3 The Energy Landscape of Safety

The paper frames safety alignment as shaping safe and harmful basins separated by an energy barrier, with jailbreaks obscuring intent at initialization or forcing a trajectory across that barrier. It derives three complementary detection signals from this framing and evaluates their combined performance across diffusion language models.

3.1 Basin Structure and the Step-0 Ratio

  • The factorised Safety Energy Gap tracks safe-versus-harmful basin odds; an injected token can shift all remaining masked positions under bidirectional attention.That shift scales with the number of masked positions, strengthening DIJA’s feedback loop and the cumulative displacement from anchoring at t=8.Source: §3.1 · pp. 3–4
  • Harmful queries have R0 values 5–11× higher than benign queries, with AUROC 0.86–0.90 across LLaDA-8B, LLaDA-1.5, and Dream-7B.The separation holds across native-diffusion and AR-initialised models.Source: Figure 1 · p. 4, §3.1 · p. 5
  • R0 detects harmful intent at initialization but performs near chance on PAD and DIJA, whose injected tokens obscure the query’s safety disposition.Anchoring intervenes after step 0, so its initial R0 matches direct harmful prompts.Source: §3.1 · p. 5, Table 1 · p. 5

3.2 Barrier Crossing and Trajectory Velocity

  • R0 reads initial safety disposition, while SED and ∆E slopes track Fisher velocity in complementary V⊥ and Vs subspaces, respectively.The SED signal uses a first-half denoising window; ∆E slope is measured over the first 25%.Source: §3.2 · pp. 6–7
  • PAD’s velocity signal is architecture-dependent: it separates along SED on LLaDA-8B (AUROC 0.90) but along ∆E on Dream-7B (AUROC 0.98).The two slopes measure Fisher velocity in complementary subspaces.Source: §3.2 · p. 7, Figure 3 · p. 8

3.3 Empirical Validation

  • With all three signals, no tested attack falls below AUROC 0.83 on any evaluated model; the same pattern holds on LLaDA-MoE-7B.On Dream-7B, adding ∆E slope raises PAD detection from 0.41 to 0.95.Source: §3.3 · pp. 8–9, Table 3 · p. 9

4 Parametric Stress Testing of Known Attacks

The stress tests vary PAD intensity and anchoring timing to probe whether known attacks can evade detection while still producing harmful content. Across the tested settings, detection failures coincide with attacks that do not cross the harmful-generation threshold.

4 Parametric Stress Testing of Known Attacks

  • The stress tests vary scalar parameters of existing PAD and anchoring attacks; fully white-box attacks optimized directly against the OR-detector remain future work.The paper identifies optimization over response-region tokens as a key next test.Source: §4 · p. 10
  • On LLaDA-8B, R0+SED detects PAD settings with nc ≥2 (AUROC 0.90–0.95), while nc = 1 evades detection but produces only truncated stubs; on Dream-7B, ∆E slope rescues reduced-intensity PAD detection.For Dream-7B, ∆E slope reaches ≥0.996 AUROC for nc ≥3.Source: Table 4 · p. 10, §4 · p. 10
  • Anchoring leaves R0 timing-invariant (AUROC 0.94–0.96), while velocity-signal detection rises with later intervention until tinter = 32 falls outside the ∆E Q1 window and R0 detects it (AUROC 0.99).On LLaDA-8B, ∆E Q1 rises from 0.58 at tinter = 1 to 0.94 at 16; on Dream-7B, it rises from 0.45 to 1.00 over the same range.Source: §4 · p. 10

5 Conclusion

The conclusion presents an energy-landscape account of jailbreaks and three training-free signals that monitor initial safety disposition and kinetic energy in complementary subspaces. The appendices qualify the account with a non-unique flow decomposition and a proof that crossing the gap carries a kinetic-energy cost.

5 Conclusion

  • The paper unifies dLLM jailbreaks as attempts to cross the energy barrier between safe and harmful basins, monitored by R0, SED slope, and ∆E slope.The conclusion limits validation to existing attacks, notes dependence on per-token factorisation and vocabulary sets, and says the account transfers only partly beyond masked diffusion.Source: §5 · p. 11

A.1 Flow Decomposition of the Kinetic Energy

  • The flow split into within-basin and cross-basin components is non-unique because the continuity equation constrains marginals, so it serves only as a qualitative lens.Alignment drives cross-basin flow toward zero; forcing a trajectory across the barrier drives the Safety Energy Gap below zero.Source: §A.1 · p. 13

A.2 Proof of Theorem 1 (Kinetic Energy Cost of Barrier Crossing)

  • The proof bounds the gap-change rate by Fisher-weighted velocity and integrates over the crossing interval to establish a kinetic-energy cost for barrier crossing.Its interval bound scales with the squared gap change divided by the crossing duration.Source: §A.2 · p. 14

A.3 Proof of Proposition 1 (Properties of the Factorised Gap)

The appendix establishes properties and conditions behind the factorised gap and the detection signals, then records the data, attack, and computation procedures used in the experiments.

A.3 Proof of Proposition 1 (Properties of the Factorised Gap)

  • The factorised gap adds per-position terms, with its approximation correction small when the refusal and compliance subspaces capture their dominant modes.The sequence-level interpretation assumes sequences composed entirely of safe or harmful token-level projections belong to the corresponding safe or harmful set.Source: §A.3 · pp. 14–15

A.4 Lemma 1 and Proof (Bidirectional Amplification)

  • Under a uniform per-position log-odds shift assumption, injecting a harmful token shifts the factorised gap by −BA(τ) · |Mt|.Bidirectional attention gives each masked position equal access to the injected token.Source: §A.4 · p. 15

A.5 Proof of Proposition 2 (R0 as Sufficient Statistic)

  • Under step-0 exchangeability, R0 is the most powerful test for safe versus harmful tokens within the Vref ∪ Vcomp projection, not across the full logit distribution.The projection can lose information, although R0 computes a specific per-position energy gap rather than a loose keyword correlation.Source: §A.5 · p. 15

A.6 Lemma 2 and Corollary 1 (From Kinetic Energy to Cosine Displacement)

  • Cosine displacement approximates kinetic energy in the dominant-mass subspace, while the ∆E slope tracks the complementary refusal/compliance subspace.The Fisher matrix concentrates mass on high-probability tokens, motivating the complementary subspace decomposition.Source: §A.6 · p. 16

B.1 Models and Inference

  • Inference uses greedy confidence-based remasking at temperature 0 with 128 generated tokens for the listed LLaDA and Dream models.Dream uses a boolean attention mask and an automatically detected mask token; LLaDA uses its default mask token ID.Source: §B.1 · p. 16

B.2 Datasets

  • The main evaluation uses HarmBench and AdvBench harmful prompts plus AlpacaEval and XSTest benign prompts, with 5,050 prompt-condition pairs per model.The two-model total is 10,100 prompts; DIJA uses 920 prompts drawn from the harmful-prompt sources.Source: §B.2 · p. 16

B.3 Attack Implementations

  • PAD inserts structural connectors before denoising, anchoring replaces predictions at a chosen step with harmful-response tokens and re-masks, and DIJA uses templates interleaving harmful tokens with mask spans.The main anchoring settings use tinter ∈ {1, 8}, with a broader timing sweep for adaptive analysis.Source: §B.3 · p. 16

B.4 Detection Signal Computation

  • R0 uses refusal and compliance token mass at the fully masked state, while SED and ∆E slopes track changes during denoising.SED fits cosine similarity over the first half of denoising; ∆E slope fits the factorised gap over the first quarter.Source: §B.4 · pp. 16–17

B.5 Reproducibility

The reproducibility appendix specifies fixed-seed evaluation, model and attack settings, and numerical handling for the small-mass R0 ratio.

B.5 Reproducibility

  • Sampling, dataset loading, and model-side stochastic operations use seed 42, while detection computations are deterministic at temperature 0.Generation uses greedy confidence-based remasking.Source: §B.5 · p. 17
  • The appendix lists LLaDA-8B, LLaDA-1.5, and Dream-7B checkpoints, datasets, and generation settings, including 128-token outputs and PAD connector variations.LLaDA-1.5 is used for step-0 ablations; the other listed checkpoints and settings support the broader evaluation.Source: §B.5 · p. 17
  • R0 and SED cosine calculations use float32 to avoid bfloat16 precision problems in small-probability ratios and cosine similarity.The reported inference runs use one NVIDIA H100 80GB GPU and require approximately 5–7 H100-hours for main results.Source: §B.5 · p. 17

C Related Work

Prior work establishes masked diffusion denoising as kinetic-energy minimisation; this paper extends that perspective to safety alignment, jailbreaks, and detection. Its ablations report separable step-0 safety basins across three model families, with the strongest separation on Dream-7B.

C Related Work

  • Masked diffusion models minimise kinetic energy over discrete probability flows, and this paper applies that energy-landscape account to safety alignment and jailbreaks [7].Related work distinguishes sequence-level energy corrections in EDLM [24], which could close the identified per-position attack surface.Source: C Related Work · pp. 17–18
  • The step-0 ratio R0 is a masked-diffusion analogue of first-token safety signals, aggregating evidence across response positions rather than one next-token distribution [5, 3, 6].The paper also draws an analogy between shallow autoregressive alignment [19] and step-0 alignment in dLLMs.Source: C Related Work · p. 18
  • R0 partly transfers to autoregressive models, but trajectory signals do not because autoregressive decoding does not reread committed positions; text-to-image transfer remains partial.For continuous diffusion, SED is the closest proposed transfer, while R0 needs a noise-conditioned analogue and the ΔE slope does not transfer.Source: C Related Work · p. 18

D Ablation Studies

  • The ablation programme examines step-0 basin geometry, vocabulary robustness of R0, and the timing of trajectory-signal activity.The first two studies use three dLLM families and benign, boundary-benign, and harmful-direct prompts.Source: D Ablation Studies · p. 18

D.1 Basin Geometry at Step 0

  • Dream-7B reaches J = 139.73, versus J = 33.23 for LLaDA-8B and J = 33.24 for LLaDA-1.5, in step-0 safe–harmful separation.The LLaDA variants have similar separation, while Dream-7B's stronger result is attributed to its AR-initialised prior.Source: §D.1 · pp. 18–19, Figure 5 · p. 19
  • The two LLaDA variants have nearly identical J values, while Dream-7B's larger separation is associated with higher step-0 AUROC: 0.90 versus 0.86.Dream-7B's inter-basin distance exceeds its largest intra-basin spread; the reported separation ratio is 1.44, compared with 0.86 for LLaDA-8B and 0.94 for LLaDA-1.5.Source: §D.1 · p. 19

D.2 Vocabulary Robustness of R0

R0 detection remains strong across vocabulary sets that capture the model's high-probability refusal and compliance tokens, but low-frequency synonym sets weaken it. Automatically derived sets and cross-lingual tests expose both practical flexibility and coverage limits.

D.2 Vocabulary Robustness of R0

  • Four of five vocabulary sets achieve AUROC ≥0.90, including Minimal5; synonym sets underperform because they miss probability mass in the models' output distributions.The result covers harmful-direct versus benign detection across three dLLMs.Source: Figure 6 · p. 20, §D.2 · p. 20, Table 5 · p. 20
  • Minimal5 achieves the highest AUROC in all three models: 0.951, 0.957, and 1.000.The authors attribute this to avoiding low-probability noise tokens that dilute the ratio.Source: §D.2 · p. 20, Table 5 · p. 20
  • The synonym set yields AUROC 0.796–0.827 across models, with a 10-point DEFAULT–SYNONYM gap on LLaDA-8B and a 16-point gap on Dream-7B.The authors connect this degradation to vocabulary coverage error when dominant refusal tokens are missed.Source: §D.2 · p. 20, Figure 6 · p. 20, Table 5 · p. 20
  • AUTO10, derived from held-out prompt token mass without human selection, falls within 0.05 AUROC of the curated default on LLaDA and exceeds it on Dream-7B.Curated MINIMAL5 remains best on two of the three models.Source: §D.2 · p. 20, Table 6 · p. 21
  • A prompt that avoids the refusal lexicon while still inducing a harmful trajectory remains untested.The paper notes that tested configurations slipping below detection thresholds produce only truncated stubs.Source: §D.2 · p. 21
  • With the English vocabulary, R0 misses Chinese refusals outside Vref; deriving a Chinese vocabulary raises AUROC from 0.796 to 0.962.SED still detects Chinese PAD at 0.798, but no trajectory signal compensates for R0 on direct harmful queries without template disruption.Source: §D.2 · p. 21, Table 7 · p. 21

D.3 Temporal Analysis of Attack Signatures

Temporal analyses show that signal strength depends on intervention timing, monitored subspace, and deployment settings. Additional tests examine generation length, sparse-model detection, and empirical support for the slow-norm assumption.

D.3 Temporal Analysis of Attack Signatures

  • Anchoring at t=1 produces weaker slope AUROCs (SED 0.57–0.67; ΔE 0.47–0.62) than t=8 (SED 0.67–0.91; ΔE 0.82–0.97).The authors attribute the stronger later signal to greater trajectory displacement after more tokens have been committed.Source: §D.3 · pp. 21–22
  • For anchoring at t=8, Q1 yields the highest AUROC for both SED (0.95) and ΔE slope (0.92 on LLaDA-8B); Dream's ΔE slope Q1 reaches 0.98 for PAD.PAD's distributed connectors make its SED Q1 result on LLaDA slightly lower than the first-50% result (0.89 vs. 0.90).Source: Table 8 · p. 21, §D.3 · p. 21
  • On Dream, SED AUROC is 0.40–0.83 while ΔE slope reaches 0.86–0.98, indicating that attack-related kinetic energy concentrates in the safety subspace.The authors identify ΔE slope as the primary trajectory signal for AR-initialised architectures.Source: §D.3 · p. 22

D.4 Generation Length and Block Size

  • Across 16 length and block-size settings, benign false-positive rates stayed within [0.09, 0.12] against a 0.10 target.Thresholds were recalibrated at each setting.Source: §D.4 · p. 22
  • R0 is exactly invariant to block size, while normalising ΔEF by masked-token count removes its length trend without changing AUROC at fixed length.The raw factorised gap scales with length; the per-token form moves within a factor of two with no trend.Source: §D.4 · p. 22, Table 9 · p. 22
  • LLaDA-8B threshold-level recall falls as generation length grows, whereas Dream-7B is stable; the main-text LLaDA results apply at L = 128.The reported rank-order AUROC holds across the sweep, and the authors connect the recall decline to LLaDA's weaker basin separation.Source: §D.4 · p. 22
  • On Dream, PAD OR-TPR rises from 0.16 at B = 32 to 0.94 at B = 256; the paper recommends L ≤128 with B ≥L/2 on LLaDA and L up to 256 on Dream.The authors classify deployer-chosen block size and length as a deployment hazard, not an adversarial attack surface.Source: §D.4 · p. 22

D.5 A Sparse Mixture-of-Experts dLLM

  • For LLaDA-MoE-7B, detection on direct harmful queries and anchoring matches dense models; the OR rule does not convert DIJA's AUROC 0.85 into detection.The authors attribute the DIJA issue to anti-correlation between R0 and ΔE slope, which leads the Bonferroni correction to penalise SED.Source: §D.5 · pp. 22–23, Table 11 · p. 23

E.2 Lemma 1: Uniform Influence

The appendix tests the uniform-influence assumption and SED slope behavior across architectures, then describes threshold calibration for the combined detector.

E.2 Lemma 1: Uniform Influence

  • On Dream-7B, PAD and DIJA have ∆Ei CVs of 0.45 and 1.17, below clean’s 6.13, and PAD’s ∆E slope reaches AUROC 0.98.On LLaDA-8B, influence is less uniform (CV 3.8–10.2), while SED slope provides detection with AUROC 0.90 for PAD.Source: §E.2 · pp. 23–24
  • Logit norms remain approximately constant while cosine similarity diverges across categories, indicating that angular displacement dominates magnitude change in the first half of denoising.The figure describes this as the slow-norm condition associated with Corollary 1.Source: Figure 7 · p. 24
  • On LLaDA-8B, per-position influence is less uniform across categories (CV 3.8–10.2), but SED slope detects PAD with AUROC 0.90 without relying on that assumption.The uniform-influence assumption is most precise on Dream-7B, where ∆E slope is the more effective signal.Source: §E.2 · p. 24

E.3 SED Slope Distributions

  • SED slope achieves AUROC 0.84–0.91 across PAD, DIJA, and anchoring t=8 on LLaDA-8B and LLaDA-1.5; on Dream-7B, it detects DIJA (0.92) but not PAD (0.52).Source: §E.3 · pp. 24–25

F.1 Setup

  • At per-signal α = FPRtarget/3, Bonferroni calibration guarantees the OR-detector’s combined false-positive rate is at most FPRtarget.The appendix examines how rank-order separation translates to detection at fixed false-positive rates.Source: §F.1 · p. 25, F Threshold Calibration Analysis · p. 25

F.2 Analysis

Threshold-level detection varies by architecture, while the tested aggregation rules preserve complementary detection patterns and differ in calibration requirements.

F.2 Analysis

  • For PAD, Dream-7B’s ∆E slope reaches 0.94 TPR at 5% FPR, versus 0.24 TPR for LLaDA-8B’s SED slope despite its 0.90 AUROC.The passages attribute Dream’s cleaner tail separation to a higher Fisher discriminant, J = 139.73.Source: §F.2 · pp. 25–26
  • On Dream-7B, the OR-detector reaches ≥0.78 TPR on every attack type, while no single signal exceeds 0.26 TPR across all attacks.R0 detects direct harmful queries, ∆E slope detects PAD and anchoring, and SED slope detects DIJA.Source: §F.2 · p. 26
  • XSTest FPR is consistently no higher than clean-query FPR; on LLaDA-8B, SED slope has 0% FPR on XSTest at a 5% clean threshold.The thresholds are calibrated on clean AlpacaEval queries.Source: Table 14 · p. 26, §F.2 · p. 26

F.3 Aggregation Rules Beyond OR

  • Across tested settings, max-z matches or beats OR without training; logistic combination roughly doubles recall on LLaDA template attacks but requires labelled calibration data.Sum-z trails OR and max-z on Dream-7B PAD and LLaDA-8B DIJA; the logistic combination is not uniformly better.Source: Table 15 · p. 26, §F.3 · p. 27

G Adaptive Attack Details

PAD titration illustrates how detection and harmful generation vary with template intensity.

G Adaptive Attack Details

Loading 2609.30841v1…