Source-linked AI summary
Harmful Responses Are Jailbreak Templates: Transferring Autoregressive Jailbreaks to Diffusion Language Models
Jinwei Gan, Zifeng Cheng, Zhiwei Jiang, Ran Sun, Shiping Ge, Qing Gu
TL;DR
Partially masked harmful responses can serve as effective jailbreak templates for dLLMs, a distinct attack surface created by their bidirectional generation. RMT-JAILBREAK transfers AR jailbreaks through induced responses, converting them into filtered masked templates. Experiments across multiple benchmarks, methods, source models, and target dLLMs demonstrate the framework’s effectiveness and generality.
Problem
Partially masking a query-specific harmful response can induce dLLMs to reconstruct harmful content, revealing an underexplored vulnerability.
Source: §1 · p. 2Method
RMT-JAILBREAK converts an AR-induced harmful response into a uniformly masked template, filters visible harmful tokens, and supplies it to a target dLLM.
Source: §1 · p. 2Results
Experiments across multiple benchmarks, AR jailbreak methods, source models, and target dLLMs demonstrate RMT-JAILBREAK’s effectiveness and generality.
Source: §4.3 · p. 7, §5 · p. 9Takeaways & Limitations
Induced harmful responses provide a simple bridge for transferring jailbreak attacks between autoregressive and diffusion generation paradigms.
Source: §5 · p. 9
Abstract
from arXiv · showhide
Diffusion large language models (dLLMs) enable flexible masked generation through bidirectional context modeling, but this capability also introduces a distinct jailbreak attack surface. We find that a harmful response to a given query naturally serves as an effective jailbreak template: simply masking a subset of its tokens can induce a dLLM to reconstruct harmful content. Based on this observation, we propose RMT-Jailbreak, a general framework that transfers existing autoregressive (AR) jailbreak attacks to dLLMs through their induced harmful responses. RMT-Jailbreak converts an AR-generated harmful response into a high-mask-ratio template using uniform token retention, and further applies prompt-based safety filtering to mask any remaining visible harmful content. The refined template is then provided to the target dLLM for bidirectional reconstruction. Extensive experiments across multiple AR jailbreak methods and target dLLMs demonstrate the effectiveness and generality of RMT-Jailbreak, revealing strong cross-paradigm transferability of jailbreak attacks.
1 INTRODUCTION
dLLMs’ bidirectional masked generation creates a jailbreak surface distinct from autoregressive prompting: partially masking a harmful response can make it an effective template. The paper introduces RMT-JAILBREAK to transfer AR jailbreaks through those responses, and reports effectiveness across multiple methods and target models.
1 INTRODUCTION
- Partially masking a query-specific harmful response can provide enough context for dLLMs to reconstruct harmful content.The paper reports consistently high attack success across a wide range of mask ratios.Source: §1 · p. 2
- RMT-JAILBREAK transfers AR jailbreaks by turning induced harmful responses into uniformly masked templates and filtering remaining visible harmful tokens.The filtered template is combined with the original query for reconstruction by the target dLLM.Source: §1 · p. 2
- Experiments across multiple AR jailbreak methods and target dLLMs demonstrate RMT-JAILBREAK’s effectiveness and generality.Source: §1 · p. 2
2 RELATED WORKS
Diffusion language models generate through iterative masked-token prediction with bidirectional context, enabling capabilities such as infilling and editing. Prior jailbreak approaches target AR generation or use dLLM-specific templates, while RMT-JAILBREAK bridges the paradigms through masked responses.
2.1 DIFFUSION LARGE LANGUAGE MODELS
- Diffusion language models iteratively predict masked tokens from surrounding context, supporting infilling, editing, and structured generation.Their bidirectional context modeling and parallel decoding distinguish them from autoregressive generation.Source: §2.1 · p. 2
2.2 JAILBREAK ATTACKS ON AUTOREGRESSIVE AND DIFFUSION LLMS
- AR jailbreaks use optimization, black-box iteration, or prompt rewriting, but are primarily designed for left-to-right generation rather than masked denoising.Source: §2.2 · pp. 2–3
- DIJA (Wen et al., 2025) uses interleaved mask-text prompts; RMT-JAILBREAK instead converts AR-induced responses into uniformly masked templates for dLLM infilling.Distributed visible context supports reconstruction of the response during generation.Source: §2.2 · p. 3, Figure 1 · p. 3
3 METHOD
RMT-JAILBREAK transfers AR jailbreaks to dLLMs by using the induced harmful response as a template for bidirectional reconstruction. It induces a response, sparsely retains tokens while masking and filtering harmful content, then supplies the query and refined template to the target dLLM.
3 METHOD
- RMT-JAILBREAK transfers AR jailbreaks to dLLMs through harmful responses induced by existing AR attacks.The framework does not require a particular AR jailbreak strategy; it can incorporate optimization-, prompt-, and rewriting-based attacks.Source: §3 · p. 3, §3.1 · p. 3
3.3 TARGET DLLM JAILBREAK
- The original query and filtered template are concatenated as the target dLLM input, which completes the template through bidirectional denoising.The combined input consists of the query and the filtered masked response template.Source: §3 · p. 3, §3.3 · p. 4
3.1 SOURCE AR INDUCTION
- An existing AR jailbreak method induces a harmful response from a source AR model, and that response—not the attack-specific input—is transferred.Any AR-oriented method capable of eliciting a harmful response can be incorporated.Source: §3.1 · p. 3
3.2 MASKED TEMPLATE TRANSFER
- Uniform masking retains sparse tokens at approximately uniform intervals, and an auxiliary LLM masks remaining visible harmful tokens while preserving existing masks and benign content.The filtering prompt instructs the LLM not to rewrite, reorder, or unmask existing content, preserving the template structure.Source: §3.2 · p. 4
4 EXPERIMENTS
Experiments show that response-mediated transfer is effective across target dLLMs, benchmarks, AR attacks, and source models. The section also examines why distributed masking helps and whether the attack withstands a prompt-level defense.
4.1 EXPERIMENT SETTINGS
- Experiments use HarmBench, JailbreakBench, and StrongReject, comparing four target dLLMs with general AR-oriented and diffusion-specific jailbreak baselines.Evaluation reports ASR on HarmBench and JailbreakBench, and SRS plus GPT-4o-assessed harmfulness score on StrongReject.Source: §4.1 · pp. 5–6, Table 4 · p. 6
4.2 ATTACK EFFECTIVENESS
- RMT-JAILBREAK achieves ASRs of 61.3–76.5% on HarmBench and 77.0–84.0% on JailbreakBench, plus SRS scores of 56.7–70.4 on StrongReject.It has the highest ASR or SRS across all 12 target-model–benchmark combinations, outperforming DIJA without uniformly higher harmfulness scores.Source: §4.2 · pp. 6–7
4.3 GENERALIZATION ACROSS AR ATTACK METHODS AND SOURCE MODELS
- Across 48 tested combinations, converting induced responses improves over direct AR attacks, with gains persisting across attack methods, source models, targets, and benchmarks.For example, converting Vicuna-induced AutoDAN responses raises ASR on MMaDA-MixCoT in JailbreakBench from 1.0% to 85.0%.Source: §4.3 · p. 7
4.4 ATTACK CASES
- RMT-JAILBREAK retains query-specific semantic and structural cues throughout its template, whereas DIJA relies mainly on a generic scaffold with long contiguous masked spans.Those distributed cues provide more informative constraints for dLLM infilling than a response format with limited query-specific content.Source: §4.4 · p. 8, Figure 2 · p. 8
4.5 ROBUSTNESS AGAINST DEFENSES
- Self-reminder does not reliably prevent RMT-JAILBREAK: it modestly lowers HarmBench success, increases JailbreakBench success for all three models, and does not reduce StrongReject success.Under Self-reminder, HarmBench ASR remains 69.5%–72.0%.Source: §4.5 · pp. 8–9, Figure 3 · p. 8
4.6 EFFECTS OF MASKING STRATEGY
- Uniform masking outperforms continuous masking at the same ratio; at ρ = 0.8, gains are 58.3 ASR points on HarmBench, 18.0 on JailbreakBench, and 60.4 SRS points on StrongReject.Increasing the mask ratio from 0.8 to 0.9 causes larger drops than increasing it from 0.7 to 0.8; RMT-JAILBREAK also achieves a higher mask ratio than DIJA.Source: §4.6 · p. 9, Table 8 · p. 9
5 CONCLUSION
The paper concludes that harmful responses induced by existing AR jailbreaks can serve as dLLM jailbreak templates. RMT-JAILBREAK transfers them through distributed masking and safety filtering, with experiments supporting effectiveness and generality.
5 CONCLUSION
- RMT-JAILBREAK converts AR-induced harmful responses into masked templates with distributed contextual cues, followed by safety filtering, and experiments show effectiveness across benchmarks, attack methods, source models, and target dLLMs.The paper frames this as a simple bridge between autoregressive and diffusion generation paradigms.Source: §5 · p. 9
AI USE STATEMENT
- The authors state that they do not use generative AI tools.Source: AI USE STATEMENT · p. 10
ETHICS STATEMENT
- The stated aim is to uncover dLLM security vulnerabilities to improve the safety of future diffusion language models.Source: ETHICS STATEMENT · p. 10
A PROMPT TEMPLATE
The appendix describes a prompt for Qwen3 to refine partially masked responses by masking remaining harmful or actionable information while preserving structure and non-harmful content.
A PROMPT TEMPLATE
- The remasking prompt guides Qwen3 to refine partially masked responses generated from existing jailbreak attacks.Source: A PROMPT TEMPLATE · p. 12
- Given a harmful behavior and an already-masked response, Qwen3 preserves existing mask tokens and replaces remaining harmful or actionable information with masks, leaving structure and non-harmful content unchanged.Source: A PROMPT TEMPLATE · p. 12
B DEFENSIBILITY OF DLLMS
Directly transferred AR attacks show uneven resistance across dLLMs: some attacks work in selected settings, but none is consistently strong. Resistance is especially clear for Dream-Instruct, while MMaDA-MixCoT has relatively high zero-shot success.
B DEFENSIBILITY OF DLLMS
- Dream-Instruct largely resists AutoDAN, GCG, and PAIR across benchmarks, while LLaDA models resist these attacks in several settings.PAIR achieves moderate success on HarmBench against LLaDA models.Source: B DEFENSIBILITY OF DLLMS · p. 12
- Resistance is not uniform or absolute: MMaDA-MixCoT has relatively high zero-shot success, and GCG or PAIR work on particular model–benchmark pairs.No transferred AR attack achieves consistently strong results, defining the challenge addressed by RMT-JAILBREAK.Source: B DEFENSIBILITY OF DLLMS · p. 12, Figure 6 · p. 13