Diffusion Language Models for Perplexity-Aware Black-Box Attacks

Ali Al-Lawati; Elsayed Eshra; Dongwon Lee; Suhang Wang

cs.LGOct 22, 2026

Diffusion Language Models for Perplexity-Aware Black-Box Attacks

Authors: Ali Al-Lawati, Elsayed Eshra, Dongwon Lee, Suhang Wang

Organizations: The Pennsylvania State University, USA

Abstract

Continuous-space attacks find prompts that trigger malicious behaviors, such as overthinking, in black-box LLMs by sampling or optimizing over a low-dimensional Gaussian latent space and decoding it to text through a random mapping and nearest-token lookup. Because the random mapping is not learned from language, its prompts can be highly unnatural, and as such easily detectable through input guardrails, and the risk estimates they yield are not grounded in natural prompts. In this paper, we demonstrate that the same continuous latent-space framework can be coupled directly to a learned generative distribution over language, a continuous diffusion language model (dLLM), which removes the artificial random mapping while preserving the standard-Gaussian latent formulation and the downstream sampling or optimization procedure. We evaluate this approach under two settings: sampling-based estimation using RareTrap and optimization-based search using ThinkTrap. We find that character-level perplexity drops from $10^3$ -- $10^7$ to 3--5 in RareTrap and from 20--28 to 4.3--5.4 in ThinkTrap. We also find that model risk estimates can differ by an order of magnitude across the two mappings.

Figures & tables

Figure 1: (Top) The dLLM-based mapping substitutes random mapping, while the search and the target LLM are unchanged. (Bottom) It lowers hit-prompt character perplexity on target models.

Panel of Figure 2 — Figure 2: A latent is mapped to a prompt, the target’s response is scored, and the sampling or optimization procedure uses the score to propose the next latents.

	RareTrap	ThinkTrap
Pipeline	$h_{\mathrm{RP}}\to h_{\mathrm{diff}}$	$h_{\mathrm{RP}}\to h_{\mathrm{diff}}$
Objective	$g(z;\tau)$	$-r(y)$
Search method	Subset Sim.	CMA-ES
Changes	reference dist.	search landscape

Table 1: Only

h_{\mathrm{RP}}

is replaced, while objective, search method, and target model remain unchanged.

Agree (within $2\times$ )
Target	Random mapping	dLLM-based (Ours)
Phi-4-reasoning	$1.000$	$1.000$
Qwen3.5-9B	$0.385$	$0.465$
Qwen3-14B	$3.94\times 10^{-3}$	$2.02\times 10^{-3}$
Lower under the dLLM-based mapping
DeepSeek-R1-Distill-Llama-8B	$0.160$	$1.17\times 10^{-2}$

Table 2: Over-generation probability at

\tau=20{,}000

. Random-mapping values are from RareTrap ( Eshra et al., 2026a ) , and dLLM-based values are medians over three runs (full results in Table 8 ).

Target	Map	Gens.	Best len.	Mean len.	Char. PPL
DeepSeek-R1-8B	Random mapping	34	4,096	$721\to 812$	27.5
DeepSeek-R1-8B	dLLM-based mapping	28	4,096	$842\to 1{,}043$	4.3
Qwen3-14B	Random mapping	39	1,772	$600\to 729$	19.7
Qwen3-14B	dLLM-based mapping	30	2,232	$751\to 862$	5.4
Phi-4-reasoning	Random mapping	16	3,396	$1{,}681\to 1{,}547$	22.7
Phi-4-reasoning	dLLM-based mapping	14	4,038	$1{,}915\to 1{,}837$	4.4

Table 3: ThinkTrap medians over three seeds (per-seed values in Table 9 ). Gens. are generations completed within budget. Mean len. of the first

\to

last five generations. PPL of the 12 longest-output prompts under the target.

Figure 3: Share of total compute spent on the dLLM-based mapping in the ThinkTrap runs.

	Target scorer		Reference scorer
Target	Random	Ours	Random	Ours
DeepSeek-R1-Llama-8B	$6.8\times 10^{6}$	4.9	$2.4\times 10^{4}$	4.7
Phi-4-reasoning	$2.0\times 10^{4}$	3.2	$3.5\times 10^{4}$	3.4
Qwen3.5-9B	$1.5\times 10^{4}$	3.3	$1.7\times 10^{4}$	3.6
Qwen3-14B	$1.7\times 10^{5}$	3.6	$4.2\times 10^{4}$	3.8
Mistral-7B-v0.3	$1.1\times 10^{5}$	3.2	$5.4\times 10^{4}$	3.1

Table 4: Median character-level perplexity of the hit prompts under the random mapping and the dLLM-based mapping (Ours), scored by the target model itself and by a reference scorer (Llama-3.1-8B). The API targets (–) expose no log-probabilities.

			PPL filter		Guard models
Prompts	Count	Char. PPL	1%	5%	Llama G. 3	ProtectAI
Real (OASST1)	735	1.9	1.1	5.0	3.4	0.5
Random mapping hits	805	$3.8\times 10^{4}$	100.0	100.0	20.4	32.3
dLLM-based mapping hits	293	3.6	67.9	94.2	16.4	9.6

Table 5: Percentage of prompts flagged by a character-level perplexity filter calibrated on OASST1 at a 1% or 5% false-positive rate, and by two guard models: Llama Guard 3 and the ProtectAI DeBERTa-v3 prompt-injection guard.

Target	Hits	Level 0	Ratio	Hits	Level 0	Ratio
	Random mapping			Ours
DeepSeek-R1-Llama-8B	–	–	–	148	220	0.67
Qwen3-14B	53	59	0.92	95	220	0.51
Mistral-7B-v0.3	59	58	1.02	286	220	1.01
Nemotron-Nano-9B-v2	50	57	0.87	97	220	0.59
GPT-5.4	40	54	0.79	261	219	0.93

Table 6: Median token-level perplexity (reference scorer) of RareTrap hits and level-0 prompts. Ratio is length-adjusted, with below 1 meaning more natural hits. RareTrap’s DeepSeek run used direct Monte Carlo, so it has no conditional levels.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: One hit prompt (response of at least 20,000 tokens) per target, random mapping left and dLLM-based mapping right, with its character-level perplexity under the reference scorer.

Figure 5: The longest-output prompt per target and mapping in the ThinkTrap runs (first seed), with its output length.

\hookleftarrow

marks a newline.

Target	Prompts	Levels	Hits	Chars	Tokens
DeepSeek-R1-Llama-8B	200	1	32	40	118
Phi-4-reasoning	200	1	200	44	345
Qwen3.5-9B	200	1	77	43	117
Qwen3-14B	2,800	3	81	43	48
Mistral-7B-v0.3	1,900	2	190	44	130
Nemotron-Nano-9B-v2	2,800	3	88	43	126

Appendix

Table 7: RareTrap’s released random-mapping populations. Prompts are all evaluated samples across Subset Simulation levels, and hits are those whose response reached 20,000 tokens. Chars and Tokens are the median prompt length in characters and in the target’s tokens.

	Random	dLLM-based mapping
Target	mapping	Seed 1	Seed 2	Seed 3	Median	95% interval
Phi-4-reasoning	$1.000$	$1.000$	$1.000$	$0.995$	$1.000$	$[0.991,1.000]$
Qwen3.5-9B	$0.385$	$0.425$	$0.465$	$0.485$	$0.465$	$[0.387,0.541]$
Qwen3-14B	$3.94\times 10^{-3}$	$3.53\times 10^{-3}$	$2.02\times 10^{-3}$	$1.09\times 10^{-3}$	$2.02\times 10^{-3}$	$[0.46,8.5]\times 10^{-3}$
DeepSeek-R1-Distill-Llama-8B	$0.160$	$1.39\times 10^{-2}$	$1.17\times 10^{-2}$	$1.12\times 10^{-2}$	$1.17\times 10^{-2}$	$[0.92,1.62]\times 10^{-2}$
Mistral-7B-Instruct-v0.3	$9.04\times 10^{-2}$	$2.00\times 10^{-3}$	$2.86\times 10^{-3}$	$2.11\times 10^{-3}$	$2.11\times 10^{-3}$	$[1.42,3.70]\times 10^{-3}$

Appendix

Table 8: RareTrap estimates per seed under the dLLM-based mapping, with the single published random-mapping run. Intervals are on the

\log_{10}

scale, capped at 1. Olmo-3 entries are upper bounds, since no run reached the threshold.

Target	Map	per seed	95% int.	per seed	per seed	95% int.
		Length gain (tokens)		Best len.	Char. PPL (top 12)
DeepSeek-R1-8B	Random mapping	227 / 142 / $-9$	$[-178,418]$	4,096 / 2,937 / 4,096	39.6 / 18.7 / 27.5	$[10.8,69.3]$
DeepSeek-R1-8B	dLLM-based mapping	201 / 169 / 171	$[136,225]$	4,043 / 4,096 / 4,096	3.6 / 11.3 / 4.3	$[1.2,25.4]$
Qwen3-14B	Random mapping	134 / 83 / 144	$[40,200]$	1,911 / 1,740 / 1,772	26.5 / 19.7 / 19.7	$[14.2,33.4]$
Qwen3-14B	dLLM-based mapping	103 / 90 / 407	$[-245,645]$	2,232 / 1,963 / 2,317	6.7 / 5.4 / 3.8	$[2.5,10.6]$
Phi-4-reasoning	Random mapping	$-135$ / $-11$ / $-114$	$[-250,77]$	3,630 / 3,396 / 3,290	23.7 / 14.7 / 22.7	$[10.3,38.5]$

Appendix

Table 9: ThinkTrap per seed, in the same seed order in every column. Length gain is the mean output length of the last five generations minus that of the first five. Perplexity is over each run’s 12 longest-output prompts, with intervals on the

\log_{10}

scale

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

Quantifying Behavioral Tails in Black-Box Language Models
Sep 27, 2026Elsayed Eshra, Ali Al-Lawati, Dongwon Lee +1Language Model Safety Evaluation LLM Safety
The Pennsylvania State University University Park, PA 16802, USA
MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models
Jun 1, 2026Yingzi Ma, Zhengyue Zhao, Xiaogeng Liu +3Masked Diffusion Models Adversarial Attacks on LLMs
University of Wisconsin-Madison · Johns Hopkins University · Responsible AI Research (RAIR) Centre, The University of Adelaide +1
Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models
Mar 17, 2026Arth SinghAdversarial Attacks on LLMs Adversarial Attacks on Diffusion Models
AIM Intelligence · National Institute of Technology Agartala

Sep 27, 2026J/K move · Enter open · S save

Quantifying Behavioral Tails in Black-Box Language Models

Elsayed Eshra, Ali Al-Lawati, Dongwon Lee, Suhang Wang

The Pennsylvania State University University Park, PA 16802, USA

Language Model Safety Evaluation LLM Safety Rare-Event Estimation

Open paper AskPDF arXiv

We introduce RareTrap, a framework for estimating the probability of severe behaviors in black box large language models (LLMs). A key challenge for probability estimation is defining a tractable distribution over the input space. To accomplish that, RareTrap uses a surrogate LLM and constructs a geometry-aware mapping from a lower-dimensional latent reference space into its token-embedding space to induce an explicit and reproducible distribution over input prompts. A response-level performance function is utilized on the response to quantify behavior severity. This enables sequential rare event simulation that concentrates evaluations on progressively more severe behaviors while preserving probability under the induced prompt distribution, which would otherwise be prohibitive to measure. Across 10 open-weight and two frontier models (GPT-5.4 and Claude Sonnet 4.6), we find that RareTrap successfully induces severe resource consumption behaviors and computes their probability with as few as 200 evaluations. RareTrap provides model developers a principled approach for evaluating language models under a common distribution, and prioritizing alignment effort to improve safety and mitigate risks.

Abstract

Adversarial Attacks on LLMs

Explore similar work

Quantifying Behavioral Tails in Black-Box Language Models

MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models