Research map / Adversarial robustness and security / Backdoor and poisoning

Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a training-free energy-landscape account of jailbreaks against masked diffusion LLMs and three logit-space detection signals (step-0 refusal/compliance ratio R0, SED slope, and ΔE slope) whose OR-combination detects known attacks on LLaDA and Dream.

Problem

Existing attacks and defenses for diffusion LLMs (dLLMs) target specific vulnerabilities without a shared framework explaining why jailbreaks succeed, and there is no training-free detection that covers both template and mid-trajectory attacks.

Approach

Interprets safety alignment as shaping the denoising energy landscape into basins separated by a barrier; every attack either reveals intent at step 0 (read by a refusal/compliance logit ratio) or must spend kinetic energy crossing the barrier, which is measured by trajectory-velocity slopes in two complementary logit subspaces.

Key results

• R0 separates harmful direct queries from benign queries with AUROC 0.86-0.90 across LLaDA-8B, LLaDA-1.5, and Dream-7B, but gives only 0.15-0.49 on template attacks PAD and DIJA.
• On Dream-7B, PAD detection rises from 0.41 (R0+SED) to 0.95 when the ΔE slope is added to all three signals.
• Under the three-signal combination, no tested attack falls below AUROC 0.83 on any model, and in stress tests every configuration that evades detection also fails to produce harmful content.

Surprising findings

• Step-0 refusal/compliance ratio is nearly blind to template attacks (DIJA AUROC 0.15-0.23 on LLaDA-8B and Dream-7B), while it is strong for harmful direct queries.
• Subspace in which kinetic energy concentrates differs by architecture: PAD is detected via SED on LLaDA-8B but via the ΔE slope on Dream-7B.

Limitations

• Validated only against existing attacks and single-scalar parametric variations; fully white-box adaptive attacks left to future work.
• Depends on per-token factorisation and English vocabulary sets; R0 degrades on Chinese prompts until sets are re-derived.
• Threshold-level recall varies by architecture and falls as generation length grows beyond 128 on LLaDA.

Experimental setup

Datasets: HarmBench AdvBench AlpacaEval XSTest

Benchmarks: HarmBench AdvBench AlpacaEval XSTest

Metrics: AUROC true positive rate at benign-quantile threshold

Baselines: DiffuGuard-SD

Builds on: masked diffusion models energy minimisation (kinetic energy geodesic result) DiffuGuard PAD DIJA Energy-based Diffusion Language Models

Closest papers by meaning

• Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models (NeurIPS 2026 · similarity 0.90)
• MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models (NeurIPS 2026 · similarity 0.90)
• The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (NeurIPS 2025 · similarity 0.90)
• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks (ICML 2025 · similarity 0.89)
• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.88)
• Weak-to-Strong Jailbreaking on Large Language Models (ICML 2025 · similarity 0.88)