Diffusion Language Models for Perplexity-Aware Black-Box Attacks

Summary

This paper couples continuous-space black-box attacks on LLMs to a continuous diffusion language model (dLLM), replacing the random latent-to-token mapping used by prior work. Character-level perplexity falls from 10^3 to 10^7 down to 3 to 5 on RareTrap, and from 20 to 28 down to 4.3 to 5.4 on ThinkTrap. The authors also report that model risk estimates can differ by an order of magnitude between the two mappings.

Related items

• InfoAgentPhishing: A Benchmark of LLM Email Agents Under Adaptive AttackSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHarmful Responses Are Jailbreak Templates: Transferring Autoregressive Jailbreaks to Diffusion Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• Medium“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesSimilar attack · Palo Alto Unit 42
• MediumAI Guardrails Aren’t Stopping Criminal HackersSimilar attack · Wired (Security)