Diffusion large language models (dLLMs) enable flexible masked generation through bidirectional context modeling, but this capability also introduces a distinct jailbreak attack surface. We find that a harmful response to a given query naturally serves as an effective jailbreak template: simply masking a subset of its tokens can induce a dLLM to reconstruct harmful content. Based on this observation, we propose RMT-Jailbreak, a general framework that transfers existing autoregressive (AR) jailbreak attacks to dLLMs through their induced harmful responses. RMT-Jailbreak converts an AR-generated harmful response into a high-mask-ratio template using uniform token retention, and further applies prompt-based safety filtering to mask any remaining visible harmful content. The refined template is then provided to the target dLLM for bidirectional reconstruction. Extensive experiments across multiple AR jailbreak methods and target dLLMs demonstrate the effectiveness and generality of RMT-Jailbreak, revealing strong cross-paradigm transferability of jailbreak attacks.
Figures & tables
Mask ratio ρ
ASR (%)
0.3
97.75
0.5
97.00
0.7
96.50
0.9
85.50
Table 1: Attack Success Rate on the HarmBench benchmark using LLaDA-8B-Instruct as the target model.
Figure 1: Overview of RMT-Jailbreak . The method sequentially induces responses from the source AR model, converts them into uniformly masked templates, applies safety filtering, and attacks the target diffusion language model through masked infilling.
Victim Models
LLaDA-Instruct
LLaDA-1.5
Dream-Instruct
MMaDA-MixCoT
Metrics
ASR
HS
ASR
HS
ASR
HS
ASR
HS
Zeroshot
17.7
2.8
16.7
2.9
0.0
2.8
29.0
3.4
GCG ( Zou et al., 2023 )
24.3
1.9
28.3
3.0
6.7
1.5
38.5
2.8
AutoDAN ( Liu et al., 2024 )
11.5
–
12.5
–
6.5
–
0.8
–
AIM ( Wei et al., 2023 )
0.0
1.4
0.0
1.4
0.0
1.0
26.0
2.5
PAIR ( Chao et al., 2025 )
43.6
3.6
41.4
3.6
1.5
1.6
40.0
4.0
Table 2: Jailbreaking evaluation of diffusion language models on HarmBench. ASR (%) denotes the evaluator-based attack success rate, and HS represents the harmfulness score assessed by GPT-4o.
Victim Models
LLaDA-Instruct
LLaDA-1.5
Dream-Instruct
MMaDA-MixCoT
Metrics
ASR
HS
ASR
HS
ASR
HS
ASR
HS
Zeroshot
11.0
1.0
5.0
1.0
0.0
1.0
57.0
2.8
GCG ( Zou et al., 2023 )
27.0
1.9
21.0
2.0
3.0
1.5
32.0
3.3
AutoDAN ( Liu et al., 2024 )
18.0
–
8.0
–
6.0
–
1.0
–
AIM ( Wei et al., 2023 )
–
1.0
–
1.0
–
1.0
–
2.5
PAIR ( Chao et al., 2025 )
14.0
2.1
13.0
3.6
1.0
1.0
26.0
4.4
Table 3: Jailbreaking evaluation of diffusion language models on JailbreakBench. According to the guidelines of JailbreakBench, ASR (%) can be obtained through the evaluator.
Victim Models
LLaDA-Instruct
LLaDA-1.5
Dream-Instruct
MMaDA-MixCoT
Metrics
SRS
HS
SRS
HS
SRS
HS
SRS
HS
Zeroshot
13.4
1.7
14.0
1.8
0.1
1.0
30.0
4.3
GCG ( Zou et al., 2023 )
13.3
1.9
17.2
2.0
0.2
1.0
19.3
3.5
AutoDAN ( Liu et al., 2024 )
2.7
–
3.2
–
2.9
–
2.0
–
AIM ( Wei et al., 2023 )
0.8
1.0
0.5
1.0
0.2
1.0
26.2
3.1
PAIR ( Chao et al., 2025 )
31.5
2.4
32.3
2.5
0.8
1.9
29.4
4.0
Table 4: Jailbreaking evaluation of diffusion language models on StrongREJECT. SRS denotes the StrongREJECT Score rescaled from the original [0, 1] range to [0, 100].
AR attack
Source AR model
Application
LLaDA Instruct
LLaDA 1.5
Dream Instruct
MMaDA MixCoT
RA
–
Direct
9.8
9.0
8.5
6.8
Mistral-7B-Instruct-v0.2
+ RMT
41.3 (+ 31.5)
42.0 (+ 33.0)
39.8 (+ 31.3)
32.0 (+ 25.2)
vicuna-7b-v1.5
+ RMT
28.5 (+ 18.7)
29.0 (+ 20.0)
30.0 (+ 21.5)
22.5 (+ 15.7)
AutoDAN
–
Direct
11.5
12.5
6.5
0.8
Mistral-7B-Instruct-v0.2
+ RMT
76.0 (+ 64.5)
76.5 (+ 64.0)
76.5 (+ 70.0)
61.3 (+ 60.5)
vicuna-7b-v1.5
+ RMT
70.0 (+ 58.5)
70.8 (+ 58.3)
73.0 (+ 66.5)
56.5 (+ 55.7)
Table 5: Attack success rate (ASR, %) on HarmBench. Direct applies the original AR-oriented attack to each target dLLM. + RMT converts a response induced from the specified source AR model into a masked template. Green values denote percentage-point gains over the direct result of the same attack method on the same target dLLM.
AR attack
Source AR model
Application
LLaDA Instruct
LLaDA 1.5
Dream Instruct
MMaDA MixCoT
RA
–
Direct
7.0
4.0
3.0
5.0
Mistral-7B-Instruct-v0.2
+ RMT
21.0 (+14.0)
24.0 (+20.0)
22.0 (+19.0)
22.0 (+17.0)
vicuna-7b-v1.5
+ RMT
14.0 (+7.0)
13.0 (+9.0)
10.0 (+7.0)
22.0 (+17.0)
AutoDAN
–
Direct
18.0
8.0
6.0
1.0
Mistral-7B-Instruct-v0.2
+ RMT
80.0 (+62.0)
81.0 (+73.0)
84.0 (+78.0)
77.0 (+76.0)
vicuna-7b-v1.5
+ RMT
78.0 (+60.0)
81.0 (+73.0)
85.0 (+79.0)
85.0 (+84.0)
Table 6: Attack success rate (ASR, %) on JailbreakBench.
AR attack
Source AR model
Application
LLaDA Instruct
LLaDA 1.5
Dream Instruct
MMaDA MixCoT
RA
–
Direct
18.8
16.9
12.0
16.8
Mistral-7B-Instruct-v0.2
+ RMT
52.9 (+34.1)
52.7 (+35.8)
48.7 (+36.7)
39.8 (+23.0)
vicuna-7b-v1.5
+ RMT
33.2 (+14.4)
33.2 (+16.3)
29.9 (+17.9)
26.0 (+9.2)
AutoDAN
–
Direct
2.7
3.2
2.9
2.0
Mistral-7B-Instruct-v0.2
+ RMT
68.8 (+66.1)
70.4 (+67.2)
66.1 (+63.2)
56.7 (+54.7)
vicuna-7b-v1.5
+ RMT
62.4 (+59.7)
62.9 (+59.7)
59.1 (+56.2)
50.4 (+48.4)
Table 7: StrongREJECT Score (SRS) on four target dLLMs. Direct applies the original AR-oriented attack to each target dLLM.
Figure 2: Comparison of attack templates for LLaDA-8B-Instruct under the same harmful query. The left panel shows the DIJA template, while the right panel shows the RMT-Jailbreak template. Red words indicate the words retained in our template.
Figure 3: Robustness of our method against Self-reminder defense on three victim dLLMs across multiple benchmarks. JBB denotes JailbreakBench.
Figure 4: Comparison of continuous and uniform masking on LLaDA-8B-Instruct at mask ratios of 0.7, 0.8, and 0.9.