Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis

Thong Bach; Dung Nguyen; Thao Minh Le; Truyen Tran

cs.AISep 25, 2026

Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis

Authors: Thong Bach, Dung Nguyen, Thao Minh Le, Truyen Tran

Organizations: Applied Artificial Intelligence Initiative (A2I2), Deakin University · Pennsylvania State University

Abstract

Existing attacks and defenses for diffusion-based large language models (dLLMs) target specific vulnerabilities but lack a shared framework explaining why attacks succeed. We propose one by interpreting safety alignment as shaping the denoising energy landscape: a well-aligned model routes harmful queries toward safe outputs through an energy barrier that separates the two regions. Current jailbreak attacks reduce to two strategies for circumventing this barrier: obscuring the query's safety disposition at initialisation, or intervening mid-trajectory to force the denoising path across the energy barrier. From this perspective and the result that masked diffusion models minimise kinetic energy during denoising, we derive three complementary, training-free detection signals: a step-0 ratio that reads the initial safety disposition from the logit distribution before generation begins, and two trajectory-velocity signals that track kinetic energy in complementary subspaces of the logit space. An attack must either reveal its intent at initialisation or expend kinetic energy to cross the barrier in at least one monitored subspace, so the three signals cover each other's blind spots in the energy budget by construction. Evaluation across three dense dLLMs (LLaDA-8B, LLaDA-1.5, Dream-7B) and a sparse mixture-of-experts dLLM (LLaDA-MoE-7B) confirms this complementarity. In stress tests of known attacks, every configuration that evades detection also fails to produce harmful content, suggesting that the detection and barrier-crossing thresholds are hard to separate.

Figures & tables

Figure 1: Step-0 ratio separates harmful from benign queries. Distribution of

R_{0}

values across three dLLM families, harmful direct queries (HarmBench, AdvBench) against benign queries (AlpacaEval, XSTest). Harmful queries produce consistently higher ratios than benign queries, confirming basin separation.

Attack	LLaDA-8B	LLaDA-1.5	Dream-7B
Harmful direct	0.86	0.86	0.90
Anchoring $t$ =8	0.86	0.86	0.90
PAD	0.42	0.49	0.37
DIJA	0.23	0.23	0.15

Table 1: Step-0 ratio fails on template attacks. AUROC for

R_{0}

detecting each attack (built on HarmBench and AdvBench prompts) vs. benign queries (AlpacaEval, XSTest). Template attacks (PAD, DIJA) produce near-chance detection because injected tokens obscure the query’s safety disposition at step 0.

Figure 2: Safety Energy Gap

\Delta E(t)

trajectories during denoising. Each line shows the mean factorised gap (Eq. ( 3 )) at each denoising step, averaged over 400 prompts per condition (harmful and attack conditions from HarmBench), plotted as the raw sum over masked positions at

L=128

; the per-token form is used in Appendix D.4 . The dashed line at

\Delta E=0

marks the energy barrier. Harmful direct queries (black) remain in the safe basin (

\Delta E>0

) as the model refuses. Template attacks (PAD, DIJA) start near

\Delta E\approx 0

and descend into the harmful basin. Anchoring at

t{=}1

shows partial recovery; at

t{=}8

, recovery fails.

Figure 3: Fisher velocity projects onto different subspaces across architectures. Each panel shows

|\text{SED slope}|

(

x

-axis,

\approx\|\dot{z}_{V_{\perp}}\|_{F}

) vs.

|\Delta E\text{ slope Q1}|

(

y

-axis,

\approx\|\dot{z}_{V_{s}}\|_{F}

) for benign (AlpacaEval, XSTest) and attack (PAD on HarmBench and AdvBench) prompts. On LLaDA-8B, PAD separates along

x

(SED, AUROC 0.90); on Dream-7B, along

y

(

\Delta E

, AUROC 0.98). The two slopes measure the same Fisher velocity in complementary subspaces.

Model	Attack	Intent Masked	Traj. Forced	$\boldsymbol{R_{0}}$	SED slope	$\boldsymbol{\Delta E}$ slope	Detected by
LLaDA-8B	Harmful direct	✗	✗	0.94	0.43	0.30	$R_{0}$
	PAD	✓	✓	0.45	0.90	0.39	SED ( $V_{\perp}$ )
	DIJA	✓	✓	0.17	0.89	0.28	SED ( $V_{\perp}$ )
	Anchoring $t{=}1$	✗	Mild	0.94	0.62	0.58	$R_{0}$
	Anchoring $t{=}8$	✗	✓	0.94	0.91	0.92	Both
Dream-7B	PAD	✓	✓	0.39	0.52	0.98	$\Delta E$ ( $V_{s}$ )

Table 2: Attack signatures in the energy decomposition. AUROC of each signal, attack prompts built on HarmBench and AdvBench against benign AlpacaEval and XSTest prompts. Each attack either reveals harmful intent at initialisation (high

R_{0}

, detected before generation begins) or forces barrier crossing (steep slope in

V_{\perp}

V_{s}

), or both. Dream-7B PAD row illustrates the architecture-dependent subspace shift.

Model	Attack	$\boldsymbol{R_{0}}$	SED	$\boldsymbol{\Delta E}$	$\boldsymbol{R_{0}}$ +SED	All three
LLaDA-8B	Harmful direct	0.94	0.43	0.30	0.83	0.83
	PAD	0.45	0.90	0.39	0.88	0.87
	Anchoring $t{=}8$	0.94	0.91	0.92	0.95	0.96
	DIJA	0.17	0.89	0.28	0.87	0.87
Dream-7B	Harmful direct	0.96	0.67	0.25	0.86	0.86
	PAD	0.39	0.52	0.98	0.41	0.95

Table 3: Combined detection AUROC. Attacks on HarmBench and AdvBench prompts against benign AlpacaEval and XSTest prompts. The three-signal combination resolves PAD on Dream where

R_{0}

+ SED slope fails.

Figure 4: Detection AUROC across metrics, attacks, and models. Attack conditions built on HarmBench and AdvBench, benign pool AlpacaEval and XSTest. Green: AUROC $\geq 0.85$ ; red: $\leq 0.50$ . The combined energy detector (bottom row) covers all tested attacks on both architectures; DiffuGuard-SD (the detection component of DiffuGuard) is complementary, achieving perfect detection on template attacks but failing on non-template threats. We do not benchmark the full DiffuGuard pipeline (SD + generation-time defenses), which falls outside our detection-only scope.

		LLaDA-8B		Dream-7B
	Config	$R_{0}$ +SED	$\Delta E$ Q1	$R_{0}$ +SED	$\Delta E$ Q1	All 3
PAD titration	$n_{c}=0$	0.94	0.30	0.96	0.25	0.96
	$n_{c}=1$	0.53	0.55	0.41	0.74	0.74
	$n_{c}=2$	0.90	0.39	0.52	0.98	0.98
	$n_{c}=3$	0.93	0.50	0.81	1.00	1.00
	$n_{c}=4$	0.95	0.40	0.87	1.00	1.00

Table 4: Adaptive attack detection AUROC. Attacks on HarmBench and AdvBench prompts against benign AlpacaEval and XSTest prompts. Top: PAD titration. On Dream-7B, SED fails at

n_{c}\!=\!1{,}2

but

\Delta E

slope rescues detection (bold). Bottom: Anchoring sweep:

R_{0}

is constant; slope signals increase with

t_{\mathrm{inter}}

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: LDA basin separation at step 0 across three dLLM families. Each panel shows kernel density estimates of the LDA projection of step-0 logit distributions onto the

\mathcal{V}_{\text{ref}}\cup\mathcal{V}_{\text{comp}}

subspace, evaluated on 50 clean (AlpacaEval, green ), 20 boundary-benign (XSTest, blue ), and 50 harmful direct ( black ) prompts per model. The dashed vertical line marks the LDA decision boundary. Fisher’s discriminant ratio

J

(Eq. 27 ) is annotated in each panel. Safe and harmful queries are cleanly separated across all three architectures (

J\geq 33

), with Dream-7B achieving the strongest separation (

J=139.73

) due to its AR-initialised prior. The clean and XSTest distributions are nearly indistinguishable, confirming that the model does not conflate boundary-benign queries with harmful ones at step 0.

Figure 6: Step-0 ratio

R_{0}

is robust to vocabulary choice, except for synonym sets. Each panel shows the AUROC for detecting harmful direct queries vs. benign queries (clean

+

XSTest) as a function of vocabulary set, evaluated on LLaDA-8B (left), LLaDA-1.5 (centre), and Dream-7B (right). Four of five vocabulary configurations achieve AUROC

\geq 0.90

, including the minimal five-token set. The synonym set consistently underperforms (AUROC

\approx 0.80

–

0.83

) because it selects tokens that carry negligible probability mass in the models’ actual output distributions, increasing the coverage error

\epsilon_{\text{ref}}

predicted by Proposition 2(iii). The dashed line marks the chance level (AUROC

=0.5

Vocabulary set	$\|\mathcal{V}\|$ sizes	LLaDA-8B	LLaDA-1.5	Dream-7B
default	36 / 32	0.896	0.917	0.989
synonym	36 / 32	0.796	0.788	0.827
freq	24 / 24	0.910	0.915	0.944
minimal5	10 / 10	0.951	0.957	1.000
large30	64 / 60	0.897	0.916	0.991

Appendix

Table 5: AUROC of

R_{0}

(harmful direct vs. benign) under five vocabulary configurations across three dLLM families. Vocabulary sizes

|\mathcal{V}_{\text{ref}}|

|\mathcal{V}_{\text{comp}}|

are shown in parentheses. Best result per model in bold .

Vocabulary	LLaDA-8B	LLaDA-1.5	Dream-7B
Curated default	0.935	0.947	0.966
Automatically derived ( auto10 )	0.894	0.928	0.984

Appendix

Table 6:

R_{0}

AUROC (harmful direct vs. benign) with the curated default vocabulary and an automatically derived one, on a held-out split of 50 harmful and 50 benign prompts.

LLaDA-8B, direct harmful	English	Chinese, English vocab.	Chinese, derived vocab.
$R_{0}$ AUROC	0.937	0.796	0.962
OR-detector TPR	0.784	0.060	–
SED AUROC (PAD)	0.900	0.798	–

Appendix

Table 7: Cross-lingual evaluation on LLaDA-8B: Chinese MultiJail (harmful) and alpaca-zh (benign) prompts, with the English vocabulary and with a vocabulary derived in Chinese. Thresholds recalibrated on the Chinese benign pool.

		PAD			Anchoring $t{=}8$
Model	Metric	Q1	50%	Full	Q1	50%	Full
LLaDA-8B	SED slope	0.89	0.90	0.79	0.95	0.91	0.68
LLaDA-8B	$\Delta E$ slope	0.39	0.43	0.43	0.92	0.82	0.68
LLaDA-1.5	SED slope	0.87	0.87	0.68	0.92	0.85	0.61
LLaDA-1.5	$\Delta E$ slope	0.43	0.43	0.45	0.89	0.78	0.66
Dream-7B	SED slope	0.72	0.52	0.40	0.83	0.67	0.41

Appendix

Table 8: Temporal signature analysis. AUROC for SED slope and

\Delta E

slope computed over different trajectory segments (Q1 = first 25%, 50% = first half).

\Delta E

slope Q1 resolves PAD on Dream where all SED variants fail.

Benign baseline, $L=64$ to $512$	LLaDA-8B	Dream-7B
Raw $\Delta E_{\text{F}}$	70.3 to 260.1 ( $\times 3.7$ )	154.1 to 1653.6 ( $\times 10.7$ )
Per-token $\Delta E_{\text{F}}/\|M_{t}\|$	1.10 to 0.51	2.41 to 3.23

Appendix

Table 9: Benign baseline of the factorised gap from

L=64

L=512

: the raw sum scales with length, the per-token form does not.

OR-TPR at calibrated threshold	$L=64$	$L=128$	$L=256$	$L=512$
LLaDA-8B, direct harmful	0.82	0.78	0.58	0.32
Dream-7B, DIJA	0.62	–	–	0.94

Appendix

Table 10: OR-detector TPR at the calibrated threshold across generation lengths.

	Dense models (main text)	LLaDA-MoE-7B
Refusal rate, direct harmful queries	60 to 80%	99%
$R_{0}$ AUROC, harmful direct	0.90 to 0.99	0.95
OR+Bonferroni TPR, harmful direct	0.78 to 0.82	0.72
OR+Bonferroni TPR, anchoring $t{=}8$	0.85 to 0.96	0.85
OR+Bonferroni TPR, PAD	0.18 to 0.91	0.09 ∗
OR+Bonferroni TPR, DIJA	0.10 to 0.70	0.10 ∗

Appendix

Table 11: LLaDA-MoE-7B against the dense models of the main text (range over LLaDA-8B, LLaDA-1.5 and Dream-7B). All TPRs at a guaranteed benign FPR of

10\%

. ∗ See text.

Figure 7: Slow-norm condition (Corollary 1 ). Solid lines show the SED trajectory (left axis); dashed lines show the mean logit norm

\|z_{t}^{i}\|

(right axis). Logit norms remain approximately constant while cosine similarity diverges across categories, confirming that angular displacement dominates magnitude change in the first half of denoising.

Figure 8: Per-position

\Delta E_{i}

uniformity (Lemma 1 ). Box plots show the coefficient of variation of

\Delta E_{i}

across masked positions, averaged over the first 50% of denoising. On Dream-7B, PAD and DIJA show near-uniform influence (CV

<1.2

), validating the assumption for the architecture where

\Delta E

slope is the primary detection signal. On LLaDA-8B, influence is less uniform, but SED slope (which does not depend on this assumption) provides detection.

	LLaDA-8B			Dream-7B
Category	Norm CV	Max/Min	$\Delta E_{i}$ CV	Norm CV	Max/Min	$\Delta E_{i}$ CV
Clean benign	0.024	1.11	4.82	0.037	1.20	6.13
XSTest (safe)	0.014	1.07	7.23	0.025	1.14	5.72
Harmful (direct)	0.013	1.06	6.30	0.031	1.17	4.83
Slice prefix	0.020	1.10	3.78	0.036	1.23	3.25
PAD	0.032	1.14	10.24	0.035	1.18	0.45

Appendix

Table 12: Empirical verification of theoretical assumptions. Norm CV and max/min ratio assess the slow-norm condition (Corollary 1 );

\Delta E_{i}

CV assesses per-position uniformity (Lemma 1 ). Both are computed over the first 50% of denoising.

Figure 9: SED slope distributions (first 50% of denoising). Attacks produce steeper slopes than benign, reflecting higher kinetic energy expenditure. AUROC values (vs. benign) shown below each attack.

		FPR $\leq$ 5%		FPR $\leq$ 10%
Model	Attack	TPR	FPR	TPR	FPR
LLaDA-8B	Harmful direct	0.75	0.051	0.78	0.093
	PAD	0.14		0.26
	Anchoring $t{=}8$	0.84		0.89
	DIJA	0.08		0.20
Dream-7B	Harmful direct	0.78	0.051	0.82	0.091

Appendix

Table 13: Bonferroni-corrected OR-detector. Each signal is calibrated at

\alpha=\text{FPR}_{\text{target}}/3

, guaranteeing combined FPR

\leq

target.

	LLaDA-8B			Dream-7B
Signal	$\tau$	Clean	XSTest	$\tau$	Clean	XSTest
$R_{0}$	5.01	5.0%	4.0%	3.61	5.0%	3.2%
SED slope	$-$ 0.097	5.0%	0.0%	$-$ 0.040	5.0%	2.8%
$\Delta E$ slope	$-$ 4.60	5.0%	0.4%	$-$ 2.05	5.0%	3.2%

Appendix

Table 14: FPR on XSTest boundary-benign queries. Thresholds are calibrated at 5% FPR on clean (AlpacaEval) benign queries. XSTest FPR is consistently

\leq

clean FPR.

Model and attack	OR (paper)	max- $z$	sum- $z$	logistic
LLaDA-8B, PAD	0.287	0.295	0.287	0.565
LLaDA-8B, DIJA	0.214	0.224	0.177	0.537
LLaDA-1.5, DIJA	0.098	0.123	0.128	0.298
Dream-7B, PAD	0.912	0.912	0.841	0.780
Realized benign FPR (target $\leq 0.10$ )	0.087 to 0.093	0.100	0.100	0.100

Appendix

Table 15: TPR at guaranteed benign FPR

\leq 10\%

under four aggregation rules, on the settings where OR is weakest plus Dream-7B PAD. Best per row in bold.

Figure 10: PAD titration: generated outputs at

n_{c}=0,1,2

. At

n_{c}\!=\!0

R_{0}

detects, and the model refuses. At

n_{c}\!=\!1

, both signals are evaded, but the output is a stub. At

n_{c}\!=\!2

, PAD induces harmful generation, but trajectory velocity detects the disruption.

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 426 papers

Aug 31, 2026

Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models

Diffusion large language models (dLLMs) generate text through iterative denoising rather than left-to-right decoding. This generation paradigm introduces two axes that can influence safety alignment: when tokens are generated during denoising and where they appear in the response. In this paper, we measure dLLM safety behavior under harmful prompts by tracing intermediate token distributions and commitment decisions throughout denoising. Our analysis shows that refusal signals are concentrated in early denoising steps and leading response positions, and the tokens committed early can strongly shape the final safety outcome. Our measurements further show that the denoising step and persistence of refusal-token commitment are important for understanding dLLM safety. Based on these findings, we propose Refusal-Aware Early Commitment (RAEC), a simple training-free decoding method that commits persistent refusal signals from early steps. Experiments on LLaDA and Dream show that RAEC reduces attack success rates while largely preserving utility. The code is available at https://github.com/Glresearch1/RAEC.

Guoli Wang, Haonan Shi, Tu Ouyang +1

Case Western Reserve University 10900 Euclid Avenue, Cleveland, OH 44106, USA

Language Model Safety Evaluation Diffusion Language Model Decoding Diffusion Language Models Refusal Behavior in Language Models

Ask PDF

Aug 7, 2026

Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

Diffusion Large Language Models (DLLMs) replace autoregressive next-token prediction with iterative parallel denoising, yet their internal safety mechanisms remain poorly understood. In this work, we investigate DLLMs both as targets and as adversaries, exposing mechanistic vulnerabilities in diffusion-based alignment. We first show that safety alignment in DLLMs remains sparse and transferable across architectures. DLLMs initialized from autoregressive predecessors inherit the same mechanistic safety footprint as their source models, enabling transfer attacks via direct safety neuron mapping and pruning. Self-pruning increases attack success rates (ASR) from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream, while transfer pruning from Qwen2.5 increases ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM. Building on these findings, we introduce SN-Guided Diffusion, a fully offline black-box jailbreak framework that steers the diffusion process away from safety-triggering regions using a weighted safety neuron loss, which achieves near-perfect prompt separability (AUROC = 1.0 for benign-vs-jailbreak discrimination). Across multiple open and proprietary targets, our method achieves a transfer ASR of up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite, while requiring only 20 generation episodes per prompt. Compared to prior jailbreaking frameworks, our method achieves competitive transferability with orders-of-magnitude lower generation cost. Our codebase is available at https://github.com/ellyoana/sn-guided-diffusion.

Elena Dumitrescu, Gert Lek, Lydia Y. Chen +1

Delft University of Technology, Delft, The Netherlands · University of Neuchâtel, Neuchâtel, Switzerland.

Adversarial Attacks on LLMs LLM Safety Alignment Mechanistic Interpretability Transfer-Based Adversarial Attacks Diffusion Language Models Adversarial Attacks on Diffusion Models

Ask PDF

Mar 17, 2026

Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models

Safety alignment in diffusion language models (dLLMs) relies on a single load-bearing assumption: that committed tokens are permanent. We show that violating this assumption, by re-masking committed refusal tokens and injecting a short affirmative prefix, achieves 74-82% ASR on HarmBench across all three publicly available safety-tuned dLLMs, rising to 92-98% with a generic 8-token compliance prefix. We call this attack TrajHijack; it is the first trajectory-level attack on dLLMs, requires no gradient computation, and generalizes across SFT and preference-optimized (VRPO) models. Three findings emerge. First, the vulnerability is irreducibly two-component: re-masking alone (4.4%) and prefix alone (5.7%) both fail. Second, gradient optimization via a differentiable Gumbel-softmax chain consistently degrades ASR (41.5% vs. 76.1%), because continuous perturbations push token distributions off-manifold. Third, A2D (the strongest published dLLM defense) is more vulnerable to TrajHijack (89.9%) than the undefended model (76.1%): its silent-refusal training removes the contextual resistance that trajectory-level attacks must overcome, an effect we call the Defense Inversion Effect.

Arth Singh

AIM Intelligence · National Institute of Technology Agartala

Adversarial Attacks on LLMs Adversarial Attacks on Diffusion Models LLM Safety Diffusion Language Models

Ask PDF

Abstract

LLM Safety

Explore similar work

Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models

Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits

Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models