Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models

Arth Singh

cs.CLMar 17, 2026

Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models

Authors: Arth Singh

Organizations: AIM Intelligence · National Institute of Technology Agartala

Abstract

Safety alignment in diffusion language models (dLLMs) relies on a single load-bearing assumption: that committed tokens are permanent. We show that violating this assumption, by re-masking committed refusal tokens and injecting a short affirmative prefix, achieves 74-82% ASR on HarmBench across all three publicly available safety-tuned dLLMs, rising to 92-98% with a generic 8-token compliance prefix. We call this attack TrajHijack; it is the first trajectory-level attack on dLLMs, requires no gradient computation, and generalizes across SFT and preference-optimized (VRPO) models. Three findings emerge. First, the vulnerability is irreducibly two-component: re-masking alone (4.4%) and prefix alone (5.7%) both fail. Second, gradient optimization via a differentiable Gumbel-softmax chain consistently degrades ASR (41.5% vs. 76.1%), because continuous perturbations push token distributions off-manifold. Third, A2D (the strongest published dLLM defense) is more vulnerable to TrajHijack (89.9%) than the undefended model (76.1%): its silent-refusal training removes the contextual resistance that trajectory-level attacks must overcome, an effect we call the Defense Inversion Effect.

Figures & tables

Figure 1: TrajHijack attack pipeline. After $k$ clean denoising steps, committed refusal tokens are re-masked and replaced with a 12-token affirmative prefix; denoising resumes to produce compliant output. No gradient computation is required. See § 3.3 for why adding gradient optimization degrades ASR.

Topic-conditioned prefix ( $n{=}159$ , $L_{g}{=}128$ )
Model	Prefix	ASR	HS $\geq$ 3	Mean
LLaDA-8B (SFT)	Re-mask+pfx	76.1%	88.1%	4.1
LLaDA-1.5 (VRPO)	Re-mask+pfx	74.2%	88.7%	4.2
Dream-7B (SFT)	Re-mask+pfx	81.8%	93.1%	4.4
Generic compliance prefix ( $n{=}159$ , $L_{g}{=}128$ )
LLaDA-8B (SFT)	Medium static	95.0%	96.9%	4.8

Table 1: Cross-model ASR on HarmBench (

n{=}159

L_{g}{=}128

). Topic-conditioned prefixes achieve 74–82%; a generic 8-token compliance prefix raises this to 92–98%. VRPO provides no additional robustness in either condition. Dual-judge validation: Gemini exact agreement 93–98%,

\kappa{=}0.48

–

0.79

Model	$L_{g}$	ASR	HS $\geq$ 3	Mean
LLaDA	64	94.0%	96.0%	4.6
LLaDA	128	84.0%	90.0%	4.3
LLaDA	256	78.0%	88.0%	4.1
LLaDA	512	52.0%	86.0%	3.4
Dream	64	90.0%	98.0%	4.6
Dream	256	90.0%	98.0%	4.6

Table 2: Generation length effect (

n{=}50

, topic-conditioned prefix). LLaDA’s ASR drops sharply with

L_{g}

(94%

\to

52%) while Dream remains stable (84–90%), explained by context amplification (§ 4.4 ). Non-refusal rate (HS

\geq

3) stays above 86% even at

L_{g}{=}512

Component ablations ( $n{=}159$ , $L_{g}{=}128$ )
Configuration	ASR	HS $\geq$ 3	Mean
Re-mask+pfx (core)	76.1%	88.1%	4.1
+ $\delta$ , $\epsilon{=}15$	41.5%	82.4%	3.3
Re-mask only	4.4%	5.0%	1.2
Prefix only (no re-mask)	5.7%	6.3%	1.2
Gradient variants ( $n{=}50$ , $L_{g}{=}64$ )

Table 3: Ablations on LLaDA-8B-Instruct. Both re-masking and prefix are necessary (4.4% and 5.7% alone vs. 76.1% combined). Every gradient variant falls below the training-free baseline; larger

\epsilon

causes greater damage.

Strategy	Topic?	Tok.	ASR	HS $\geq$ 3	Mean
Minimal (“Sure,”)	×	2	21.4%	23.3%	1.9
Medium static	×	8	95.0%	96.9%	4.8
Smart templates	✓	$\leq$ 12	27.7%	35.2%	2.2
Fallback only	✓	$\leq$ 12	21.4%	44.0%	2.3
Long verbose	✓	20	43.4%	56.0%	2.9

Table 4: Prefix sensitivity on LLaDA-8B-Instruct (

n{=}159

L_{g}{=}128

). A generic 8-token compliance prefix (“Sure, I will help with this. Here is”) achieves 95.0% ASR, substantially higher than topic-conditioned templates. Topic extraction can degrade ASR by producing awkward truncated text. The compliance signal, not topic specificity, drives the attack. Dual-judge validation: Gemini reports 93.1% exact agreement,

\kappa{=}0.481

Metric	dLLM (LLaDA)	AR (Llama)
ASR (HS $\geq$ 4)	76.1%	72.3%
HS=5 rate	62–64%	44.0%
Non-refusal (HS $\geq$ 3)	88–93%	73.6%
Mean HS	4.1	3.64

Table 5: dLLM vs. AR comparison at matched prefix (

n{=}159

). dLLMs produce 40% more maximally harmful (HS=5) outputs.

Defense	ASR	HS $\geq$ 3	Mean HS
None (LLaDA-8B)	76.1%	88.1%	4.1
LLaDA-1.5 (VRPO)	74.2%	88.7%	4.2
A2D ( Jeung et al., 2026 )	89.9%	99.4%	4.5

Table 6: TrajHijack ASR under different defenses (

n{=}159

L_{g}{=}128

). A2D, which reduces input-level attacks to near-zero, is more vulnerable to trajectory-level attacks.

Strategy	Detect.	FP
Monotonicity check	14% (7/50)	0%
Self-consistency	100% (50/50)	0%

Table 7: Diagnostic detection of TrajHijack (

n{=}50

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Parameter	Value
Denoising steps ( $T$ )	64
Target step ( $k$ )	16
Generation length ( $L_{g}$ )	64 / 128 / 256 / 512
$L_{\infty}$ budget ( $\epsilon$ )	15.0
Re-masked positions ( $n_{r}$ )	20
Max prefix tokens	12

Appendix

Table 8: Full hyperparameter configuration.

Method	Threat Model	Eval. Setup	Key Requirement	Grad.-Free?
DIJA ( Wen et al., 2025 )	Black-box (input)	HarmBench / Llama clf.	LLM-crafted prompts	✓
PAD ( Zhang et al., 2025 )	White-box (input)	Custom / Gemini	Structural connectors	✓
Priming ( Yamabe and Sakuma, 2026 )	White-box (step $k$ )	JBB-Behav. / GPT-4	Full target (100+ tok.) + GCG	×
Ctx. nesting ( He et al., 2026 )	Black-box (input)	HarmBench / GPT-4o	Structured benign context	✓
TrajHijack (ours)	White-box (step $k$ )	HarmBench / Claude S4	12-token rule-based prefix	✓

Appendix

Table 9: Structural comparison with concurrent attacks on dLLMs. ASR is omitted because each method uses a different benchmark and judge with no cross-calibration. Our core attack is the simplest trajectory-level intervention: gradient-free, no adversarial search, and a 12-token prefix vs. 100+ tokens for Yamabe and Sakuma (2026) .

Step $k$	ASR	HS $\geq$ 3	Mean HS
4	86.0%	94.0%	4.3
8	86.0%	92.0%	4.4
12	84.0%	92.0%	4.3
16	84.0%	90.0%	4.3
20	82.0%	92.0%	4.3
24	84.0%	92.0%	4.3

Appendix

Table 10: ASR vs. intervention step

k

(re-mask + prefix,

L_{g}{=}128

n{=}50

). The attack is effective across all tested values of

k

(82–92%), with ASR increasing at late steps (

k{\geq}32

). This suggests that late intervention benefits from more committed context surrounding the re-masked prefix region.

Category	$n$	Core	+Gradient	$\boldsymbol{\Delta}$
Misinformation	27	85.2%	55.6%	+29.6
Harmful	17	82.4%	41.2%	+41.2
Harassment	16	81.2%	56.2%	+25.0
Illegal	47	80.9%	29.8%	+51.1
Cybercrime	33	75.8%	51.5%	+24.2
Chem./biological	19	42.1%	21.1%	+21.1

Appendix

Table 11: Per-category ASR on HarmBench (

L_{g}{=}128

). The core attack outperforms the gradient method across all categories. Chem./biological is the most resistant (42.1%), likely reflecting disproportionate CBRN safety training data.

\Delta

= core

-

gradient. See text for constructive implications.

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 343 papers

Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models
Aug 31, 2026Guoli Wang, Haonan Shi, Tu Ouyang +1Language Model Safety Evaluation Diffusion Language Model Decoding
Case Western Reserve University 10900 Euclid Avenue, Cleveland, OH 44106, USA
Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
Aug 7, 2026Elena Dumitrescu, Gert Lek, Lydia Y. Chen +1Adversarial Attacks on LLMs LLM Safety Alignment
Delft University of Technology, Delft, The Netherlands · University of Neuchâtel, Neuchâtel, Switzerland.
Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
Sep 25, 2026Thong Bach, Dung Nguyen, Thao Minh Le +1LLM Safety Adversarial Attacks on LLMs
Applied Artificial Intelligence Initiative (A2I2), Deakin University · Pennsylvania State University

Aug 31, 2026J/K move · Enter open · S save

Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models

Guoli Wang, Haonan Shi, Tu Ouyang, An Wang

Case Western Reserve University 10900 Euclid Avenue, Cleveland, OH 44106, USA

Language Model Safety Evaluation Diffusion Language Model Decoding Diffusion Language Models Refusal Behavior in Language Models

Open paper AskPDF arXiv

Diffusion large language models (dLLMs) generate text through iterative denoising rather than left-to-right decoding. This generation paradigm introduces two axes that can influence safety alignment: when tokens are generated during denoising and where they appear in the response. In this paper, we measure dLLM safety behavior under harmful prompts by tracing intermediate token distributions and commitment decisions throughout denoising. Our analysis shows that refusal signals are concentrated in early denoising steps and leading response positions, and the tokens committed early can strongly shape the final safety outcome. Our measurements further show that the denoising step and persistence of refusal-token commitment are important for understanding dLLM safety. Based on these findings, we propose Refusal-Aware Early Commitment (RAEC), a simple training-free decoding method that commits persistent refusal signals from early steps. Experiments on LLaDA and Dream show that RAEC reduces attack success rates while largely preserving utility. The code is available at https://github.com/Glresearch1/RAEC.

Abstract

Adversarial Attacks on LLMs

Explore similar work

Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models

Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis