Research map / Adversarial robustness and security / Black-box and transfer attacks

MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

NeurIPS 2026 · Adversarial robustness and security › Black-box and transfer attacks · approach: Data-free substitute training · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MaskForge, a black-box adaptive jailbreak for diffusion LLMs that searches a growing library of structural mask-bearing patterns with a UCB bandit, a scorer-guided fallback, and transfers the frozen library to AdvBench.

Problem

Jailbreaking diffusion LLMs (dLLMs) via their native infilling capability; existing black-box dLLM attacks use static hand-crafted mask templates with no per-goal adaptation or cross-goal experience accumulation.

Approach

Abstracts successful attacks into reusable structural schemas (slot count, slot roles, goal tags), selects goal-compatible patterns with UCB1, falls back to a drafter-generated draft whose policy-violating spans are masked so the victim fills them, and distills successful attempts back into the library.

Key results

• Averaged over five dLLM victims on HarmBench, MaskForge reaches 79.0% ASR and 4.64 HS versus DIJA's 64.8% and 3.57.
• On AdvBench transfer with a frozen library and MaskForge-Embed, average ASR is 88.2% versus 52.8% for PAD and 50.6% for DIJA.
• Against the A2D defense on Dream-Instruct, MaskForge retains 85% ASR while PAD and DIJA drop to 30% and 26%.

Surprising findings

• AR-based AutoDAN matches or exceeds DIJA and PAD on older LLaDA checkpoints in ASR, though with much lower HarmfulScore.
• Fallback ablation shows only a small average ASR change (75.2% full vs 74.3% no-fallback), suggesting the bandit does most of the work once the library is mature.

Limitations

• Constructing the pattern library is computationally costly due to repeated attacker, victim, scorer and fallback calls.
• Relies on the scorer/judge (Qwen3-235B-A22B) for reward and evaluation; results depend on the judge and the authors' own protocol.
• Evaluated only on five open dLLM victims; no evaluation on commercial dLLM APIs.

Experimental setup

Datasets: HarmBench JailbreakBench StrongREJECT AdvBench

Benchmarks: HarmBench JailbreakBench StrongREJECT AdvBench

Metrics: ASR HarmfulScore

Baselines: DIRECT AIM PAIR AutoDAN PAD DIJA

Builds on: DIJA PAD AutoDAN-Turbo UCB1

Closest papers by meaning

• Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis (NeurIPS 2026 · similarity 0.90)
• Scaling up Masked Diffusion Models on Text (ICLR 2025 · similarity 0.88)
• Many-shot Jailbreaking (NeurIPS 2024 · similarity 0.88)
• UnMaskFork: Test-Time Scaling for Masked Diffusion via Deterministic Action Branching (ICML 2026 · similarity 0.88)
• CORE: Context-Robust Remasking for Diffusion Language Models (ICML 2026 · similarity 0.88)
• Fail-Closed Alignment for Large Language Models (NeurIPS 2026 · similarity 0.87)