Researchers have identified mechanistic vulnerabilities within Diffusion Large Language Models (DLLMs), revealing that their safety alignment can be sparse and transferable. This finding enables transfer attacks, which significantly increase the success rates of adversarial prompts. The study, titled "Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits," was published on arXiv.
DLLMs represent an alternative to traditional autoregressive large language models (LLMs) by employing an iterative parallel denoising process for text generation, rather than sequential next-token prediction. Despite this architectural difference, the research suggests that their internal safety mechanisms are not fully understood.
One key finding is that safety alignment in DLLMs is often sparse, meaning that protective measures are not uniformly distributed throughout the model's architecture. Furthermore, this alignment can be transferred across different DLLM architectures. This transferability is particularly evident when DLLMs are initialized from autoregressive predecessors. In such cases, the DLLMs inherit the same mechanistic safety footprint as their source models.
This inheritance allows for "transfer pruning" attacks. Researchers demonstrated that by mapping and pruning specific "safety neurons" from the source autoregressive models, they could compromise the safety of the successor DLLMs. Self-pruning attacks increased the attack success rate (ASR) on LLaDA from 2.6% to 73.8%. LLaDA is an 8-billion-parameter diffusion model trained from scratch, designed to rival models like LLaMA3 8B in performance. It utilizes a masked diffusion process, progressively refining masked text to form coherent responses.
Similarly, on Dream, another diffusion language model, self-pruning raised the ASR from 1.9% to 86.6%. Dream 7B is a diffusion large language model that aims to match or exceed the performance of autoregressive models of similar size across general, mathematical, and coding tasks. Transfer pruning from Qwen2.5, an autoregressive model, increased the ASR on Dream from 1.9% to 73.2%.
These findings indicate that the safety vulnerabilities are not isolated to specific models but can propagate through model lineages. Previous research has explored other attack vectors against DLLMs. One study in January 2026, "Safer by Diffusion, Broken by Context," noted that while DLLMs showed intrinsic robustness against certain jailbreak attacks, this robustness was not absolute and could be bypassed by embedding harmful requests within structured benign contexts. Another paper, "The Devil behind the mask," published in February 2026, introduced a framework called DIJA, which constructs adversarial interleaved mask-text prompts to exploit the bidirectional modeling and parallel decoding mechanisms of DLLMs, achieving high attack success rates.
The current research underscores the need for a deeper understanding of safety mechanisms in DLLMs and suggests that current alignment techniques may not be sufficient to address these mechanistic vulnerabilities. The ability to transfer safety exploits from one model to another, particularly from autoregressive predecessors, presents a challenge for developing secure diffusion-based language models.